Skip to content

GCRI · 系统性风险管理

保证与更正

Assurance asks whether risk management works as described; correction makes sure that when it does not, records and decisions change. Internal audit, independent review, incident investigation and learning 系统 provide the checks. This page sets out how assurance is organised, why it can miss systemic weaknesses, and how corrections are recorded so that the evidence behind a decision stays traceable after the facts change.

提出咨询 返回主题
01登记

Assurance and correction on the record.

档案Systemic Risk Management · topic
  1. 01问题4 种机制
  2. 02领域六边形场图版
  3. 03指标6
  4. 04来源5
  5. 05决策者3
  6. 06方法3
02问题

Assurance and correction: how the risk develops.

Evidence, review and methods correction. The dossier below sets out how the risk develops, what is measured, where the data come from, how it is modelled and who decides.

机制

Assurance tests what it is shown

Reviews examine the processes and records put in front of them. Risks that fall outside the scope, or between the scopes of several reviewers, go untested.

机制

Investigations stop at the first cause

Incident reviews that end at the person or component closest to the failure miss the organisational and design conditions behind it. Those conditions remain and produce the next incident.

机制

Corrections must reach the record

When an assumption, dataset or model proves wrong, decisions built on it need revisiting. Without versioned records, the correction is made in one place and the error persists elsewhere.

机制

Actions decay before closure

Audit and incident actions are agreed, then deferred as priorities shift. Overdue actions accumulate and the weaknesses they were meant to fix stay open.

03监测

Risk register.

团队跟踪该主题时会使用的界面：其指标、状态与决策。名称为示例，数值仅作示意。

风险登记册

Assurance and correction · Enterprise A · Review cycle Q4

三项高于风险偏好的风险GCRI · 系统性风险管理

剩余风险

可能性 × 影响，每个单元格的风险数

每个单元格的风险数量。底色按风险偏好区间显示。

超出风险偏好

供应商集中度采购高▲ 2
数据中心受淹运营高▲ 0
定价中的模型误差金融中▲ 1
关键人员流失人口中▼ 1

依据国际标准的风险管理流程

  1. 范围、背景、准则设置
  2. 标识分类体系
  3. 分析可能性 · 影响
  4. 评估相对风险偏好
  5. 处置计划
  6. 监测与审查KRI
  7. 记录与报告理事会

处置行动

  1. T-11双源关键部件负责人：采购 · 已逾期9 天逾期
  2. T-14将备份站点迁至洪水水位之上负责人：运营due 14 天后到期
  3. T-17独立模型验证负责人：财务due 20 天后到期
Risk register: the screen’s structure, terms and states for Assurance and correction.示例名称和示意数值；是设计方案，并非记录或实时系统。
04跨领域

Assurance checks that risk evidence in every domain can be trusted.

Assurance practice is designed for the 方法与技术系列. The Three Lines Model of 2020 separates management, risk oversight and independent assurance; verification evidence would follow NS-11 of the proposed Nexus Standards.

  • Published audit and correction records.
  • Lessons where assurance missed a failure.
05方法与证据

How assurance and correction is modelled, measured and tested.

模型、其假设、数据和不确定性，以科学家或工程师会核查的形式呈现。结构遵循已发表的方法。所取数值仅为示意，不是研究发现。

模型、方程与假设

The model structure used for assurance and correction, the assumptions it makes and how each is tested.

要素 i 的风险Ri = f(Hi, Ei, Vi, Ci)危害、风险暴露、脆弱性和应对能力
预期年度损失EAL = ∑k pk · Lk对年概率为 pk
耦合系统xt+1 = A xt + B ut + εtA carries the couplings, u the shock, ε the error
假设为何制作如何检验
在一次事件中，危害与暴露相互独立使损失积分保持可计算与基于联合记录拟合的 copula 进行比较
耦合在工作点附近是线性的让冲击通过 A 传播在线性范围之外施加扰动并比较
脆弱性曲线可以在不同地点之间迁移使用很少有本地曲线可用在有观测损失的地方据此进行验证
输入
带溯源信息的版本化数据集
成果
分布，绝不是单一数字
代码
连同模型卡和测试一起发布
复现
相同的数据、代码、环境和随机种子
标准的风险与状态空间表述；所列假设是该方法的典型假设，供审查之用，并非结果。
FAIR 指导原则 · GO FAIR 和 FORCE11W3C PROV · 万维网联盟关于一致处理不确定性的指南 · IPCCCEOS 分析就绪数据 · 地球观测卫星委员会
06指标

衡量什么，以及衡量得如何。

每个指标都注明其单位、频率、背后的来源类型以及数值将附带的证据标签。此处不显示数值：数值由计划依据其自身权限提供。

指标单位节奏来源类型标签
Principal risks covered by assurancepercent of principal risks reviewed in the cycle年度Assurance maps已报告
Overdue audit actionscount by age band每季度Audit action tracking已报告
Incident investigations reaching organisational factorspercent of investigations年度Investigation reports已报告
Corrections issued to published risk evidencecount with reason recorded持续Correction log观测
Repeat incidentscount of incidents with a previously identified cause年度事件数据库观测
Independent reviews of the risk frameworkdate of last external review每次审查Governance records已声明
07来源

证据来自何处。

具名公共数据集与机构记录，各自注明许可类别。依协议获得的来源仅按其条款使用，绝不再次发布。

来源它提供什么许可类别
Global Internal Audit StandardsRequirements for internal audit independence, planning and reporting, from The Institute of Internal AuditorsPublic, IIA terms of use
The IIA Three Lines ModelRoles of management, risk functions and internal audit in assurancePublic, IIA terms of use
National audit office reportsIndependent public sector audit findings on risk and resiliencePublic records, licence per office
Safety investigation board reportsInvestigations that trace organisational and systemic factorsPublic records, terms per board
Retraction Watch databaseRecords of retracted and corrected research used in evidence basesOpen, Crossref terms (to check)
08决定

由谁决定，以及证据服务于什么。

系统性风险 Management prepares evidence. The decisions below are taken by the authorities named, under their own rules, and never by the platform.

谁来决定问题本页面服务的证据
Audit committeesWhether assurance over principal risks is sufficient and independentAssurance maps; overdue actions; external review dates
Chief audit executivesWhere to direct audit effort in the next planCoverage gaps; repeat incidents
Public accounts committees and legislaturesWhether public bodies have acted on findingsAudit office reports; action status

该主题产生的产出

  • Assurance maps that show coverage gaps across lines and reviewers
  • Investigation protocols that trace organisational and design factors
  • Correction and versioning procedures for published risk evidence
  • Action tracking templates with ageing and escalation
09核心问题

What assurance experts ask.

  • Is the evidence that controls work independent of the people who run them?
  • Are models validated against data they were not built on, and are their limits documented?
  • When an error is found, is it corrected openly, with a record of what changed and why?
  • Do near misses and small failures lead to learning, or are they explained away?
  • Who checks the checkers: is there a route for staff and outsiders to raise concerns that bypasses the line being reviewed?
  • Are corrections traced through to every decision, report and model that relied on the flawed result?
10机制

Why assurance weakens.

Assurance tends to erode quietly. Reviews become routine, findings repeat from one cycle to the next and the people being reviewed learn what reviewers look for. Major failures often follow years of assurance reports that described controls as effective.

独立性

Too close to the work

Reviewers who depend on those they review, or who designed the controls, find fewer problems.

Form over substance

Checking the paperwork

Assurance that checks whether processes are documented rather than whether they work.

Silent edits

Unrecorded change

Methods and models changed without records, so no one can tell what earlier results relied on.

11方法与局限

How assurance and correction work.

  1. 01

    模型验证

    Independent testing of models against data, benchmarks and expert review, using uncertainty quantification and model validation. Limits: validation is harder for models of rare events.

  2. 02

    Internal and external audit

    Independent review of controls and governance. Limits: audit samples, and its findings depend on scope.

  3. 03

    Version control and provenance

    Records of data, code and method versions behind each result. Limits: requires discipline to maintain.

  4. 04

    Open correction

    Published corrections with reasons and dates. Limits: requires a culture that values correction over reputation.

12方法

如何研究，以及方法无法说明的内容。

  1. 不确定性下的决策分析多准则处置选择 · 用于应急计划的决策树在此应用
    规范 · STEM Commons
  2. 概率与统计频率与严重度建模 · 风险之间的相依性 · 数据与判断的结合在此应用
    规范 · STEM Commons
  3. 不确定性量化与模型验证输入不确定性的传播 · 区分不确定性的类型 · 深度不确定性框架在此应用
    规范 · STEM Commons
13Where this page’s references

Where this page’s references lead.

阅读本页时所对照的机构和文件。状态和版本会变化；每个链接都指向发布机构。

14问题

问题与解答。

What does assurance mean in risk management?
An objective examination that gives a stated level of confidence that risk management, controls and governance operate as intended, provided by internal audit, external reviewers or other independent functions.
Why trace organisational factors in investigations?
Because the conditions that allowed a failure, such as design, staffing, incentives and procedures, usually outlast the individual event. Fixing only the immediate cause leaves them in place.
How are corrections handled on these pages?
Each correction to published evidence is recorded with its date, what changed and why, and earlier versions remain traceable, so readers can see how evidence evolved.
Why publish corrections openly?
Because others may have relied on the earlier result. A visible correction lets them check whether their conclusions still hold.
Is assurance the same as audit?
Audit is one form of assurance. Model validation, peer review and independent challenge are others.
Can the platform provide assurance on my risk management?
No. It does not audit, validate or certify any organisation’s risk management.
报告贡献

从本页贡献证据。

报告 is the Consortium’s quarterly publication. What you know about this subject can become evidence, a case or a correction in the next edition, credited to you and published under CC BY 4.0 where it is your own work.

GCRI系统性风险管理情景与压力测试方法与技术组合与准备度

切勿发送个人数据、敏感基础设施细节或您无权分享的任何内容。贡献在使用前会经过审查；发送贡献不赋予署名权或编辑权，赞助也绝不能换取研究结论。

系统性风险管理

带来一种方法、一个数据集或一个问题。

信息和咨询现已开放。每项咨询都会获得一个编号，并告知下一步；申请、付款、算力分配和注册只有在相应团队、条款和审查能力就绪时才会开放。

提出一种方法 查看全部联系途径
法律

本网站上的地图、数据和图表仅作为背景和一般信息展示。它们不是建议、预测或预警；信息的局限见免责声明和数据说明。