GCRI · 系统性风险管理
风险治理与风险偏好
风险治理 decides who owns each risk, how much of it an institution is willing to carry, and how that position is challenged and reported. Appetite statements and tolerances only matter if they shape decisions on strategy, investment and operations. This page sets out how governance arrangements work, where they fail for interconnected risks, and what evidence boards, ministers and supervisors need to set and review an appetite they can defend.
Risk governance and appetite in seven parts.
Risk governance and appetite: how the risk develops.
Authority, objectives and acceptable exposure. The dossier below sets out how the risk develops, what is measured, where the data come from, how it is modelled and who decides.
Ownership fragments across silos
Risks that cross departments, sectors or jurisdictions often have no single owner. Each unit manages its share, and the combined exposure, which sits between them, is reported by nobody.
Appetite is set without measures
An appetite statement written in qualitative terms cannot be checked against exposure. Without tolerances tied to indicators, breaches are noticed late or argued away.
Short horizons crowd out slow risks
Reporting cycles reward attention to near-term, familiar risks. Slow-building and low-frequency risks, such as dependency concentration or climate exposure, receive less scrutiny until they materialise.
Challenge weakens over time
Independent risk functions and non-executive members lose influence when information is filtered, incentives align with growth, or dissent is costly. Governance then confirms decisions rather than testing them.
Risk register.
团队跟踪该主题时会使用的界面：其指标、状态与决策。名称为示例，数值仅作示意。
风险登记册
Risk governance and appetite · Enterprise A · Review cycle Q1
剩余风险
可能性 × 影响，每个单元格的风险数
每个单元格的风险数量。底色按风险偏好区间显示。
超出风险偏好
| 供应商集中度 | 采购 | 高 | ▲ 1 |
| 数据中心受淹 | 运营 | 高 | ▼ 0 |
| 定价中的模型误差 | 金融 | 中 | ▲ 0 |
| 关键人员流失 | 人口 | 中 | ▼ 1 |
依据国际标准的风险管理流程
- 范围、背景、准则设置
- 标识分类体系
- 分析可能性 · 影响
- 评估相对风险偏好
- 处置计划
- 监测与审查KRI
- 记录与报告理事会
处置行动
- T-11双源关键部件负责人：采购 · 已逾期14 天逾期
- T-14将备份站点迁至洪水水位之上负责人：运营due 18 天后到期
- T-17独立模型验证负责人：财务due 15 天后到期
Risk appetite set in one sector constrains the others.
- 水耦合Utility boards set service reliability targets that fix how much drought and outage risk customers carry.What to watchStated levels of service for supply interruptions
- 能源耦合Reserve margins and stockholding obligations express a government’s appetite for supply risk.What to watchReserve margin policy and stock cover
- 卫生耦合Surge capacity decisions set how much shock a health system can absorb.What to watchFunded surge beds and staff
Governance findings are designed for the 全球系统风险与韧性系列. Risk appetite statements are decisions of boards and governments; the page describes how they are made and documented, following ISO 31000 and COSO, and sets none.
- Published risk appetite statements from public bodies, with dates.
- Cases where an appetite set in one sector moved risk to another.
存量、流量、延迟和一个临界阈值。
两个存量，即压力和 适应能力，由一个增强的增长回路、一个延迟的平衡响应以及压力超过能力时产生的损害相连；越过阈值后，系统可能发生突变。这是使用明示示例数值的教学模型，不是预测。
控制措施
- 压力增长
- 每年 6.0%
- 能力在降低压力方面的效力
- 每年 4.0%
- 对感知压力的投资响应
- 20%
- 感知延迟
- 4.0 年
- 压力的临界阈值
- 60 项指数
- 越过阈值后的放大
- 2.0 倍
- 模拟年数
- 50 年
读数
- 峰值压力
- 113 指数
- 期末能力
- 186 指数
- 超过阈值的年数
- 15.8 年
数字、方法与来源
| 年份 | 压力 | 能力 | 感知 |
|---|---|---|---|
| 0 | 20.0 | 50.0 | 20.0 |
| 4 | 23.3 | 44.9 | 21.2 |
| 8 | 27.2 | 42.2 | 24.0 |
| 12 | 31.7 | 42.3 | 27.7 |
| 16 | 36.8 | 45.5 | 32.2 |
| 20 | 42.3 | 51.5 | 37.2 |
| 24 | 47.9 | 60.3 | 42.6 |
| 28 | 53.2 | 71.3 | 48.0 |
| 32 | 57.8 | 84.3 | 53.1 |
| 36 | 66.4 | 98.4 | 58.4 |
| 40 | 82.7 | 115.9 | 69.7 |
| 44 | 97.8 | 139.7 | 83.8 |
| 48 | 109.1 | 169.4 | 97.3 |
方法
- 系统动力学 Forrester (1961), Industrial Dynamics, MIT Press; Sterman (2000), Business Dynamics
- 临界转变与临界点 Scheffer and others (2009), Early-warning signals for critical transitions, Nature 461
- 因果回路图 Sterman (2000), Business Dynamics, McGraw-Hill
- 不确定性扇形图（参数蒙特卡罗） Spiegelhalter, Pearson and Short (2011), Visualising uncertainty about the future, Science 333
- 单因素敏感性（龙卷风图） Saltelli and others (2008), Global Sensitivity Analysis: The Primer, Wiley
数据
No observed data enters this model: it runs on the teaching values set by the controls, to be replaced with a programme’s own evidence.
贯穿六大支柱，由 Nexus Consortium 牵头
- 实验 实验室
- 构建于 Foundry 中的系统性风险管理
- 检验地点 Universe 中的系统性风险管理
- 编入 Standards 中的系统性风险
- 发表于 Reports 中的系统性风险管理
- 授课于 Academy 中的风险科学与方法学院
衡量什么，以及衡量得如何。
每个指标都注明其单位、频率、背后的来源类型以及数值将附带的证据标签。此处不显示数值：数值由计划依据其自身权限提供。
| 指标 | 单位 | 节奏 | 来源类型 | 标签 |
|---|---|---|---|---|
| Risks with a named owner | percent of register entries | 每季度 | 风险登记册 | 已报告 |
| Exposure against tolerance | ratio of measured exposure to stated tolerance | per reporting cycle | Risk reporting to the board or cabinet | 已报告 |
| Tolerance breaches escalated on time | percent of breaches escalated within the defined period | 每季度 | Escalation logs | 已报告 |
| Cross-cutting risks with joint ownership | count of risks with a cross-unit owner | 年度 | 风险治理 charters | 已声明 |
| Board time on principal risks | share of agenda time | 年度 | Board minutes and committee records | 已报告 |
| Open audit findings on risk governance | count by age band | 每季度 | Internal audit tracking | 已报告 |
How risk governance and appetite is modelled, measured and tested.
模型、其假设、数据和不确定性，以科学家或工程师会核查的形式呈现。结构遵循已发表的方法。所取数值仅为示意，不是研究发现。
模型、方程与假设
The model structure used for risk governance and appetite, the assumptions it makes and how each is tested.
Ri = f(Hi, Ei, Vi, Ci)危害、风险暴露、脆弱性和应对能力EAL = ∑k pk · Lk对年概率为 pkxt+1 = A xt + B ut + εtA carries the couplings, u the shock, ε the error| 假设 | 为何制作 | 如何检验 |
|---|---|---|
| 在一次事件中，危害与暴露相互独立 | 使损失积分保持可计算 | 与基于联合记录拟合的 copula 进行比较 |
| 耦合在工作点附近是线性的 | 让冲击通过 A 传播 | 在线性范围之外施加扰动并比较 |
| 脆弱性曲线可以在不同地点之间迁移使用 | 很少有本地曲线可用 | 在有观测损失的地方据此进行验证 |
- 输入
- 带溯源信息的版本化数据集
- 成果
- 分布，绝不是单一数字
- 代码
- 连同模型卡和测试一起发布
- 复现
- 相同的数据、代码、环境和随机种子
证据来自何处。
具名公共数据集与机构记录，各自注明许可类别。依协议获得的来源仅按其条款使用，绝不再次发布。
| 来源 | 它提供什么 | 许可类别 |
|---|---|---|
| ISO 31000 and its handbook | Principles and framework language for governance, roles and integration | Licensed standard, purchase required |
| COSO 企业风险管理框架 | Components and principles on governance, culture and appetite | Licensed publication, purchase required |
| OECD Recommendation on the Governance of Critical Risks and its implementation reports | Country practice on national 风险治理 and coordination | Public, OECD terms of use |
| Published annual reports and principal risk disclosures | How organisations describe their risks, appetite and governance | 公共记录，条款因发布方而异 |
| National audit office reports on risk management in government | Independent findings on how public bodies govern risk | Public records, licence per office (to check) |
由谁决定，以及证据服务于什么。
系统性风险 Management prepares evidence. The decisions below are taken by the authorities named, under their own rules, and never by the platform.
| 谁来决定 | 问题 | 本页面服务的证据 |
|---|---|---|
| Boards and risk committees | What level of each principal risk the organisation accepts, and when a breach triggers action | Appetite templates; exposure against tolerance; ownership gaps |
| Cabinet offices and centres of government | Who coordinates national risks that cross ministries | Ownership maps of cross-cutting risks; peer country governance practice |
| Supervisors and regulators | Whether a regulated entity’s 风险治理 is adequate for its exposures | Governance reviews against named principles; escalation records |
| Internal audit functions | Which risk governance processes to examine next | Open findings; areas with weak ownership or untested tolerances |
该主题产生的产出
- Risk ownership maps that show cross-cutting exposures and their gaps
- Appetite and tolerance templates linked to measurable indicators
- Governance reviews framed against ISO 31000 and COSO principles
- Briefing notes for boards and cabinet committees on systemic exposures
治理专家提出的问题。
- Who has authority to accept a given risk, and is that authority clear before a crisis rather than improvised during one?
- Is the stated 风险偏好 connected to real limits, budgets and decisions, or is it a statement no one uses?
- How are risks that the organisation shares with others, or imposes on others, reflected in its appetite?
- How does the board or council learn when exposure is drifting beyond what it agreed?
Why governance fails.
Post-event reviews of major failures repeatedly find that warning signs existed inside the organisation. The failure was not a lack of information but of authority, incentives and channels that would have carried that information to someone able and willing to act.
Diffuse ownership
Risks that cross departments or organisations have no single owner, so no one is accountable when they materialise.
短期展望
Rewards for near-term performance can favour risks whose costs arrive later or fall on others.
Filtered reporting
Bad news is softened as it moves upward, so leaders see a calmer picture than staff do.
How governance and appetite are designed and tested.
- 01
Appetite frameworks
Statements of appetite translated into tolerances and limits for specific risk types. They work best where risks can be measured and worst for novel or shared risks.
- 02
Lines of defence
Separation of risk-taking, risk oversight and independent assurance. The model clarifies roles but can encourage box-ticking if not used thoughtfully.
- 03
决策分析
不确定性下的决策分析 makes trade-offs and values explicit. It depends on honest elicitation of preferences.
- 04
Governance reviews
Post-event and periodic reviews test whether governance worked as designed. They are only as useful as the willingness to act on them.
Where this page’s references lead.
阅读本页时所对照的机构和文件。状态和版本会变化；每个链接都指向发布机构。
问题与解答。
What is risk appetite?
How is risk tolerance different from appetite?
Who should own a systemic risk?
Is a risk appetite statement required?
Can an organisation have appetite for systemic risk?
Does the platform review organisations’ governance?
从本页贡献证据。
报告 is the Consortium’s quarterly publication. What you know about this subject can become evidence, a case or a correction in the next edition, credited to you and published under CC BY 4.0 where it is your own work.
- 电子邮件网关 GW-GCRI从本页发送证据、更正、案例、方法、审查、翻译或概况投稿。它会带上本页标签送达，由负责的编辑接收。
- Zenodo开放存缴存缴并提交到社区用您的 ORCID iD 在 Zenodo 上发布您自己的记录，然后提交到那里的 Reports 社区。由策展人审核；DOI 仍归您所有。
- 报告GCRI查看所有贡献方式贡献类型、各自的评审方式、您获得的署名、许可协议，以及绝不接受的内容。
切勿发送个人数据、敏感基础设施细节或您无权分享的任何内容。贡献在使用前会经过审查；发送贡献不赋予署名权或编辑权，赞助也绝不能换取研究结论。
法律文件。
本网站上的地图、数据和图表仅作为背景和一般信息展示。它们不是建议、预测或预警；信息的局限见免责声明和数据说明。