Skip to content

GCRI · 系统性风险管理

风险治理与风险偏好

风险治理 decides who owns each risk, how much of it an institution is willing to carry, and how that position is challenged and reported. Appetite statements and tolerances only matter if they shape decisions on strategy, investment and operations. This page sets out how governance arrangements work, where they fail for interconnected risks, and what evidence boards, ministers and supervisors need to set and review an appetite they can defend.

提出咨询 返回主题
01目录

Risk governance and appetite in seven parts.

本档案内容7 个部分
  1. 01问题Risk governance and appetite: how the risk develops
  2. 02跨领域Risk appetite set in one sector constrains the others
  3. 03指标衡量什么，以及衡量得如何
  4. 04来源证据的来源
  5. 05决定由谁决定，以及证据服务于什么
  6. 06核心问题治理专家提出的问题
  7. 07机制Why governance fails
02问题

Risk governance and appetite: how the risk develops.

Authority, objectives and acceptable exposure. The dossier below sets out how the risk develops, what is measured, where the data come from, how it is modelled and who decides.

机制

Ownership fragments across silos

Risks that cross departments, sectors or jurisdictions often have no single owner. Each unit manages its share, and the combined exposure, which sits between them, is reported by nobody.

机制

Appetite is set without measures

An appetite statement written in qualitative terms cannot be checked against exposure. Without tolerances tied to indicators, breaches are noticed late or argued away.

机制

Short horizons crowd out slow risks

Reporting cycles reward attention to near-term, familiar risks. Slow-building and low-frequency risks, such as dependency concentration or climate exposure, receive less scrutiny until they materialise.

机制

Challenge weakens over time

Independent risk functions and non-executive members lose influence when information is filtered, incentives align with growth, or dissent is costly. Governance then confirms decisions rather than testing them.

03监测

Risk register.

团队跟踪该主题时会使用的界面：其指标、状态与决策。名称为示例，数值仅作示意。

风险登记册

Risk governance and appetite · Enterprise A · Review cycle Q1

三项高于风险偏好的风险GCRI · 系统性风险管理

剩余风险

可能性 × 影响，每个单元格的风险数

每个单元格的风险数量。底色按风险偏好区间显示。

超出风险偏好

供应商集中度采购高▲ 1
数据中心受淹运营高▼ 0
定价中的模型误差金融中▲ 0
关键人员流失人口中▼ 1

依据国际标准的风险管理流程

  1. 范围、背景、准则设置
  2. 标识分类体系
  3. 分析可能性 · 影响
  4. 评估相对风险偏好
  5. 处置计划
  6. 监测与审查KRI
  7. 记录与报告理事会

处置行动

  1. T-11双源关键部件负责人：采购 · 已逾期14 天逾期
  2. T-14将备份站点迁至洪水水位之上负责人：运营due 18 天后到期
  3. T-17独立模型验证负责人：财务due 15 天后到期
Risk register: the screen’s structure, terms and states for Risk governance and appetite.示例名称和示意数值；是设计方案，并非记录或实时系统。
04跨领域

Risk appetite set in one sector constrains the others.

Governance findings are designed for the 全球系统风险与韧性系列. Risk appetite statements are decisions of boards and governments; the page describes how they are made and documented, following ISO 31000 and COSO, and sets none.

  • Published risk appetite statements from public bodies, with dates.
  • Cases where an appetite set in one sector moved risk to another.
05模拟器

存量、流量、延迟和一个临界阈值。

两个存量，即压力和 适应能力，由一个增强的增长回路、一个延迟的平衡响应以及压力超过能力时产生的损害相连；越过阈值后，系统可能发生突变。这是使用明示示例数值的教学模型，不是预测。

控制措施

压力增长
每年 6.0%
能力在降低压力方面的效力
每年 4.0%
对感知压力的投资响应
20%
感知延迟
4.0 年
压力的临界阈值
60 项指数
越过阈值后的放大
2.0 倍
模拟年数
50 年

读数

峰值压力
113 指数
期末能力
186 指数
超过阈值的年数
15.8 年
数字、方法与来源
年份压力能力感知
020.050.020.0
423.344.921.2
827.242.224.0
1231.742.327.7
1636.845.532.2
2042.351.537.2
2447.960.342.6
2853.271.348.0
3257.884.353.1
3666.498.458.4
4082.7115.969.7
4497.8139.783.8
48109.1169.497.3

方法

  1. 系统动力学 Forrester (1961), Industrial Dynamics, MIT Press; Sterman (2000), Business Dynamics
  2. 临界转变与临界点 Scheffer and others (2009), Early-warning signals for critical transitions, Nature 461
  3. 因果回路图 Sterman (2000), Business Dynamics, McGraw-Hill
  4. 不确定性扇形图（参数蒙特卡罗） Spiegelhalter, Pearson and Short (2011), Visualising uncertainty about the future, Science 333
  5. 单因素敏感性（龙卷风图） Saltelli and others (2008), Global Sensitivity Analysis: The Primer, Wiley

数据

No observed data enters this model: it runs on the teaching values set by the controls, to be replaced with a programme’s own evidence.

存量、流量、延迟和临界阈值。示意性教学模型：它依据控件设定的数值运行，而非实测数据。方法：System dynamics (Forrester (1961), Industrial Dynamics, MIT Press; Sterman (2000), Business Dynamics)；Critical transitions and tipping points (Scheffer and others (2009), Early-warning signals for critical transitions, Nature 461)；Causal loop diagram (Sterman (2000), Business Dynamics, McGraw-Hill)。

贯穿六大支柱，由 Nexus Consortium 牵头

06指标

衡量什么，以及衡量得如何。

每个指标都注明其单位、频率、背后的来源类型以及数值将附带的证据标签。此处不显示数值：数值由计划依据其自身权限提供。

指标单位节奏来源类型标签
Risks with a named ownerpercent of register entries每季度风险登记册已报告
Exposure against toleranceratio of measured exposure to stated toleranceper reporting cycleRisk reporting to the board or cabinet已报告
Tolerance breaches escalated on timepercent of breaches escalated within the defined period每季度Escalation logs已报告
Cross-cutting risks with joint ownershipcount of risks with a cross-unit owner年度风险治理 charters已声明
Board time on principal risksshare of agenda time年度Board minutes and committee records已报告
Open audit findings on risk governancecount by age band每季度Internal audit tracking已报告
07方法与证据

How risk governance and appetite is modelled, measured and tested.

模型、其假设、数据和不确定性，以科学家或工程师会核查的形式呈现。结构遵循已发表的方法。所取数值仅为示意，不是研究发现。

模型、方程与假设

The model structure used for risk governance and appetite, the assumptions it makes and how each is tested.

要素 i 的风险Ri = f(Hi, Ei, Vi, Ci)危害、风险暴露、脆弱性和应对能力
预期年度损失EAL = ∑k pk · Lk对年概率为 pk
耦合系统xt+1 = A xt + B ut + εtA carries the couplings, u the shock, ε the error
假设为何制作如何检验
在一次事件中，危害与暴露相互独立使损失积分保持可计算与基于联合记录拟合的 copula 进行比较
耦合在工作点附近是线性的让冲击通过 A 传播在线性范围之外施加扰动并比较
脆弱性曲线可以在不同地点之间迁移使用很少有本地曲线可用在有观测损失的地方据此进行验证
输入
带溯源信息的版本化数据集
成果
分布，绝不是单一数字
代码
连同模型卡和测试一起发布
复现
相同的数据、代码、环境和随机种子
标准的风险与状态空间表述；所列假设是该方法的典型假设，供审查之用，并非结果。
FAIR 指导原则 · GO FAIR 和 FORCE11W3C PROV · 万维网联盟关于一致处理不确定性的指南 · IPCCCEOS 分析就绪数据 · 地球观测卫星委员会
08来源

证据来自何处。

具名公共数据集与机构记录，各自注明许可类别。依协议获得的来源仅按其条款使用，绝不再次发布。

来源它提供什么许可类别
ISO 31000 and its handbookPrinciples and framework language for governance, roles and integrationLicensed standard, purchase required
COSO 企业风险管理框架Components and principles on governance, culture and appetiteLicensed publication, purchase required
OECD Recommendation on the Governance of Critical Risks and its implementation reportsCountry practice on national 风险治理 and coordinationPublic, OECD terms of use
Published annual reports and principal risk disclosuresHow organisations describe their risks, appetite and governance公共记录，条款因发布方而异
National audit office reports on risk management in governmentIndependent findings on how public bodies govern riskPublic records, licence per office (to check)
09决定

由谁决定，以及证据服务于什么。

系统性风险 Management prepares evidence. The decisions below are taken by the authorities named, under their own rules, and never by the platform.

谁来决定问题本页面服务的证据
Boards and risk committeesWhat level of each principal risk the organisation accepts, and when a breach triggers actionAppetite templates; exposure against tolerance; ownership gaps
Cabinet offices and centres of governmentWho coordinates national risks that cross ministriesOwnership maps of cross-cutting risks; peer country governance practice
Supervisors and regulatorsWhether a regulated entity’s 风险治理 is adequate for its exposuresGovernance reviews against named principles; escalation records
Internal audit functionsWhich risk governance processes to examine nextOpen findings; areas with weak ownership or untested tolerances

该主题产生的产出

  • Risk ownership maps that show cross-cutting exposures and their gaps
  • Appetite and tolerance templates linked to measurable indicators
  • Governance reviews framed against ISO 31000 and COSO principles
  • Briefing notes for boards and cabinet committees on systemic exposures
10核心问题

治理专家提出的问题。

  • Who has authority to accept a given risk, and is that authority clear before a crisis rather than improvised during one?
  • Is the stated 风险偏好 connected to real limits, budgets and decisions, or is it a statement no one uses?
  • How are risks that the organisation shares with others, or imposes on others, reflected in its appetite?
  • How does the board or council learn when exposure is drifting beyond what it agreed?
11机制

Why governance fails.

Post-event reviews of major failures repeatedly find that warning signs existed inside the organisation. The failure was not a lack of information but of authority, incentives and channels that would have carried that information to someone able and willing to act.

权限

Diffuse ownership

Risks that cross departments or organisations have no single owner, so no one is accountable when they materialise.

Incentives

短期展望

Rewards for near-term performance can favour risks whose costs arrive later or fall on others.

信息

Filtered reporting

Bad news is softened as it moves upward, so leaders see a calmer picture than staff do.

12方法与局限

How governance and appetite are designed and tested.

  1. 01

    Appetite frameworks

    Statements of appetite translated into tolerances and limits for specific risk types. They work best where risks can be measured and worst for novel or shared risks.

  2. 02

    Lines of defence

    Separation of risk-taking, risk oversight and independent assurance. The model clarifies roles but can encourage box-ticking if not used thoughtfully.

  3. 03

    决策分析

    不确定性下的决策分析 makes trade-offs and values explicit. It depends on honest elicitation of preferences.

  4. 04

    Governance reviews

    Post-event and periodic reviews test whether governance worked as designed. They are only as useful as the willingness to act on them.

13方法

如何研究，以及方法无法说明的内容。

  1. 不确定性下的决策分析多准则处置选择 · 用于应急计划的决策树在此应用
    规范 · STEM Commons
  2. 不确定性量化与模型验证输入不确定性的传播 · 区分不确定性的类型 · 深度不确定性框架在此应用
    规范 · STEM Commons
  3. 概率与统计频率与严重度建模 · 风险之间的相依性 · 数据与判断的结合在此应用
    规范 · STEM Commons
14Where this page’s references

Where this page’s references lead.

阅读本页时所对照的机构和文件。状态和版本会变化；每个链接都指向发布机构。

15问题

问题与解答。

What is risk appetite?
The amount and type of risk an organisation is willing to pursue or retain in pursuit of its objectives. It is usually expressed in a statement and made operational through tolerances and limits tied to measures.
How is risk tolerance different from appetite?
Appetite is the broad position; tolerance is the acceptable variation around a specific objective or measure. Tolerances make an appetite checkable, because exposure can be compared with them each reporting cycle.
Who should own a systemic risk?
Someone with authority over the dependencies that carry it. Where no single unit has that authority, governance needs a joint owner or a coordinating body, with the arrangement written down.
Is a risk appetite statement required?
In some regulated sectors, supervisors expect one. Elsewhere it is a choice. Its value depends on whether it shapes real decisions.
Can an organisation have appetite for systemic risk?
It can decide how much exposure to shared risks it will carry, but it cannot decide alone how much risk the system bears. That requires coordination with others.
Does the platform review organisations’ governance?
No. It publishes methods and evidence and does not audit or rate any organisation.
报告贡献

从本页贡献证据。

报告 is the Consortium’s quarterly publication. What you know about this subject can become evidence, a case or a correction in the next edition, credited to you and published under CC BY 4.0 where it is your own work.

GCRI系统性风险管理情景与压力测试方法与技术组合与准备度

切勿发送个人数据、敏感基础设施细节或您无权分享的任何内容。贡献在使用前会经过审查；发送贡献不赋予署名权或编辑权，赞助也绝不能换取研究结论。

系统性风险管理

带来一种方法、一个数据集或一个问题。

信息和咨询现已开放。每项咨询都会获得一个编号，并告知下一步；申请、付款、算力分配和注册只有在相应团队、条款和审查能力就绪时才会开放。

提出一种方法 查看全部联系途径
法律

本网站上的地图、数据和图表仅作为背景和一般信息展示。它们不是建议、预测或预警；信息的局限见免责声明和数据说明。