GB/T 24353-2022Risk management - Guidelines (English PDF)

foreword

This document is in accordance with the provisions of GB/T 1.1-2020 "Guidelines for Standardization Work Part 1.Structure and Drafting Rules of Standardization Documents"

drafted.

This document replaces GB/T 24353-2009 "Risk Management Principles and Implementation Guidelines". Compared with GB/T 24353-2009, except

In addition to editorial changes, the main technical changes are as follows.

--- Added eight terms in Chapter 3 (see 3.1~3.8);

--- Changed the content of Chapter 4, adjusted the number of principles (see Chapter 4, Chapter 4 of the.2009 edition), supplemented the content of the principles

content, a schematic diagram of the principles has been added (see Chapter 4).

--- Chapter 5 is changed from "Risk Management Process" to "Framework"; Chapter 6 is changed from "Implementation of Risk Management" to "Process" (see Chapter 5, Section 6).

Chapter 6, Chapters 5 and 6 of the.2009 edition).

This document is equivalent to ISO 31000.2018 "Guidelines for Risk Management".

The following minimal editorial changes have been made to this document.

Added the description "Note" in Clause 4a).

Introduction

Organizations of any type and size are affected by a variety of internal and external factors, leading to uncertainty in the achievement of their goals. these items

The standard is related to various activities in the organization from strategic decision-making to operation, which is manifested in various aspects such as strategy, operation, finance, environment, society, reputation and so on.

Risk management by taking into account uncertainty and its impact on objectives, and taking appropriate actions, contributes to the organization's decision-making and operations as well as effective

Provide support for various emergencies. Risk management aims to ensure that the organization appropriately responds to risks, to improve the efficiency and effectiveness of risk response, and to enhance

The rationality of decisions and actions, and the efficient allocation of resources.

Managing risk is a cyclical process that helps organizations formulate strategies, achieve goals and make sound decisions. managing risk is

Part of organizational governance and leadership that provides the basis for management at all levels of the organization and contributes to the improvement of the management system. managing risk is

An integral part of the organization of all relevant activities, including communication with stakeholders.

Risk management takes into account the internal and external environment of the organization, including human behavior and cultural factors.

Figure 1 lists the principles, frameworks and processes underlying risk management. These principles, frameworks and processes may already exist in whole or in part

within the organization, but can be adjusted or improved as needed to manage risk effectively, efficiently and consistently.

This document is designed to help organizations manage risk, create and protect in the process of making decisions, setting and achieving goals, and improving performance

value.

Figure 1 Principles, Frameworks and Processes

Risk Management Guidelines

1 Scope

This document provides guidance for organizations to manage the risks they face, which organizations can apply in a targeted manner according to their specific circumstances.

This document provides a general approach to managing all types of risk, not just specific industries or sectors.

This document applies to any activity throughout the life cycle of an organization, including decision-making at all levels.

2 Normative references

There are no normative references in this document.

3 Terms and Definitions

The following terms and definitions apply to this document.

3.1

risk

The effect of uncertainty on goals.

Note 1.Impact refers to deviations from expectations, deviations can be positive and/or negative, and may bring opportunities and threats.

Note 2 to entry. Objectives can have different dimensions and types and can be applied at different levels.

Note 3.Usually risk can be described in terms of risk sources, potential events and their consequences and possibilities.

3.2

risk management

directing and controlling the organization's coordination activities related to risk (3.1).

3.3

stakeholder; interestedparty

A person or organization that can influence, be influenced, or believes to be influenced by a decision or activity.

Note. "interestedparty" can be used to replace the English counterpart "stakeholder".

3.4

risksource

elements that may individually or collectively cause a risk (3.1).

3.5

event event

The occurrence or change of certain circumstances.

Note 1.An event can include one or more situations, and can be caused by multiple reasons.

Note 2.An event may be something that was expected to happen but did not happen, or something that was not expected to happen but happened.

Note 3.An event may be a source of risk.

3.6

consequencesconsequence

The result of an event (3.5) affecting the target.

Note 1.Consequences can be definite or uncertain; the impact on the goal can be positive or negative; it can be direct or