风险评估和排列的应用模型

风险评估和排列的应用模型

A practical model for risk assessment and prioritisation

风险评估和排列的应用模型

Introduction

This article explains a practical and straightforward method of assessing and prioritising risks, based on a simple quasi-mathematical risk model.

介绍

这篇文章解释了在简单的准数学风险模型的基础上进行风险评估和排列的实用简单的方法。What is ‘risk’?

Risk is simply the chance coincidence of three factors:

Threats – events or activities, generally external to the system which may, at some point, affect the inherent weak points, causing impacts;

Vulnerabilities – weaknesses within the system under consideration which may, at some point, be exploited by the threats;

Impacts – the short- and long-term organisational [adverse] consequences should threats happen to exploit vulnerabilities.

什么是‘风险’？

风险仅仅是三种因素的偶然巧合：

威胁——事件或者活动，通常作用于系统外部，在某一方面可能影响固有的弱点，而产生影响；

脆弱性——系统所考虑的弱点在某一方面可能暴露在威胁之下；

影响——威胁短期和长期组织的[不利的]结果碰巧利用了弱点。

The probability that a damaging impact will occur is not easy to determine as it requires the coincidence of one or more threats and vulnerabilities, which are themselves generally unpredictable. A system may possess a vulnerability for a long time without impact until some threatening event actually occurs and ‘exploits’ it. Some threats are more likely to occur than others in a given timeframe (e.g. simple keyboard errors are generally far more frequent than break-ins). Similarly, some vulnerabilities may only appear for short periods of time (e.g. while the security guard walks from the armoured van to the bank vault) whereas others may persist indefinitely (e.g. the bank vault alarm system may not cover all entry points). Impacts also vary in extent - some may be so severe as to jeopardise the entire system or organisation (e.g. a major fire), others may be totally insignificant (e.g. inconvenience to workers).

发生破坏影响的可能性之所以不容易确定，是因为它需要一个或更多的威胁和弱点的同时发生，通常它们自己都是不可预测的。系统可以在很长一段时间内存在着弱点而不受影响，直到某一威胁事件真的发生，并且暴露出来。在特定的时间里，一些威胁比另一些更容易发生（例如简单的键盘错误通常远比非法进入更频繁）。同样地，一些弱点可能仅仅在短期内出现（例如安全警卫从运钞车走到银行保险库的时候），但是，其他人可以并不知道（例如银行保险库的警报系统可以无法覆盖全部入口处）。影响也有一定程度的变化，一些影响可能严重到危及整个系统或组织（例如一次较大的火灾），而其他的影响可能无关紧要（例如给工人造成的不便）。

Insurance companies may have the skills to calculate the probabilities of certain threats and vulnerabilities, and to predict the scale of likely impacts, but even they would acknowledge

that this is an imprecise process - perhaps more art than science. Insurers essentially cover their risks by spread betting: although any given event is unpredictable, the probability of a certain number of events in a certain period may be estimated with greater confidence, mostly on the basis of prior experience. However, there are two particular problems with this approach. Some extremely high-impact events (e.g.your CEO being hit by lightening) are so infrequent that human nature tends to discount or ignore such events, therefore the insurers find it difficult to sell the corresponding policies at realistic prices. Furthermore, new situations introduce new risks but the lack of experience makes them even more difficult to predict. High technology topics such as eCommerce are changing so fast that even IT experts are struggling to keep up. Insurers can do little more than guess at the risks.

保险公司可能有技术能够计算某种威胁和弱点的可能性，以及预测可能影响的范围，但即使这样他们也承认这是不精确的过程——或许艺术的部分比科学更多。保险公司基本上通过分布打赌控制他们的风险：虽然任何给定的事件是不可预测的，但是在某一时期内，事件发生数量的可能性可以以更大的置信水平被评估，通常是在先前经验的基础上。不过，这种方法有两个特别的问题。由于一些具有非常高影响的事件（例如你的执行总裁被雷电击中）很少发生，以至于人性往往把这样的事件打折扣或者忽视，因此保险公司发现按实际的价格销售相应的政策很困难。此外，新情况出现就要引入新风险，但是，经验的不足使他们更难以预测。高技术领域象电子商务的变化是如此迅速，以至于连IT专家都要努力才不会落伍。

保险公司对于这些风险除了推测并不能做的更多。

Particular combinations of threats and vulnerabilities may occur purely by chance ("bad luck") but it is intuitively obvious that a system with few vulnerabilities and/or threats is less likely to suffer impacts in the long run, and that a system with many/large potential impacts (in other words, a fragile system) is eventually likely to suffer more damage than one without. This is the basis of risk management, itself a crucial element in the sound management of any organisation. Managers generally seek to reduce vulnerabilities, threats and/or impacts by directing organisational resources towards risk mitigation activities such as installing appropriate control frameworks.

威胁和弱点的特别结合可能是偶然发生的（“倒霉”），但显而易见的是，一个极少弱点和威胁的系统不那么容易遭受攻击，而于之相比，一个有很多/大的潜在影响的系统（换句话说一个脆弱的系统）最后可能遭受更多的损害。这是风险管理的基础，它本身在任何组织的健全管理中都是关键的要素。管理人员一般寻求把组织的资源分配到类似组建适当的控制构架之类的风险缓解活动上来减少弱点，威胁和或影响。

Derivation of a simple risk model

Business is far from risk-free and there is profit to be made by taking acceptable risks, but some risks lead to ruin. The key to sound management is to know which risks to mitigate and when to ‘take a chance’. This is why it is so important to develop a good understanding of risk. In this section, we develop a straightforward quasi-mathematical model to quantify risks.

Thinking simplistically about the nature of risk, one might derive the following additive formula:

Risk = Threats + Vulnerabilities + Impacts

简单风险模式的起源

企业是充满风险的，通过冒可接受的风险可以取得收益，但一些风险会导致崩溃。健全管理

的关键是了解何种风险需要减轻及何时需要冒险。这就是为什么它对于了解风险是如此的重要。在这一节中，我们为了确定风险的数量开发出一种简单明了的准数学模型。如果简单地考虑风险的性质，可以得到下列累加的公式：

风险=威胁＋弱点＋影响

At face value, this formula indicates that systems with high threats, vulnerabilities OR impacts are high risk systems. However, it is the chance combination of threats AND vulnerabilities that cause impacts to occur, while the extent of damage to an organisation depends on an event’s occurrence AND the impacts caused. Mathematically, the ‘logical AND’ calculation requires a product not a sum i.e.:

Risk = Threats x Vulnerabilities x Impacts

在表面上，这公式显示具有高的威胁，弱点或影响的系统是高风险的系统。不过，正是威胁和弱点的偶然结合导致影响的产生，另一方面，对一个组织的损害程度取决于事件的传播和所产生的影响。数学上，‘逻辑与’的计算要求乘积而不是合计，即：

风险=威胁×弱点x影响

Combinations involving at least two large factors (e.g. high threat and high vulnerability) now generate substantially higher risk scores than those with consistently low- or medium-scoring factors. Risks where any one factor is rated zero, of course, score lowest of all.

现在包括至少两大因素（例如高威胁和高弱点）的结合会比那些一贯低分数或中等分数的因素得到更高的风险分数。当然，风险中任何一个因素都可以得零分，在全部得分中最低的分数。

Calculating risk

In order to use the model to calculate risks, we need to examine and quantify the component factors (threats, vulnerabilities and impacts) separately.

计算风险

为了使用模型来计算风险，我们需要检查和单独确定组成因素（威胁，弱点和影响）的数量。Perhaps the simplest method of quantification is to classify the three factors as high (score 3), medium (score 2), low (score 1) or none (score zero), generating risk scores between 0 and 27 (3x3x3). Alternatively, we may prefer to use a continuous ‘percentage’ scale like this: 0% 25% 50% 75% 100%

+---------------------+---------------------+---------------------+---------------------+ THREA T

Person Building Getting OF

struck by struck by zapped by LIGHTENING

lightening lightening static

也许量化的最简单方法是将三种因素分为高风险（3分），中等风险（2分），低风险（1分）或零（0分），最后得到从0和27（3x3x3）分之间的风险分数。做为选择，我们更希望使用连续的‘百分比’分数象这样：

0% 25% 50% 75% 100%

+---------------------+---------------------+---------------------+---------------------+ 闪电

被闪电被闪电被静电的威胁

击中的人击中的建筑攻击

The maximum risk score using the percentage scale is therefore 1,000,000, giving

ample granularity for any organisation.

Whatever the scale, the process is the same. We compare and contrast risk factors, seeking a reasonable spread of values in our business context. A risk-averse manager is likely to rate the factors generally higher than a risk-taker, but the spread of values should be broadly comparable. It is this spread that gives the model its real power, allowing us to prioritise risks rationally.

使用百分比大小的最大风险分数之所以是1000000，是对任何组织给予足够的间隔。

无论规模多大，这个过程是相同的。我们比较和对比风险因素，以寻找在商业环境里一个合理的价值范围。一个反对风险的管理者比接受风险的管理者更可能分配给因素较高的分值，但是，价值范围应进行更广泛的比较。正是这种范围赋予模型真正的能力，使我们可以合理地排列风险。

Applying the risk model practically

The model has utility in many practical settings, such as this risk assessment and audit planning process:

The process has two important outputs: a ranked set of risks (useful for managers in the organisation) and the matching prioritised audit plan (to structure the work of the internal and/or external auditors).

The “periodic refresh” gives us the opportunit y to update the risk factor scores to reflect changes, such as improvements to the internal control environment (reduced vulnerabilities) or new market pressures (increased threats).

The simple rationality of this process makes clear the linkage between planned audit work and organisational risks.

实际应用风险模型

这个模型使用了许多实际的设置，象风险评估和审计计划过程：

这个过程有两个重要的输出：一系列分类的风险（对组织里的管理人员有用）和与之匹配的审查计划（构筑内部和外部的审计人员的工作）。

“定期的更新”使我们能够更新风险因素的分数以反映类似对内部控制环境（弱点减少）或新的市场压力（威胁增加）的改进。

这种方法简单的合理性使计划的审查工作和组织的风险之间的联系更加清晰。Similarly, project risks can be assessed using the model to form the basis of project risk management. Project threats depend on the nature of the project but typically include Political, Economic, Social and Technical aspects (so-called PEST analysis). Vulnerabilities can include inadequate skills, motivation, financial or other resource constraints etc. Impacts of project failure are normally classified as:

excessive cost;

late completion; and/or

low customer satisfaction (e.g. unwanted, incomplete or poor quality deliverables).

The model can be used to relate these factors and suggests which risks are the most or least important, forming an agenda for management action. The risk calculations should be updated frequently during the course of the project as new information comes to light - a crude spreadsheet with notes should suffice.

同样，项目风险也能用模型进行评估以形成项目风险管理的基础。项目威胁取决于项目的性质，但是典型地包括政治，经济，社会，和技术的方面（所谓PEST评估法）。弱点包括不合适的技能，促动因素，财政的或者其他的资源限制等等。项目失败的影响通常分为以下几

类：

额外成本；

延期完成；

和或顾客满意度低（例如不必要，不完全或者品质低劣的交付）。

模型可以阐明这些因素，提议哪些风险是最重要的或者最不重要的，为管理行动形成议程。当新的信息出现时－带注释的未加工的电子数据表应该足够了，风险计算应该在项目的进行期间里经常更新，。

Conclusion

This article has demonstrated that risk assessment need not be a black art, understood only by insurers, but can be a straightforward, logical and useful process. The simple model gives managers a powerful means to quantify and prioritise risks in virtually any context, with benefits for strategic planning and risk mitigation.

结论

这篇文章证明了风险评估不是只有保险公司能理解的魔法，而是简单明了的，逻辑的和有用的方法。简单的模型对管理人员是一个有力的武器，使他们能够在各种环境中量化和排列风险，在战略规划和缓解风险上取得利益。

Footnote

Professor Robert Simons published a similar but slightly more complicated risk-scoring process in the Harvard Business Review (May-June 1999, pages 85-94): his process uses 9 risk factors, each scored 1 to 5, although the scores are simply added together. Notwithstanding my comments earlier about using products not sums, the article is still useful as it explains how one might use the risk scoring process as part of a pan-organisational business risk assessment activity. The article is sprinkled with the professor’s thoughts on typical risk areas (‘pressure points’) and it raises some practical questions about corporate governance with which to challenge business managers. All in all, a good read.

脚注

罗伯特·西蒙斯教授在哈佛商务评论上发表了相似但略为复杂的风险计分过程（1999年5-6月，85-94页）：他的过程使用九种风险因素，虽然分数只是简单的相加，每种因素从1分到5分。虽然我的注释以前使用乘积而不是合计数，但文章还是有用的，因为它解释了作为泛组织化的商务风险评估活动的一部分，是如何使用风险评分方法的。文章体现了教授关于典型风险领域（压力点）的想法，并且它提出一些关于合作管理的实际问题，而这对于企业管理人员是个挑战。总而言之，这是一篇好文章。