mcpField
R
risk-management

risk-management

github.com/travisjneuman其他106166 次安装今天更新
代码仓库

关于 risk-management

risk-management 是一项涵盖企业风险评估、业务连续性和风险缓解框架的技能，为风险团队提供分类、评估、监控及报告业务风险的方法。

主要功能

  1. 01企业风险评估框架
  2. 02风险类别与评估流程
  3. 03第三方供应商风险生命周期
  4. 04运营风险与控制评估
  5. 05关键风险指标与阈值
  6. 06董事会报告与风险仪表板

适用场景

  1. 01构建企业风险评估流程
  2. 02审查供应商尽职调查要求
  3. 03跟踪运营指标与控制措施
  4. 04准备董事会风险报告

安装

复制下面的命令，在终端中运行。

$npx skills add https://github.com/travisjneuman/.claude --skill risk-management

安装后在 Claude Code 中输入/risk-management确认已加载。

包含的文件

除 SKILL.md 外，安装时一起下载的参考资料和脚本。

references/
business-continuity.md
erm-framework.md
fortune50-risk-management.md
insurance-risk-transfer.md

详细介绍

风险管理专家

为企业风险评估、业务连续性和风险缓解决策提供全面的风险框架。

详细参考：

风险类别

类别说明示例
战略商业模式／战略相关风险竞争格局突变、并购失败
运营日常运营中的风险流程故障、供应链问题
财务财务损失风险信用、市场、流动性
合规监管／法律风险监管变化、诉讼
声誉品牌和利益相关方风险负面报道、社交媒体
技术IT 和网络风险网络攻击、系统故障
人力资本与人员相关的风险关键人员风险、人才短缺
外部环境／外部风险自然灾害、地缘政治风险

风险评估流程

RISK ASSESSMENT STEPS:

1. RISK IDENTIFICATION
   - Environmental scanning
   - Stakeholder interviews
   - Workshop facilitation
   - Historical analysis
   - Scenario analysis

2. RISK ANALYSIS
   - Probability assessment
   - Impact assessment
   - Velocity consideration
   - Control effectiveness

3. RISK EVALUATION
   - Risk prioritization
   - Comparison to appetite
   - Aggregation analysis
   - Interdependency mapping

4. RISK RESPONSE
   - Accept (within appetite)
   - Mitigate (reduce likelihood/impact)
   - Transfer (insurance, contracts)
   - Avoid (eliminate activity)

5. MONITORING & REPORTING
   - Key Risk Indicators (KRIs)
   - Risk dashboards
   - Escalation triggers
   - Periodic reassessment

风险热力图

RISK MATRIX:

         IMPACT
         Low    Medium    High    Critical
LIKELIHOOD
Very High   3      6        9        12
High        2      4        6         9
Medium      1      2        4         6
Low         1      1        2         3

SCORING:
1-2: Accept/Monitor
3-4: Active Management
6: Senior Management Attention
9-12: Executive/Board Attention

第三方风险管理

供应商风险框架
TPRM LIFECYCLE:

1. PLANNING
   - Vendor inventory
   - Risk categorization
   - Assessment requirements

2. DUE DILIGENCE
   - Questionnaires
   - Documentation review
   - On-site assessments
   - Reference checks

3. CONTRACTING
   - Security requirements
   - SLAs
   - Audit rights
   - Termination provisions

4. ONGOING MONITORING
   - Performance tracking
   - Risk reassessment
   - Issue management

5. TERMINATION
   - Data return/destruction
   - Access revocation
   - Transition planning
供应商风险等级
等级标准评估
关键核心业务、高数据访问权限全面评估，每年一次
高对运营有重大影响综合评估，每年一次
中对业务有中等影响标准评估，每两年一次
低影响有限自我评估
供应商评估领域
ASSESSMENT DOMAINS:

INFORMATION SECURITY:
- Security controls
- Data protection
- Incident response
- Access management

OPERATIONAL:
- Business continuity
- Change management
- Performance history

FINANCIAL:
- Financial stability
- Insurance coverage
- Pricing sustainability

COMPLIANCE:
- Regulatory compliance
- Certifications
- Audit history

REPUTATIONAL:
- Market reputation
- Legal history
- References

运营风险管理

运营风险框架
OPERATIONAL RISK CATEGORIES:

PEOPLE:
- Human error
- Inadequate training
- Fraud
- Key person dependency

PROCESS:
- Control failures
- Procedure gaps
- Documentation issues
- Capacity constraints

SYSTEMS:
- IT failures
- Data integrity
- System integration
- Technology obsolescence

EXTERNAL:
- Vendor failures
- Regulatory changes
- Natural disasters
- Market disruptions
关键风险指标（KRIs）
风险领域KRI阈值
运营流程异常>5%
技术系统停机时间>99.9% 正常运行时间
人员员工流失率<15%
供应商SLA 违约<5%
合规政策违规重大违规为 0
控制评估
CONTROL EVALUATION:

DESIGN EFFECTIVENESS:
- Is the control properly designed?
- Does it address the risk?
- Is it documented?

OPERATING EFFECTIVENESS:
- Is it consistently applied?
- Is it working as intended?
- Is evidence maintained?

CONTROL RATINGS:
Effective: Control works as designed
Needs Improvement: Minor gaps
Inadequate: Significant gaps
Absent: No control in place

声誉风险

声誉风险框架
REPUTATION DRIVERS:

PRODUCTS & SERVICES:
- Quality
- Safety
- Value

CORPORATE BEHAVIOR:
- Ethics
- Governance
- Environmental impact

WORKPLACE:
- Culture
- Diversity
- Employee treatment

LEADERSHIP:
- Integrity
- Competence
- Communication

FINANCIAL:
- Performance
- Transparency
- Investor relations
声誉监测
MONITORING SOURCES:

MEDIA:
- Traditional news
- Online publications
- Broadcast

SOCIAL:
- Twitter/X
- LinkedIn
- Reddit
- Industry forums

STAKEHOLDER:
- Customer feedback
- Employee surveys
- Investor calls
- Analyst reports

METRICS:
- Sentiment score
- Share of voice
- Message pull-through
- Crisis response time

风险报告

董事会风险报告
BOARD REPORT ELEMENTS:

EXECUTIVE SUMMARY:
- Top risks
- Emerging risks
- Risk appetite status

RISK DASHBOARD:
- Heat map
- Trend analysis
- KRI status

DEEP DIVES:
- Focus areas
- Incident summary
- Response effectiveness

FORWARD LOOK:
- Emerging risks
- Strategic risks
- Mitigation plans
风险指标仪表板
类别指标目标状态
风险偏好在容忍范围内的风险100%
事件重大损失0
控制有效控制>90%
问题逾期整改<5%
培训完成率>95%

另请参阅

评论

支持 Markdown