ISO 31073:2022 リスク管理—語彙 | ページ 6

3.1.1

危険

不確実性（3.1.3） が 目標（3.1.2） に及ぼす影響

注記 1:効果とは、予想からの逸脱です。それは肯定的なもの、否定的なもの、またはその両方であり、 機会 (3.3.23) や 脅威 (3.3.13) に対処したり、生み出したり、その結果をもたらしたりする可能性があります。

注記 2: 目標にはさまざまな側面やカテゴリがあり、さまざまなレベルで適用できます。

注記 3:リスクは通常、 リスク源 (3.3.10) 、潜在的な 事象 (3.3.11) 、その 結果 (3.3.18) およびその 可能性 (3.3.16) の観点から表現される。

3.1.2

客観的

達成すべき結果

注記 1: 目標には、戦略的、戦術的、または作戦的なものがあります。

注記 2:目標は、さまざまな分野 (財務、健康と安全、環境目標など) に関連することがあり、さまざまなレベル (戦略的、組織全体、プロジェクト、製品、プロセスなど) に適用することができます。

注記 3:目標は、他の方法で表現することもできる。例えば、意図された結果、目的、運用基準として、管理システム目標として、または同様の意味を持つ他の単語の使用（例えば、目的、目標、目標） ）。

3.1.3

不確実性

理解または知識に関する情報が部分的であっても欠如している状態

注記 1:場合によっては、不確実性は組織の 目的 (3.1.2) だけでなく、 組織の状況 (3.3.7) にも関連している可能性があります。

注記 2:不確実性は リスクの根本原因 (3.1.1) 、すなわち、目標に関連して重要なあらゆる種類の「情報不足」です (そして、目標は、すべての関連する 利害関係者に関係します) (3.3. 2) ニーズと期待)

3.2.1

risk management

coordinated activities to direct and control an organization (3.3.7) with regard to risk (3.1.1)

3.2.2

risk management policy

statement of the overall intentions and direction of an organization (3.3.7) related to risk management (3.2.1)

[SOURCE:ISO Guide 73:2009, 2.1.2]

3.2.3

risk management plan

scheme within the risk management framework specifying the approach, the management components and resources to be applied to the management of risk (3.1.1)

Note 1 to entry: Management components typically include procedures, practices, assignment of responsibilities, sequence and timing of activities.

Note 2 to entry: The risk management plan can be applied to a particular product, process and project, and part or whole of the organization (3.3.7) .

[SOURCE:ISO Guide 73:2009, 2.1.3]

3.3.1

risk management process

systematic application of management policies, procedures and practices to the activities of communicating, consulting, establishing the context, and identifying, analysing, evaluating, treating, monitoring (3.3.40) and reviewing risk (3.1.1)

[SOURCE:ISO Guide 73:2009, 3.1]

3.3.2

interested party

stakeholder

person or organization (3.3.7) that can affect, be affected by, or perceives itself to be affected by a decision or activity

3.3.3

risk perception

interested party’s (3.3.2) view on risk (3.1.1)

Note 1 to entry: Risk perception reflects the interested party’s needs, issues, knowledge, beliefs and values.

[SOURCE:ISO Guide 73:2009, 3.2.1.2, modified — “interested party” has replaced “stakeholder”, and “risk” has replaced “a risk” in the definition.]

3.3.4

external context

external environment in which the organization (3.3.7) seeks to achieve its objectives (3.1.2)

[SOURCE:ISO Guide 73:2009, 3.3.1.1, modified — “interested parties” has replaced “stakeholders”.]

3.3.5

internal context

internal environment in which the organization (3.3.7) seeks to achieve its objectives (3.1.2)

[SOURCE:ISO Guide 73:2009, 3.3.1.2, modified — “interested parties” has replaced “stakeholders”.]

3.3.6

risk criteria

terms of reference against which the significance of risk (3.1.1) is evaluated

Note 1 to entry: Risk criteria are based on organizational objectives (3.1.2) , and external (3.3.4) and internal context (3.3.5) .

Note 2 to entry: Risk criteria can be derived from standards, laws, policies and other requirements.

[SOURCE:ISO Guide 73:2009, 3.3.1.3, modified — “risk” has replaced “a risk” in the definition.]

3.3.7

organization

person or group of people that has its own functions with responsibilities, authorities and relationships to achieve its objectives (3.1.2)

Note 1 to entry: The concept of organization includes, but is not limited to, sole-trader, company, corporation, firm, enterprise, authority, partnership, charity or institution, or part or combination thereof, whether incorporated or not, public or private.

3.3.8

risk assessment

overall process of risk identification (3.3.9) , risk analysis (3.3.15) and risk evaluation (3.3.25)

[SOURCE:ISO Guide 73:2009, 3.4.1]

3.3.9

risk identification

process of finding, recognizing and describing risks (3.1.1)

Note 1 to entry: Risk identification involves the identification of risk sources (3.3.10) , events (3.3.11) , their causes and their potential consequences (3.3.18) .

Note 2 to entry: Risk identification can involve historical data, theoretical analysis, informed and expert opinions, and interested party’s (3.3.2) needs.

[SOURCE:ISO Guide 73:2009, 3.5.1, modified — “interested party” has replaced “stakeholder”.]

3.3.10

risk source

element which alone or in combination has the potential to give rise to risk (3.1.1)

3.3.11

event

occurrence or change of a particular set of circumstances

Note 1 to entry: An event can have one or more occurrences, and can have several causes and several consequences (3.3.18) .

Note 2 to entry: An event can also be something that is expected which does not happen, or something that is not expected which does happen.

Note 3 to entry: An event can be a risk source (3.3.10) .

3.3.12

hazard

source of potential harm

Note 1 to entry: Hazard can be a risk source (3.3.10) .

[SOURCE:ISO Guide 73:2009, 3.5.1.4]

3.3.13

threat

potential source of danger, harm, or other undesirable outcome

Note 1 to entry: A threat is a negative situation in which loss is likely and over which one has relatively little control.

Note 2 to entry: A threat to one party may pose an opportunity (3.3.23) to another.

3.3.14

risk owner

person or entity with the accountability and authority to manage risk (3.1.1)

[SOURCE:ISO Guide 73:2009, 3.5.1.5, modified — “risk” has replaced “a risk” in the definition.]

3.3.15

risk analysis

process to comprehend the nature of risk (3.1.1) and to determine the level of risk (3.3.22)

Note 1 to entry: Risk analysis provides the basis for risk evaluation (3.3.25) and decisions about risk treatment (3.3.32) .

[SOURCE:ISO Guide 73:2009, 3.6.1, modified —Note 2 to entry has been deleted.]

3.3.16

likelihood

chance of something happening

Note 1 to entry: In risk management terminology, the word “likelihood” is used to refer to the chance of something happening, whether defined, measured or determined objectively or subjectively, qualitatively or quantitatively, and described using general terms or mathematically [such as a probability (3.3.19) or a frequency (3.3.20) ].

Note 2 to entry: The English term “likelihood” does not have a direct equivalent in some languages; instead, the equivalent of the term “probability” is often used. However, in English, “probability” is often narrowly interpreted as a mathematical term. Therefore, in risk management terminology, “likelihood” is used with the intent that it should have the same broad interpretation as the term “probability” has in many languages other than English.

3.3.17

exposure

extent to which an organization (3.3.7) and/or interested party (3.3.2) is subject to an event (3.3.11)

[SOURCE:ISO Guide 73:2009, 3.6.1.2, modified — “interested party” has replaced “stakeholder”.]

3.3.18

consequence

outcome of an event (3.3.11) affecting objectives (3.1.2)

Note 1 to entry: A consequence can have positive or negative, direct or indirect, effects on objectives.

Note 2 to entry: Consequences can be expressed qualitatively or quantitatively.

Note 3 to entry: Any consequence can escalate through cascading and cumulative effects.

3.3.19

probability

measure of the chance of occurrence expressed as a number from 0 to 1 ここで, 0 is impossibility and 1 is absolute certainty

Note 1 to entry: See 3.3.16, Note 2 to entry.

[SOURCE:IEC 31010:2019, 3.3, modified — The definition has been modified.]

3.3.20

frequency

number of events (3.3.11) or outcomes per defined unit of time

Note 1 to entry: Frequency can be applied to past events or to potential future events ここで, it can be used as a measure of likelihood (3.3.16) / probability (3.3.19) .

[SOURCE:ISO Guide 73:2009, 3.6.1.5]

3.3.21

vulnerability

intrinsic properties of something resulting in susceptibility to a risk source (3.3.10) that can lead to an event (3.3.11) with a consequence (3.3.18)

[SOURCE:ISO Guide 73:2009, 3.6.1.6]

3.3.22

level of risk

magnitude of a risk (3.1.1) or combination of risks, expressed in terms of the combination of consequences (3.3.18) and their likelihood (3.3.16)

[SOURCE:ISO Guide 73:2009, 3.6.1.8]

3.3.23

opportunity

combination of circumstances expected to be favourable to objectives (3.1.2)

Note 1 to entry: An opportunity is a positive situation in which gain is likely and over which one has a fair level of control.

Note 2 to entry: An opportunity to one party may pose a threat (3.3.13) to another.

Note 3 to entry: Taking or not taking an opportunity are both sources of risk (3.1.1) .

[SOURCE:IEC 31010:2019, 3.2]

3.3.24

risk driver

factor that has a major influence on risk (3.1.1)

[SOURCE:IEC 31010:2019, 3.4]

3.3.25

risk evaluation

process of comparing the results of risk analysis (3.3.15) with risk criteria (3.3.6) to determine whether the risk (3.1.1) is acceptable or tolerable

Note 1 to entry: Risk evaluation assists in the decision about risk treatment (3.3.32) .

[SOURCE:ISO Guide 73:2009, 3.7.1, modified — “and/or its magnitude” has been deleted from the definition.]

3.3.26

risk attitude

organization’s (3.3.7) approach to assess and eventually pursue, retain, take or turn away from risk (3.1.1)

[SOURCE:ISO Guide 73:2009, 3.7.1.1]

3.3.27

risk appetite

amount and type of risk (3.1.1) that an organization (3.3.7) is willing to pursue or retain

[SOURCE:ISO Guide 73:2009, 3.7.1.2]

3.3.28

risk tolerance

organization’s (3.3.7) or interested party’s (3.3.2) readiness to bear the residual risk (3.3.38) in order to achieve its objectives (3.1.2)

Note 1 to entry: Risk tolerance can be influenced by legal or regulatory requirements.

[SOURCE:ISO Guide 73:2009, 3.7.1.3, modified — “interested party” has replaced “stakeholder”, and “residual risk” has replaced “risk after risk treatment”.]

3.3.29

risk aversion

attitude to turn away from risk (3.1.1)

[SOURCE:ISO Guide 73:2009, 3.7.1.4]

3.3.30

risk aggregation

combination of a number of risks (3.1.1) into one risk to develop a more complete understanding of the overall risk

[SOURCE:ISO Guide 73:2009, 3.7.1.5]

3.3.31

risk acceptance

informed decision to take a particular risk (3.1.1)

Note 1 to entry: Risk acceptance can occur without r isk treatment (3.3.32) or during the process of risk treatment.

Note 2 to entry: Accepted risks are subject to monitoring (3.3.40) and review (3.3.41) .

[SOURCE:ISO Guide 73:2009, 3.7.1.6]

3.3.32

risk treatment

process to modify risk (3.1.1)

Note 2 to entry: Risk treatments that deal with negative consequences are sometimes referred to as “risk mitigation”, “risk elimination”, “risk prevention” and “risk reduction”.

Note 3 to entry: Risk treatment can create new risks or modify existing risks.

[SOURCE:ISO Guide 73:2009, 3.8.1]

3.3.33

risk control

measure that maintains and/or modifies risk (3.1.1)

Note 1 to entry: Risk controls include, but are not limited to, any process, policy, device, practice, or other conditions and/or actions which maintain and/or modify risk.

Note 2 to entry: Risk controls do not always exert the intended or assumed modifying effect.

3.3.34

risk avoidance

informed decision not to be involved in, or to withdraw from, an activity in order not to be exposed to a particular risk (3.1.1)

Note 1 to entry: Risk avoidance can be based on the result of risk evaluation (3.3.25) and/or legal and regulatory obligations.

[SOURCE:ISO Guide 73:2009, 3.8.1.2]

3.3.35

risk sharing

form of risk treatment (3.3.32) involving the agreed distribution of risk (3.1.1) with other parties

Note 1 to entry: Legal or regulatory requirements can limit, prohibit or mandate risk sharing.

Note 2 to entry: Risk sharing can be carried out through insurance or other forms of contract.

Note 3 to entry: The extent to which risk is distributed can depend on the reliability and clarity of the sharing arrangements.

[SOURCE:ISO Guide 73:2009, 3.8.1.3, modified — Note 4 to entry has been deleted.]

3.3.36

risk financing

form of risk treatment (3.3.32) involving contingent arrangements for the provision of funds to meet or modify the financial consequences (3.3.18) should they occur

[SOURCE:ISO Guide 73:2009, 3.8.1.4]

3.3.37

risk retention

acceptance of the potential benefit of gain, or burden of loss, from a particular risk (3.1.1)

Note 1 to entry: Risk retention includes the acceptance of residual risks (3.3.38) .

Note 2 to entry: The level of risk (3.3.22) retained can depend on risk criteria (3.3.6) .

[SOURCE:ISO Guide 73:2009, 3.8.1.5]

3.3.38

residual risk

risk (3.1.1) remaining after risk treatment (3.3.32)

Note 1 to entry: Residual risk can contain unidentified risk.

Note 2 to entry: Residual risk can also be known as “retained risk”.

[SOURCE:ISO Guide 73:2009, 3.8.1.6]

3.3.39

resilience

adaptive capacity of an organization (3.3.7) in a complex and changing environment

[SOURCE:ISO Guide 73:2009, 3.8.1.7]

3.3.40

monitoring

continual checking, supervising, critically observing or determining the status in order to identify change from the performance level required or expected

Note 1 to entry: Monitoring can be applied to a risk management framework, risk management process (3.3.1) , risk (3.1.1) or risk control (3.3.33) .

[SOURCE:ISO Guide 73:2009, 3.8.2.1, modified — “risk control” has replaced “control” in Note 1 to entry.]

3.3.41

review

activity undertaken to determine the suitability, adequacy and effectiveness of the subject matter to achieve established objectives (3.1.2)

Note 1 to entry: Review can be applied to a risk management framework, risk management process (3.3.1) , risk (3.1.1) or risk control (3.3.33) .

[SOURCE:ISO Guide 73:2009, 3.8.2.2, modified — “risk control” has replaced “control” in Note 1 to entry.]

3.3.42

risk reporting

form of communication intended to inform particular internal or external interested party (3.3.2) by providing information regarding the current state of risk (3.1.1) and its management

[SOURCE:ISO Guide 73:2009, 3.8.2.3, modified — “interested party” has replaced “stakeholder”.]

3.3.43

risk management audit

systematic, independent and documented process for obtaining evidence and evaluating it objectively in order to determine the extent to which the risk management framework, or any selected part of it, is adequate and effective

[SOURCE:ISO Guide 73:2009, 3.8.2.6]