國際管理系統標準對於風險評估要求之探討

International management system standards for risk assessment requirements of the study

張文忠(Wen-chung Chang)

指導教授 ： 于樹偉

國立中央大學/工學院/環境工程研究所碩士在職專班/碩士(2011年)

摘要

工安意識抬頭及企業內產品及服務外包後，造成企業與顧客、供應商、合作伙伴及競爭者關係日趨複雜，產生非單一影響經營因素的整合性風險。有時對企業經營最致命的影響因素，是來自於公司管理上的問題，如人員流動率高影響生產品質、研發人員跳槽至競爭對手或管理階層掏空資產，其他致命因素可能是一個外在環境的意外事件，如地震、颱風等天災或金融風暴及石油危機等此類影響全球的事件，因為這類事件產生企業經營上的危害，造成營運中斷風險，甚至企業因此而結束，所以有效的風險管理成為許多企業必要的生存之道。
風險管理係經由對風險評估結果進行控制以達到管理之目標，國內許多企業不論規模大小都已引進ISO系列標準，藉由通過國際標準系統認證以表示公司治理制度與國際接軌。各種不同國際標準系統皆有其特色如BS 25999營運持續管理系統、OHSAS 18001職業安全衛生管理系統、ISO 31000風險管理系統雖屬不同組織所推動之標準，但卻有相同的模式，推動的過程也有著相似的系統架構，只是不同標準對於風險評估要求及目標不同，如BS 25999營運持續管理系統在於受到危害衝擊後而能持續生存，OHSAS 18001職業安全衛生管理系統目標在於消除工作場所中的危害，降低對中人員安全健康的的損害，而ISO 31000風險管理系統可協助組織符合法規相關要求事項及管理績效的提升。
本研究係針對 BS 25999、 OHSAS 1800及 ISO 31000三種管理系統中風險管理要求及評估範圍，以文獻分析方式，探討不同風險管理系統的風險評估面向，再由ISO 31000風險管理系統的風險評估要求，探討這三類系統在風險評估要求的優缺點及應用，進行利用風險評估與管理的精神，說明企業達成風險管理系統要求的目標的機制。

關鍵字

風險管理 ； 風險評估 ； 整合性風險

並列摘要

The growing demands on environmental protection, occupational health and safety, green supply chain, product safety, etc. has greatly increased the complexity of an organization’s operations. Non-controllable external factors such as Japan’s March 11, 2011 natural disasters and the late 2008 United States financial crisis have had great impact on Taiwanese companies because of globalization. It is nearly impossible in the 21st century for an organization to compete in the global market without sound risk management.
Since early 2000, many Taiwanese companies have implemented the occupational health and safety management system, OHSAS 18001, to address changing legislation, customer demands and to protect the workforce. The essence of OHSAS 18001 is to use a systems approach to effective identify and control workplace health and safety risks. Terrorist attack on the World Trade Center in September 2001 brought a new dimension to management as far as business continuity is concerned. BS 25999, the Business Continuity Management standard published by British Standards Institution, aims to assist an organization to maintain its critical business activities during the most challenging circumstances to protect its staff, reputation, and stakeholders’ interest. BS 25999 contains the fundamental principles of and covers the complete life cycle of business continuity management. International Organization for Standardization’s work on ISO 31000, the risk management standard, further emphasizes the importance of integrating the risk management framework as an integral component of an organization’s management system. ISO 31000 is designed to assist an organization to achieve its objectives by identifying and treating risks throughout the whole organization with all business aspects taken into consideration.
Recent developments in risk-based management system standards clearly illustrate the importance of managing an organization’s risks arising from both internal operations and external factors. A common and core element of these management system standards is risk assessment. This study aims to analyze the risk assessment requirements of OHSAS 18001, BS 25999 and ISO 31000. Based on the findings of risk assessment analysis, practical approaches for the design, implementation and continual improvement of the integrated risk management system are proposed.

並列關鍵字

risk management ； risk assessment ； integrated risk management system

參考文獻

12.戴基福，英國政府推行工作場所風險評估及管理的作法，工業安全衛生月刊，P26-50，2007.9

4.企業營運持續管理技術手冊，經濟部工業局工業安全衛生技術輔導網站，取自http://proj.moeaidb.gov.tw/cesh/data3/DATA3-2-05.pdf

16.林瑞玉，職業安全衛生風險評估實務，工業安全科技 2008.JUNE

1. OHSAS 18001：2007職業健康安全管理系統標準，DNV

2. 風險管理作業手冊第二版，行政院研究發展考核委員會，九十五年十一月