Over the past few decades we have seen a steady  movement towards a more managerial response to these forms of risk. What has emerged is the discipline of risk management. We could define risk management as "the identification， analysis and economic control of those risks which can threaten the assets or earning capacity of an enterprise."

　　This definition is valuable because it highlights the structured approach which is called for if risks to the business environment are to be managed.

　　The three-fold nature of risk management is highlighted in the definition. Risks must be identified before they can be measured， and only  after their impact has been evaluated can we decide on the most effective method of control.

　　However we decide to control risk， it must be "economic." There is no point in spending ten pounds to control a risk which can only ever cost five pounds. There will always be a point where spending on risk control has stop.

　　The definition mentions the assets and earning capacity of an organization. These assets can be physical or human； they are both important and risk management must be seen to have a part to play in both. However， risks do not only strike at assets directly and for this reason the definition also mentions the earning capacity of an enterprise.

　　Note that the definition uses the word "enterprise" rather than a more restrictive word such as "company" or "manufacturer"。 The principles of risk management are just as applicable in the service sectors as they are in the manufacturing sectors， and are of equal importance in the public and private sectors of the economy.

　　When considering risk identification we must remember to take the broad view. We are not solely concerned with what can be insured， or even with what can be controlled. We start from the very basic question， "How can the assets or earning capacity of the enterprise be threatened？"  Starting from this position does not place any constraint on us as to what kind of risks we are looking for. We must begin the task in an unblinking manner and identify the whole host of ways in which an organization may be impeded from achieving its objectives.

　　We could say that there are at least two essentials if risk identification is to be effective.

　　Firstly， risk identification must be importantly recognized within an enterprise. When this is case， it is often marked down as a task within the job descriptions of a particular manager.

　　Secondly， the person responsible for risk identification must be armed with the relevant “tools of the trade” and must make use of them.

　　Once it has been identified that there is a risk， steps have to be taken to measure the potential impact of that risk on the organization.In a practical sense the measurement of risk starts with the gathering of information， followed by tile analysis of past experience， and then moves on to see what the data tells us about the level of frequency and severity of the risk to which an organization is exposed.

　　We can split the whole area of risk control into physical and financial control.

　　Physical risk control

　　We are concerned here with physical steps which can be taken in order to control risk. The first　step must be to reduce the level of the risk as far as possible. This means both the chance that something will happen and the severity of the incident， should it occur. There are at least two ways in which we could understand risk reduction.

　　Pre-loss risk reduction

　　It is possible to take steps before any event has occurred to minimize risk. The essence ofpre-loss reduction of risk is that the effects of the loss are anticipated and steps are taken to ensure that they are kept to a minimum.

　　Wearing a car seatbelt is a good， personal example. There has been no loss， but the possible effect of a loss has been anticipated and the pre-loss risk reduction step of wearing a belt has been taken.

　　The use of safety guards on machinery， is an industrial equivalent. There has been no injury，but steps have been taken to reduce the risk of injury.

　　Post-loss risk control

　　This form of risk control imagines that the risk has occurred and takes steps to minimize the effect of the loss. The use of automatic fire sprinkler systems fits into this category. Once the fire has started， the sprinklers operate to reduce the impact of the fire.

　　Financial risk control

　　We now turn our attention to financial mechanisms which can be used to control risk.

　　These can be divided into two categories.

　　Risk retention

　　Once the risk has been identified and controlled in some physical way， it will be necessary to consider how the effects are to be financed，should the worst happen.

 　In certain situations， it may be wise to retain the risk rather than to seek another form of protection， such as insurance. We have already mentioned the problems associated with insuring high frequency， low severity events and they certainly fall into the self-retention category.

　　The cost of these events could be paid for out of current income and passed on to the customer via the price of the product （or service） ， which is offered by the organization. Alternatively a fund could be established， out of which the losses are to be paid.

　　Risk transfer

　　Insurance is a risk transfer mechanism by which an organization can exchange its uncertainty for certainty. The uncertainty experienced would  include whether a loss will occur， when it will take place， how severe it will be and how frequent there might be in a year. This uncertainty makes it very difficult to budget and so the organization seeks ways of controlling the financial effect of the risk. Insurance offers the opportunity to exchange this uncertain loss for a  certain loss： the insurance premium.

　 The organization agrees to pay a fixed premium， in return， the insurance company agrees to meet any losses which fall within the terms of the policy. This is a risk transfer mechanism which is of immense value not only to industry， but also to  individuals.

　　在過(guò)去的幾十年我們已經(jīng)看到對(duì)于這些風(fēng)險(xiǎn)的管理方法越來(lái)越趨于穩(wěn)定。出現(xiàn)了風(fēng)險(xiǎn)管理的原則。我們可以把風(fēng)險(xiǎn)管理定義為“對(duì)那些會(huì)威脅企業(yè)資產(chǎn)和收入能力的風(fēng)險(xiǎn)進(jìn)行識(shí)別、分析和經(jīng)濟(jì)控制”。

　　這個(gè)定義十分有用，因?yàn)樗鼜?qiáng)調(diào)，如果商業(yè)環(huán)境出現(xiàn)風(fēng)險(xiǎn)而必須進(jìn)行管理時(shí)，要用系統(tǒng)的方法來(lái)管理。

　　定義中已經(jīng)強(qiáng)調(diào)了風(fēng)險(xiǎn)管理的三方面。風(fēng)險(xiǎn)在估計(jì)前必須先識(shí)別，只有估計(jì)出它們的影響后，我們才能決定出控制它們的最有效的方法。

　　不管我們決定怎樣控制風(fēng)險(xiǎn)，都必須是“經(jīng)濟(jì)”的?；ㄙM(fèi)10英磅去控制只需花費(fèi)5英磅的風(fēng)險(xiǎn)是沒(méi)有意義的，停止控制風(fēng)險(xiǎn)才有意義。

　　定義涉及一個(gè)組織機(jī)構(gòu)的資產(chǎn)和收人能力。這些資產(chǎn)可以是物質(zhì)的也可以是人力的，兩者都很重要。而且必須看到，風(fēng)險(xiǎn)管理對(duì)這兩者都起作用。然而風(fēng)險(xiǎn)不只是直接影響資產(chǎn)，為此定義中也涉及了企業(yè)的收人能力。

　　要注意定義中用的詞是“企業(yè)”而不是用其他的像“公司”或“制造商”這樣限制性的詞。風(fēng)險(xiǎn)管理的原則在服務(wù)部門的應(yīng)用跟在制造部門的應(yīng)用是一樣的，并且在社會(huì)公共領(lǐng)域和私人領(lǐng)域中同等重要。

　　就風(fēng)險(xiǎn)識(shí)別而言，我們必須記得要從宏觀上來(lái)看。我們不僅只是關(guān)心什么能被保，或者什么能被控制。我們從最基本的問(wèn)題開始，“企業(yè)的資產(chǎn)和收入能力怎樣受到威脅？”從這點(diǎn)出發(fā)絲毫不會(huì)限制我們要尋找什么樣的風(fēng)險(xiǎn)。我們必須毫不隱瞞地開始這項(xiàng)任務(wù)，積極識(shí)別妨礙一個(gè)企業(yè)達(dá)到其目標(biāo)的所有方面。

　　我們可以說(shuō)，要有效進(jìn)行風(fēng)險(xiǎn)識(shí)別至少有兩個(gè)要點(diǎn)。

　　第一，必須認(rèn)識(shí)到風(fēng)險(xiǎn)的識(shí)別在企業(yè)內(nèi)部是很重要的。這時(shí)，這一點(diǎn)經(jīng)常被納入某個(gè)經(jīng)理的工作范疇。

　　第二，負(fù)責(zé)風(fēng)險(xiǎn)識(shí)別的人員必須配備有關(guān)的“技術(shù)工具”，并且必須利用這些工具。

　　一旦識(shí)別有風(fēng)險(xiǎn)，就要采取措施估計(jì)風(fēng)險(xiǎn)對(duì)企業(yè)的潛在影響。風(fēng)險(xiǎn)估計(jì)的實(shí)際做法是首先要收集信息，然后分析以往經(jīng)驗(yàn)，再通過(guò)數(shù)據(jù)掌握一個(gè)企業(yè)所暴露出來(lái)的風(fēng)險(xiǎn)頻率和（或）幅度。

　　我們可以把整個(gè)風(fēng)險(xiǎn)領(lǐng)域劃分為物質(zhì)上的風(fēng)險(xiǎn)控制和財(cái)務(wù)上的風(fēng)險(xiǎn)控制。

　　物質(zhì)上的風(fēng)險(xiǎn)控制

　　這里我們關(guān)心的是可以采取什么樣的物質(zhì)措施控制風(fēng)險(xiǎn)。第一步必須是盡可能地減輕風(fēng)險(xiǎn)的程度。一旦事件發(fā)生，就意味著事情發(fā)生的可能性以及事情的嚴(yán)重程度。我們可以看到至少有兩種方法可以減少風(fēng)險(xiǎn)。

　　防損

　　在事件發(fā)生前采取措施把風(fēng)險(xiǎn)降到最低是可能的。防損就是預(yù)測(cè)損失并采取措施以保證風(fēng)險(xiǎn)保持在最低。

　　對(duì)此，開車系安全帶就是一個(gè)很好的個(gè)人的例子。這就是進(jìn)行了風(fēng)險(xiǎn)預(yù)測(cè)，然后采取了系安全帶的防災(zāi)舉措。預(yù)測(cè)了可能發(fā)生的損失，系上安全帶就是采取了損失控制措施。

　　機(jī)器上運(yùn)用安全防御措施也是一樣。沒(méi)有發(fā)生傷亡，但還是會(huì)采取措施減少傷亡危險(xiǎn)。

　　減損

　　這種風(fēng)險(xiǎn)控制則是想象風(fēng)險(xiǎn)已經(jīng)發(fā)生，然后要采取措施把損失造成的影響降到最低?；馂?zāi)自動(dòng)灑水系統(tǒng)的運(yùn)用就屬于這種風(fēng)險(xiǎn)控制。-旦火災(zāi)開始，灑水系統(tǒng)就會(huì)啟動(dòng)以減少火災(zāi)造成的影響。

　　財(cái)務(wù)上的風(fēng)險(xiǎn)控制

　　我們現(xiàn)在要注意看的是控制風(fēng)險(xiǎn)的財(cái)務(wù)方法。它可以分為兩類。

　　風(fēng)險(xiǎn)自留

　　一旦風(fēng)險(xiǎn)被確認(rèn)并且用某種自然方法進(jìn)行了控制，就有必要考慮如果發(fā)生最糟的情形將要怎樣用金錢計(jì)算出其產(chǎn)生的影響。

　　在某些情況下，保留風(fēng)險(xiǎn)而不去尋求另一種保護(hù)，例如保險(xiǎn)，是明智的。我們已經(jīng)提到過(guò)一些跟高頻率低幅度的事件有關(guān)的風(fēng)險(xiǎn)，它們肯定歸入自我保留一類。這些事件的費(fèi)用可以從現(xiàn)有收入中扣除，并且以企業(yè)提供的產(chǎn)品（或服務(wù)）的價(jià)錢傳遞給消費(fèi)者?；蛘呖梢越⒁还P基金，從中支出損失。

　　風(fēng)險(xiǎn)轉(zhuǎn)移

　　保險(xiǎn)是一種風(fēng)險(xiǎn)轉(zhuǎn)移過(guò)程。通過(guò)它，一個(gè)企業(yè)可以把它的不確定性轉(zhuǎn)換成確定性。常有的不確定性包括：損失是否會(huì)發(fā)生，什么時(shí)候會(huì)發(fā)生，會(huì)有多嚴(yán)重，一個(gè)時(shí)期內(nèi)會(huì)發(fā)生多少次。這種不確定性使得預(yù)算變得非常困難，所以企業(yè)找尋控制財(cái)務(wù)支出的方法以及把不確定損失轉(zhuǎn)換成確定損失的機(jī)會(huì)，即保險(xiǎn)保費(fèi)。企業(yè)同意支付一定數(shù)額的保費(fèi)，反過(guò)來(lái)，保險(xiǎn)公司同意承擔(dān)保單條款范圍內(nèi)的任何損失。這是一個(gè)風(fēng)險(xiǎn)轉(zhuǎn)移過(guò)程，不只是對(duì)某行業(yè)而且對(duì)個(gè)人都很有利。