Chapter 1 General Principles

1.     To achieve administration goals and to enhance administrative performance, the Risk and Crisis Management Operation Criteria are promulgated and incorporated into the daily operations and decision making processes of ministries, commissions, councils, banks, directorates-general, offices, administrations, departments and museums of the Executive Yuan (hereinafter referred to as “Agencies”) to reduce the possibility and consequences of hazards.

2.    The Criteria are principle-based operational rules and references for the Agencies in promoting integrated risk and crisis management. The Risk and Crisis Management manuals are issued to guide the Agencies in establishing standard operating procedures and actual practices.

3.     The Agencies may adopt risk and crisis management practices in accordance with relevant laws and regulations and in light of the special needs of their functions and capacities.

4.    The terms used in the Criteria are defined as follows:

(1)    Risk: A potential event that could affect the objectives of an organization as well as the probability of occurrence and the severity of such an event. 

(2)    Crisis: An event with time pressure that poses material threat to an organization’s value and requires the decision maker to make a decision which could have significant impact.

(3)    Risk management: The measures and actions taken to effectively manage a risk and to reduce the adverse effects of an event.

(4)    Crisis management: A continuous and dynamic monitoring and management process to prevent or alleviate the adverse consequences of a crisis that may affect the organization.

(5)    Integrated risk management: A continuous and systemic process to assess, dispose, monitor, and communicate risks from an organization-wide perspective.

(6)    Stakeholder: An individual or organization that possesses influence on, or who could be affected or deems itself could be affected by the decisions or actions of others.

(7)    Risk assessment: The process to identify, analyze and evaluate risks.

(8)    Risk identification: The processes and methods of uncovering potential risk events and reasons and form of occurrence of these potential risks.

(9)    Risk analysis: A systemic process of utilizing effective information to determine the likelihood of a specific event occurring and to assess the severity of its impact.

(10)  Risk evaluation: The determination of the priorities of risk management by comparing a risk with pre-established standards to determine the level of risk.

(11)  Risk disposal: The execution of countermeasures to minimize the likelihood of unacceptable risks identified in risk evaluation, as well as to reduce the severity of its impact to an acceptable level.

(12)  Risk avoidance: A decision not to be involved or to withdraw from a risk situation.

(13)  Risk reduction: The use of appropriate techniques and management principles to reduce risk or its likelihood.

(14)  Risk retention: The intentional or unintentional retention of the responsibility for loss, or financial burden caused by risks within the organization.

(15)  Risk transfer: Transferring the responsibility for loss and the costs of loss to other organizations through legislation, contract, insurance or other means.

(16)  Organization’s risk profile: The major risks and risk priorities of an organization as well as the analytical data of individual risks, including the overall presentation of risks and their impact, risk mitigation strategies and risk management objectives.

(17)  Monitor: The process of regularly and irregularly reviewing, consulting, observing and recording activities, actions, or measures.

(18)  Risk communication: Conveying and Communicating risk awareness to stakeholders, including the exchange of content of risks, the methods of risk mitigation, and the channels of risk communication. 

Chapter 2　Risk Management Policy and Framework

5.     The Agencies shall, based on their administrative visions and plans, set up consistent governance goals for all the internal units and subordinate agencies (institutions), and demonstrate risk management performance.

6.     The Agencies shall draft risk management policy in accordance with their authority and responsibility. The policy shall describe the overall risk management goals and declare the methods for preventing potential risks and the commitment to continuous improvement in risk management.  

The Agencies shall convey their risk management policy to all employees so that all staff members understand their respective risk management responsibilities, and shall also communicate risks with stakeholders.

7.     The Agencies shall establish risk management frameworks that shall take into consideration the internal and external environments of the agency and include the processes of planning, execution, supervision and improvement of risk management.

Chapter 3　Risk Management Planning

8.     The Agencies shall define the risk management responsibilities of their staff at all levels, and provide resources and training, as well as undertake necessary measures to implement risk management.

The Agencies shall acquire the professional risk management know-how through education, training and organizational learning to enhance their risk management capabilities.

9.     The heads of the Agencies shall be responsible for the risk management performance of their respective agencies. The Agency heads shall designate a unit or personnel to be in charge of all matters relating to the scope of risk management at each administration level.

10.   The risk management unit or personnel of an Agency shall have explicitly defined authority and responsibilities and report periodically to the head of the agency the execution status and performance of risk management.

11.   When planning integrated risk management policy, the Agencies shall draw up suitable risk management methods and tools according to their special needs of their business, and may draw up annual risk management plan, provide the resources needed for the implementation of risk management plan, and revise the plan as necessary.

12.   The Agencies shall communicate the risks, possible consequences of risks, and the management methods to stakeholders internal and external to the Agencies, and build a supportive work environment through resources sharing to shape the risk management culture within the organization.

13.   The Agencies shall design and actuate integrated risk management in line with the nature of their business, types of risk, and management experience, and implement the integrated risk management on a sustained basis. 

Chapter 4　Execution of Risk Management

14.   When conducting risk assessment, an Agency should first understand its administration goals and take into consideration laws and regulations, internal and external environments, techniques and financial situations.

15.   The Agencies shall perform overall risk assessment through the process of risk identification, risk analysis and risk evaluation.

The Agencies shall design methods to identify risks, set out evaluation indices to determine the likelihood of a certain risk and gauge the severity of its impact for risk analysis. The Agencies shall also set out risk standards and risk levels according to their risk tolerance, and continuously undertake risk assessment and monitor for any change in the organization’s risk profile. 

16.   The Agency shall manage the identified risks and prevent the occurrence of risks arising in the risk management process. Risk management measures include risk avoidance, risk reduction, risk retention, and risk transfer. The cost and benefits, policy feasibility and priorities in the management process of risk management measures shall be considered.

17.   The planning and execution of risk management, and related procedures and measures shall be documented.

Chapter 5　Risk Management Monitoring

18.   The Agencies shall set forth the procedure for and the scope of risk management monitoring and the responsibility of monitors.

19.   The Agencies shall establish mechanisms to monitor the planning and performance of risk management in a timely manner. The monitoring results shall be documented. The agencies shall perform appropriate risk communication with stakeholders to ensure the continuous relevance and effectiveness of risk management.

Chapter 6 　Improvement of Risk Management

20.   The Agencies shall continuously improve the performance of risk management through risk management policy, risk management goals, audit and monitor, corrective and preventive actions and management review.

21.   The Agencies shall propose corrective or preventive actions against deficiencies found in the monitoring process and verify the effectiveness of those actions.

22.   The Agencies shall continuously improve and communicate measures relating to integrated risk management, based on the risk management monitoring results and the internal and external environments.

Chapter 7 Crisis Management　

23.   The Agencies shall incorporate crisis management into their risk management framework. The Agencies shall have in place crisis prevention, response and recovery measures for risks that are still unacceptable after risk management measure have been applied.

24.  The Agencies shall set forth an emergency response plan for each type of crisis.

The above-mentioned emergency response plan shall include the standard operating procedures for crisis response team, response strategy, public relations and communication, and post-crisis management, and shall be kept as dynamic and flexible as possible to adapt to any extraordinary emergency event. The effectiveness of the response plan shall be validated through testing and drills.

25.   Aside from strengthening the overall concept of crisis management, the Agencies shall stress the coordination mechanism, crisis communication and discussion of related cases. The Agencies shall also establish internal and external contact windows for real-time reporting mechanisms to make use of all kinds of communication tools to exchange the latest information and status.

26.   The Agencies should activate their crisis response team in a timely manner when a crisis arises to identify all possible aspects involved in a crisis, and if deemed necessary, quickly report to the superior agency to establish an inter-agency crisis response team, and following to the established plan, undertake emergency mobilization, broadcast, make contact, plan response strategies, and effectively integrate relevant plans and internal and external resources as well as make the most of government and non-government resources to promptly resolve the crisis.

27.   Upon the completion of the emergency management for a crisis, the Agencies shall create a knowledge sharing case study based on the experience and facts pertaining to the crisis for further learning and improvement objectives. The Agencies shall also propose corrective or preventive actions against deficiencies found in the process of management measure of the current crisis, verify the effectiveness of those actions, give feedback to the risk management mechanism and continue the monitoring activities.