MapKAI

第 3 天,共 5 天

事实、风险与治理

数字揭示了什么,又可能隐藏什么?

预计学习时间:25分钟

今天你将学会
  • 把利润与现金及经营事实一起阅读
  • 把风险指标转成行动阈值
  • 在压力高峰前分配决策权
  • 把治理与可用证据连接起来
开始本课

观看课程

如素材提供,可使用字幕

中文

《三块白板:财务、ERM 与治理》

中文

《披萨店的三块白板》

English

The Corner Bistro

收听播客

《披萨店后厨的三块白板》

01

开场故事或商业情境

Beside a university town stood a small pizza shop called Corner Slice. It had only six tables, but delivery made up half its business. Every Friday evening, the order printer kept spitting out tickets, and the owner, Amin, felt business was good.

At the end of March he took the accounts home and told his wife, “This month is good. Profit is thirty per cent higher than the same month last year.” “Did we sell more pizza?” she asked. “No, about the same.” Amin pointed to one line in the accounts: the shop had sold an old delivery van for four thousand euros. Its book value had become very low, so the difference on sale became income for the month.

The profit was real, but his wife asked, “Will we have another old van to sell next March?” Amin had no answer.

The next day he looked around the shop again. The fridge door no longer shut properly. The oven heated more slowly. To save labour, Friday’s evening shift had fallen from four people to three. Pizza sales had not increased, while negative delivery-platform reviews were quietly rising. None of this appeared in the line that said “profit up thirty per cent.”

Later Amin asked Zhou, a member of staff, to make a risk table: oven failure in yellow, expired ingredients in yellow, last-minute absence and delivery delay in red, and falling platform rating in yellow. Zhou put it beside the fridge. At first people glanced at it. A few days later it was covered by the rota, an old menu, and drink-promotion posters. Gradually, nobody noticed which items had turned red.

The real failure came one Friday night. There was a match at the nearby stadium and orders suddenly surged. One employee called in sick, only two bags of cheese remained, and after hours of work the oven temperature became unstable.

Zhou asked, “After how many orders should we close one platform?” Amin said, “Let’s see.” Ten minutes later Zhou asked, “Which comes first—diners or delivery?” Amin said, “Do not delay either.” It sounded like an answer but decided nothing.

By seven o’clock, some pizzas were burnt at the edge and raw in the middle. Customers chased orders, the platform demanded refunds, and neither front nor kitchen knew who could stop taking orders. They refunded more than twenty orders that night. The rating fell from 4.7 to 4.2. A regular student wrote, “The pizza tastes the same, but everyone seems busy and nobody is actually deciding.”

The next morning Amin removed all the posters, rota, and risk table from beside the fridge and hung three whiteboards in the kitchen.

The first asked, “How exactly did we make money this month?” In the past Amin saw only the final profit number. Now he separated it: how much pizza itself earned, how much came from the old van, which platform payments had not arrived, which ingredients had been used while supplier bills remained unpaid, and which refunded orders could no longer count as revenue.

The gain on the van was not wrong, but it did not show that the pizza business had improved. For the first time Amin separated two questions: were the numbers recorded correctly, and what did those numbers actually mean?

The second board asked, “What could stop us from making acceptable pizza?” Risks no longer had only red, yellow, and green colours. If the oven missed its temperature twice, it had to be checked that day; when cheese was enough for only one hundred pizzas, the front desk stopped promotions; when unfinished orders exceeded forty, the duty manager could pause one delivery platform; with fewer than four people on Friday night, no large group order could be taken; below a 4.5 rating, negative reviews had to be examined the next day.

Amin said, “Colours are not here to make a table look complete. When a colour changes, someone must change what they do.”

The third board asked, “Who may decide?” The front desk told customers the real waiting time and could issue refunds within limits. The kitchen lead decided whether ingredients could be used and pizzas could leave the oven. The duty manager could pause orders without waiting for Amin’s approval. Zhou checked risk indicators before closing, but he was no longer merely updating colours. Amin’s wife reconciled platform payments, supplier bills, and the reality in the shop each week, checking whether the story in the accounts matched the story in the shop.

For the next two months, profit looked less beautiful. The van-sale gain would not recur. Deferred repairs entered the accounts and refunds were deducted. The shop also added labour cost to keep Friday staffing adequate. Amin looked at the accounts and said, “When we calculate it like this, it was not as good as I thought.” His wife replied, “At least now you know where the problem is.”

Months later, there was another stadium match. When unfinished orders reached forty-two, the duty manager closed one delivery platform. When the oven temperature became abnormal, the kitchen stopped using one oven shelf and gave the front desk a new waiting time. They accepted a dozen fewer orders, but there were no mass refunds and no new negative reviews.

At closing, Amin said, “We made a little less tonight.” The duty manager smiled: “But we can open again tomorrow.”

Later Amin learned that the three whiteboards have formal names in larger organisations. The first is Financial Accounting: it helps managers see revenue, cost, assets, and obligations that have happened, and understand where profit comes from. The second is Enterprise Risk Management (ERM): it helps an organisation identify what can affect its goals and set early indicators, action thresholds, and responses. The third is Governance: it tells people who runs the operation, who can call a halt, who challenges, and who checks that the system actually works.

Amin did not put those English words on the menu. Beneath the three boards he wrote only one sentence: “Take good news in the accounts back into the shop to see it; when bad news appears on the wall, someone must take the next action.”

02

决策问题

03

核心概念

会计

把利润与现金及经营事实一起阅读

为什么重要

最重要的报告中缺少哪一个经营事实?

营运资本

把风险指标转成行动阈值

为什么重要

谁有权叫停或改变流程?

风险管理

在压力高峰前分配决策权

为什么重要

最重要的报告中缺少哪一个经营事实?

治理

把治理与可用证据连接起来

为什么重要

谁有权叫停或改变流程?

04

视觉框架

01从一个商业情境开始
02揭示背后的金融逻辑
03把概念连接到实用框架
04通过反思与决策问题应用

五步知识链|我怎样带你把一条数字走到治理行动

先看清已经发生了什么 → 再理解数字背后的原因 → 再识别什么事情可能影响目标 → 再设定什么时候必须行动 → 最后说明谁负责决定、质疑和检查。

01一笔生意怎样进入三张报表

三张报表不是三份互不相关的文件,而是从不同角度记录同一家公司的经营活动。Income statement(利润表)记录一段时间内确认的收入、成本和利润;Balance sheet(资产负债表)记录某个时间点公司拥有什么、欠什么,以及股东留下的权益;Cash flow statement(现金流量表)记录现金实际怎样流入和流出。

例如,披萨店通过外卖平台卖出一张 20 欧元的披萨,使用了 8 欧元的原料,但平台要到下个月才付款。利润表会记录 20 欧元收入和 8 欧元成本,因此产生 12 欧元利润;资产负债表会增加 20 欧元应收款,同时库存减少 8 欧元;现金流量表暂时不会显示收到 20 欧元,因为平台还没有付款。

所以利润和现金不同并不一定说明账目有问题。利润回答的是“这笔生意是否已经发生”,现金流回答的是“钱是否已经收到或付出”,资产负债表则保留两者之间尚未完成的部分,例如应收款、应付款和库存。

02数字正确,不代表解释只有一种

会计数字可以记录正确,但管理者仍然需要理解数字背后的原因。公司利润增加,可能是产品卖得更多,也可能是卖掉了一块土地、一栋楼或一辆旧车;应收账款增加,可能是业务增长,也可能是客户付款越来越慢;库存增加,可能是在为旺季准备,也可能是产品卖不出去。

设备仍然出现在资产负债表上,也不代表它仍然值原来的价格或仍然能够正常工作。看到数字变化时,先问:这是日常经营带来的变化,还是一次性项目?这个变化以后还能持续吗?账上的价值和实际情况是否一致?还有什么证据可以支持这个解释?EBITDA、margin、working capital、provision 和 impairment 都能帮助我们提出问题,但不能替我们得出结论。

03ERM 从目标开始,不从风险清单开始

ERM 是 Enterprise Risk Management,中文是企业风险管理。它不是财务部门替所有部门管理风险,也不是 Risk 部门单独维护一张表格。食品安全和产品质量由业务与 Quality 负责,设备、人员和交付由 Operations 负责,现金、预算和融资由 Finance 负责,系统和数据由 IT 负责,合规问题由业务和 Compliance 共同管理。

ERM 的作用,是先明确组织想实现什么目标,再识别哪些不确定性可能影响这些目标。披萨店的目标可以是:在保证食品质量的情况下,按时完成订单,并保持顾客信任。烤炉故障、员工缺班、原料不足、平台故障和订单突然增加都可能影响它。只把这些写进风险清单还不够;组织还需要说明谁负责、怎样监控,以及什么时候必须行动。

04给风险设置信号、界线和动作

风险管理不能停在红黄绿颜色上。Risk appetite 是为了实现目标,组织愿意承担多少风险;KRI(Key Risk Indicator) 是提前显示风险正在变大的指标;threshold 是达到什么程度以后必须采取行动;risk owner 是谁负责监控和处理这个风险。

例如,待完成订单数量是 KRI,四十单是 threshold,暂停一个外卖平台是 response,值班店长是 risk owner。这样,风险管理才从“我们知道可能出问题”,变成“问题达到什么程度时,谁必须做什么”。

05治理说明谁负责、谁质疑、谁检查

即使数字正确、风险也被识别,如果没有清楚的权力与责任,问题仍然可能停在会议纪要或表格里。第一线是实际经营业务的人:他们负责完成目标,也负责处理日常风险。第二线提供专业规则、建议和挑战,例如 Risk、Compliance、Finance 或 Quality;通常不替业务做决定,但会提醒、监督和提出质疑。第三线通常是 Internal Audit,独立检查前两层的制度是否设计合理、是否真正执行。

Board 或监督机构不负责每一个日常决定,但要确认主要目标和风险是否清楚、管理层是否设定了合理边界、重大问题是否被及时升级、问题发生后是否真的采取了行动。这套逻辑同样适用于 non-profit 和公共组织:目标可能不是利润最大化,而是安全、公平、响应速度和公众信任;但公共使命不代表可以忽视预算、证据和问责。

05

实用案例

商业例子

为现金、交付、客户满意度和平台依赖设置少量可行动的信号;触线后有明确的下一步。

06

常见误解

07

关键要点

  • 把利润与现金及经营事实一起阅读
  • 把风险指标转成行动阈值
  • 在压力高峰前分配决策权
  • 把治理与可用证据连接起来

08

知识检查

数字揭示了什么,又可能隐藏什么?

09

参考资料说明

  1. COSO (2017). Enterprise Risk Management: Integrating with Strategy and Performance — Executive Summary.

    COSO ERM 执行摘要。

    用于目标、战略、risk appetite、performance variation、信息沟通与 review 的基础框架。

  2. Grant Thornton (2017). Risk Frameworks.

    风险框架材料。

    用于责任分配、risk appetite 进入决策、风险报告以及管理层与监督机构的分工。

  3. Deloitte (2017). Managing Non-Financial Risk.

    非财务风险框架材料。

    用于跨部门的运营、网络、数据、人员、第三方、合规、客户与声誉风险。

  4. Royal DSM (2021). Integrated Annual Report, pp. 123–146.

    指定范围为治理、风险与内部控制相关页。

    用于区分企业对制度设计的公开说明,与制度在日常运营中是否真实有效。