legalby asgard-ai-platform
企業風險管理框架（Enterprise Risk Management, ERM）
asgard-ai-platform/biz-erm
Enterprise risk management (ERM) framework layer — integrates COSO ERM 2017 (five components, 20 principles), ISO 31000, three-lines model, risk appetite, risk heatmap, and key risk indicators (KRI) into a complete governance playbook covering structure through culture.
What it changes
Passed 21 of 23 test cases with the skill, and 18 of 23 without it.
Without skill78%
With skill91%
Checks it passed that the model alone missed
- Recommends setting total KRI count between 15 and 25 indicators
- Recommends an ERM implementation timeline spanning 12 to 18 months
- Assigns Risk Appetite approval authority strictly to the Board of Directors
and 3 more in the full report
3 fixed18 passed either way2 still failing0 broke
- Pass-rate lift
- +13 pp
- Tokens
- +176%
- Agent turns
- 0%
- Response time
- +11%
Model gemini-3.6-flashMeasured 8/27/2026v121 of 23 cases passed with skill
See it in action
One of 3 test cases the skill fixed. Same model, same prompt, with and without the skill.
Prompt我們連鎖餐飲集團正在推動跨國擴張，希望建立可落地的企業風險管理機制以提升決策品質。請產出一份企業風險診斷與導入建議，內容請梳理：現況盤點、核心缺口診斷、風險胃納建議、風險熱圖評估、KRI 監控與回應機制、三道防線重構、組織文化與專責權責規劃、12-18 個月導入路線圖，以及實施時的風險與限制。
What was checked, without and with the skill| Checked | Without skill | With skill |
|---|
| Assigns Risk Appetite approval authority strictly to the Board of Directors | Missed | Passed |
|---|
| Rejects concurrent holding of Chief Risk Officer and Chief Financial Officer roles | Missed | Passed |
|---|
| Structures Section II gap analysis into governance, appetite, process, and culture dimensions | Missed | Passed |
|---|
| Categorizes Section III risk appetite into strategic, financial, operational, and compliance/reputation dimensions | Missed | Passed |
|---|
What's inside
The instructions your model reads when the skill loads.
SKILL.md418 lines6 files
企業風險管理框架（Enterprise Risk Management, ERM）
定位
為什麼 EMBA 要學 ERM 框架
台灣企業風險管理常見兩種極端：
- 過度工具化：只做財務風險 VaR、信用評分，但沒有治理結構
- 過度形式化：有風險委員會但只開會、沒風險胃納、沒 KRI 觸發機制
本 skill 拉回「框架＋治理」層，整合 COSO ERM 2017 與 ISO 31000，讓學員能：
- 分層診斷（治理→文化→流程→工具）
- 設計可執行的風險治理結構
- 避免「有報表沒行動」的 ERM 陷阱
與相近 Asgard skill 的邊界
algo-risk-altman-z — 財務危機預測（單一量化工具）algo-risk-benford — 舞弊偵測數學algo-risk-credit — 信用風險評分algo-risk-var — 市場風險 VaRgrad-governance — 公司治理學理- 本 skill — 風險管理整合框架，協調治理結構、風險胃納、文化、工具四層
何時使用
觸發條件
- 公司要導入 ERM 或重整現有風險管理
- 金管會公司治理評鑑、ESG 風險揭露
- 設立風險管理委員會或風險長（CRO）職位
- 三道防線重建（尤其 IPO 前或金融業）
- 家族企業職業化、大型專案風險治理
- 企業危機後的「風險治理體檢」
不適用
- 單一風險量化計算 → Asgard
algo-risk-*
- 危機事件的即時溝通 → Asgard
pr-crisis-communication、pr-crisis-response
- ESG 永續揭露 → 本 repo
biz-net-zero-transition、Asgard grad-sustainability
- 合約法律風險 → Asgard
law-contract、law-gdpr-pdpa
IRON LAW — ERM 三條鐵律
Track record
Benchmark
21 / 23
test cases passed, vs 18 / 23 without
Adoption
- Users
- 0
- Times used
- 0
Safety and source details
SkillSafety
✓ 3 of 3 passed✓Code scan15 of 15 checks clean
0 critical · 0 warning · 0 info — scanner v4 — 8/3/2026
View 15 scanner checks
live_secretremote_code_executionreverse_shelldata_exfiltrationssrf_metadataagent_snoopinganti_refusaldestructive_commandsobfuscated_unicodeunicode_homoglyphopaque_blobsuspicious_urltool_overreachtrigger_abuseprompt_injection_phrasing
✓IntentSafe
LLM judge · does the skill do what it claims
✓ContentClean
LLM judge · policy & harmful-content review
Source
ImportedLicense MITImported 8/3/2026Version v1Bundled 5 files