我國IT治理之個案研究

Abstract

論文摘要 對許多組織而言，資訊與其支援技術代表該組織最有價值的資產，而且，競爭和不斷變化的商業環境也要求企業充分利用資訊技術實現更快的交付速度及更低的成本。因此，有效的公司治理與風險管理必然需要有效的IT治理及IT風險管理。亞洲地區對於IT治理的認知並不普遍，未能藉由良好的管理，充分利用資訊科技所能帶來的利益。本研究以個案研究方式，由IT治理之內部控制點分析企業於資訊管理上所產生之現象及問題，並以IT治理之五大領域為基礎提供實務界資訊管理上之相關建議。 本研究深入訪談的對象為分屬五種不同產業的五家公司，其中包括了飯店業、醫藥生化業、機械業、電子業及政府機關，經訪談結果指出，IT治理之五大領域中，最受企業重視者為風險管理，最缺乏者為績效衡量；各個受訪公司資訊部門主管對於風險管理皆有一致的共識，且於此方面花費相當的時間及成本，但對於系統所提供的服務效能水準卻未訂定事前之標準，更未於事後定期評估其實際之績效。 本研究就深入訪談結果，於企業資訊管理上給予以下五點建議：1、重視IT策略擬定，確保IT策略與企業策略目標一致；2、重視IT投資時之效益評估；3、加強內部稽核人員之IT相關專業知識；4、注重IT人員之訓練並提供合理之升遷管道；5、訂定有效之績效衡量指標，定期衡量IT績效。

Abstract Requirements for increased IT quality, decreased delivery time and continuously improving service levels are receiving higher emphasis within tighter cost constraints. Information and the technology that supports it represent many organizations' most valuable asset. Therefore, effective corporation governance and risk management need effective IT governance and the risk management of IT. However, the awareness of IT governance is not widespread in the Asia region. Organizations couldn’t take advantage of effective management to earn profits. This research uses the framework of internal control of IT to analyze the phenomenon and the questions of enterprises’ information governance by case study and provides related suggestions of information management to the industry on the basis of the five areas of IT governance. This research interviewed five different companies in five industries including hotel industry, medical biochemistry industry, machinery industry, electronics industry, and government departments. The interview result points out those enterprises pay much attention to risk management but do not concern with performance evaluation. Every director of the information department in all companies I have interviewed has common consensus on the risk management and spends much time and cost on this field. But they do not establish the standard of effectiveness level for the system service and even do not evaluate the actual performance periodically. This research provides five suggestions of business information governance through the result: 1.Ascertaining that IT strategy is aligned with enterprise strategy. 2. Stressing importance of the effectiveness evaluation of IT investment. 3. Enhancing the IT-related expertise of internal auditors. 4. Emphasizing the training of IT staffs and providing reasonable promotion policy. 5. Setting up some effective indexes for performance measurement and measuring the performance periodically.