行動支付風險管理稽核機制之研究

A Study of Risk Management and Auditing Mechanism for Mobile Payment

謝亞庭(YA-TING HSIEH)

指導教授 ： 張碩毅

國立中正大學/管理學院/會計與資訊科技學系/碩士(2016年)

摘要

隨著智慧型手機與各種手持裝置日漸普及，消費者購物時所運用之支付工具亦面臨革新，「行動支付」在這幾年已然成為電信、金融、手機軟硬體製造產業之間最熱門的話題之一；再加上消費習慣的快速改變，由實體店面銷售演變成越來越多的網路交易行為，多樣化之支付型態因應而生。將個人行動裝置結合金融支付工具進行交易，讓使用者不需帶錢包出門即能輕鬆完成小額支付是未來趨勢，也使許久未變的支付領域引入創新活水。
2015年被視為行動支付元年，我國政府單位也力推此支付新模式，2015年1月金管會放寬限制讓行動支付平台不須試辦即可營運，立法院亦三讀通過「電子支付機構管理條例」，使行動支付頓時火熱。然而，隨著此新興科技的發展，也引發各界對於其安全性與風險的疑慮，相關產業或企業的營運亦深受影響，在行動支付的環境下，給企業帶來發展契機卻也隱含著風險，因此我們欲從探究行動支付在應用上的威脅及風險著手，進一步探討企業如何落實管控，以確保組織的風險控管皆經良好設計並有效地執行。本研究建立行動支付環境下企業風險管理與稽核機制，以檢查和評估其現有行動支付相關之風險管控措施之施行狀況，藉由本研究針對特定之風險類別做內部控制有效性的評價，可了解部門控制制度須加強之處。
透過文獻探討及德爾菲專家問卷辨識出企業發展行動支付時會遇到之問題與挑戰，列出企業於行動支付環境下的風險因子，再依據英國「經濟學人研究中心」（the Research Central of Economics）之企業交叉風險8類，當作風險因子的分類架構；進一步在各風險類別底下建構出COSO各控制構面的行動支付環境下企業內部控制稽核要項，藉由與風險類別之對應識別出該項稽核要項是有機會用來檢驗此類行動支付風險的相關管控情形，以期作為行動支付環境下企業風險管理及稽核機制。最後，透過個案研究之方式，來驗證本研究產出結果的可行性，並依據受訪者提供的建議做討論而獲得最終成果。因此由本研究的檢核表，輔以CMMI能力成熟度模型，可作為自我評估行動支付環境下的風險是否能有相關的內控有效地管理風險。

關鍵字

CMMI能力成熟模型 ； 稽核機制 ； 風險管理 ； 行動支付

並列摘要

As smartphones and a variety of handheld devices increasingly popular, the use of the payment instrument when customer shopping is also facing innovation. ‘‘Mobile Payment’’ is on the rise within these years and has been a focus among the telecommunication companies, financial industry, and mobile phone makers. Coupled with the rapid changes in consumption habits, evolved from the sale on physical stores to more and more network transactions, diversification of the payment patterns are appeared. Personal mobile devices combined with financial payment instruments, so that users can go out without a wallet that still complete the transaction easily. It is the future trend and makes the field of payments an innovation push.

2015 is considered the first year of mobile payment. Our government units are also pushing this new mode of payment. In January 2015, FSC relaxation for mobile payment platform to operate without being a trial basis. Legislative Yuan also has the Third Reading of ‘‘The Act Governing Electronic Payment Institutions.’’ These actions make mobile payments hot suddenly. However, with the development of this emerging technology, also led all sectors concern about its safety and risk. The operation of related industries or companies also deeply affected. In the mobile payment environment, it brings opportunities to the enterprise, but also implies risk. Therefore, we want to start from exploring the mobile payment threats and risks. Further, explore how enterprises implement control. To ensure that the organization's risk control are well-designed and effective implementation. This study discuss, develop and verify an effective and feasible audit mechanism to ensure enterprise have effective control those risks of mobile payment. The mechanism also provides internal controls and audit practice model.

This study identifies enterprise risks that include issues and challenges under the mobile payment environment through literature review and the Delphi expert questionnaire. Then classification of risk factors based on the cross-risk of enterprise from the Research Central of Economics. Furthermore, this study also develops auditing items for this environment under COSO framework. Use these auditing items to test or evaluate the risk whether has a good management or not. Finally, by the way of case studies, to verify the feasibility of the research output. Based on recommendations provided by interviewees, discussing the mechanism and get the results. Therefore, by the use of checklist, including CMMI model, we can review the degree of internal controls implementation, review whether the internal controls are integrity, and fully implement.

並列關鍵字

Auditing Mechanism ； Risk Management ； Mobile Payment ； CMMI Capability Maturity Model

參考文獻

施炳煌. (2004). 中央行政機關實施內部控制制度之研究. 臺灣大學政治學研究所碩士論文.

陳李綢. (1991). 個案研究.

美國審計準則公報第55號. (1988). 會計研究發展基金會.

李培群. (2010). IT控制架構COBIT之探討-兼述GTAG之遵循(上). 證交資料, (579).

財政部證券暨期貨管理委員會. (1995). 公開發行公司建立內部控制制度與內部稽核制度實施要點.