- 學位論文
An Innovative Framework of Data Governance
An Innovative Framework of Data Governance
摘要
由於資訊科技創新、企業規模的擴張和全球化、政策法規不斷推陳出新，企業的營運管理因而面臨諸多新的挑戰，需要投資大量的精力和成本管理營運的風險，並遵從各種相關法令規範，因此治理、風險及遵循(Governance、Risk and Compliance，簡稱GRC)議題已被日漸重視，而其中資料治理即為近幾年湧現且被視為相當重要的GRC研究議題。合適的資料治理能協助企業有效管理資料，進而使其在遵從法規要求之情況下，活用企業資料，最大限度地發揮其資料資產價值，因此需要有一適當的資料治理架構協助企業同時實現遵從法規要求與達成企業營運目標。由於資料治理相關學術研究尚在起步階段，雖然目前已有文獻提出資料治理的概念，但尚未有一致認同之統合架構，因此本論文主要目的為建構出一資料治理架構，並探討組織成功實行資料治理應考慮的關鍵控制項目。 由於資料治理關鍵控制項目之評估會受評估者之風險意識與認知變化影響，故在不同環境情況下會有很大的差異，且易受評估者主觀認知的模糊性左右，屬於複雜與模糊的決策問題。因此，本論文分為三階段進行資料治理關鍵控制項目的探討，第一階段首先蒐集與彙整資料治理相關之文獻，透過紮根理論研究法分析與歸納資料治理架構之控制項目雛形；第二階段則結合修正式德菲法與Lawshe’s CVR (Content Validity Ratio)進行資料治理架構之控制項目雛形的確認，經由專家評估與篩選出適當且具代表性之控制項目；第三階段再延請銀行業、製造業、政府單位具實務經驗人員針對篩選後之控制項目進行重要性評估，評估方式則結合模糊理論與層級分析法，透過模糊語意變數與解模糊化消除評估者主觀認知的模糊性，以模糊層級分析方法計算資料治理架構下各控制項目的重要性程度，並分析比較其在不同產業下之排列順序變化，以探討組織成功實行資料治理應考慮的關鍵控制。 目前研究結果顯示不同產業的受測者對資料治理架構的重要性評估各有不同的觀點，本研究針對資料治理控制重要性評估結果有明顯差異之銀行業與政府單位推演出個別地資料治理架構：銀行資料治理架構(Banking Data Governance Framework, BDGF)與政府資料治理架構(Government Data Governance Framework, GDGF)，最後，本研究進一步以實地個案研究(Field Case Study)驗證BDGF，驗證過程包含階段一以內容分析方法(Content Analysis)，分析探討個案銀行公司資料治理事件與本研究資料治理架構中各個控制項目之關係，階段二採用實地實驗法(Field Experiment Method)，調查個案銀行公司啟動與資料治理相關之洗錢防制查核專案實際可協助其改善的查核效果與本研究資料治理架構中各個控制項目之關係。而驗證結果顯示本研究所提出的BDGF架構能有效的反映出個案銀行的資料治理架構。
並列摘要
Continuous innovation in information technology, the expansion and globalization of enterprises, and the necessary introduction of new policies and regulations engender challenges that compel enterprises to invest massive amounts of effort and capital into managing operating risks and complying with relevant regulations. As a result, governance, risk and compliance (GRC) have become increasingly critical issues. In particular, data governance has emerged as a paramount GRC research topic. Adequate data governance enables enterprises to effectively utilize data for business purposes while remaining compliant with legal requirements and maximizing the value of their data assets. A suitable data governance framework is needed to assist enterprises in achieving operational goals while fulfilling legal requirements; however, data governance-related academic studies remain in their infancy. Though some studies have introduced the concept of data governance, no consensus on a unifying framework has evolved. The primary purpose of this study is to construct a data governance framework and to examine the critical controls that organizations must consider to successfully implement data governance. Since evaluations of critical controls for data governance are inevitably influenced by the risk perceptions and cognitive challenges of evaluators, the GRC evaluations tend to differ based on various environmental conditions and the fuzziness of evaluators’ subjective cognition. Therefore, control evaluations have become a complex and fuzzy decision-making problem. To address this issue, this study examines critical data governance controls in three phases. In the first phase, relevant data governance studies were collected and summarized, and grounded theory research methodology was applied to analyze and compile the control prototypes to be used in a data governance framework. In the second phase, the modified Delphi method and Lawshe’s content validity ratio (CVR) were combined to confirm the control prototypes for use in the data governance framework. The most suitable and representative controls were identified after assessments and screening by Taiwanese experts. In the third phase, experienced professionals from government authorities and the banking and manufacturing industries evaluated the importance of the selected controls. Evaluations were performed using a combination of fuzzy theory and the hierarchical analysis method. Fuzzy semantic variables and defuzzification methods were employed to eliminate any fuzziness in the subjective cognition of evaluators. The fuzzy hierarchical analysis method was adopted to calculate the relative importance of various controls in the data governance framework and to analyze and compare rankings across industries, allowing for an evaluation of the critical controls that organizations must consider for the successful implementation of data governance. The results of this study show that respondents from separate industries have varying views on the importance of particular controls in a data governance framework. Based on differing opinions on the importance of various controls, individual data governance frameworks were developed for the banking industry and for government authorities in Taiwan: the banking data governance framework (BDGF) and the government data governance framework (GDGF). Finally, this study validated the BDGF using a field case study. In Phase 1 of the testing process, content analysis was employed to examine the relationships between data governance incidents at the case bank and various controls in the data governance framework. In Phase 2, a field experiment was conducted to investigate the relationships between controls in the data governance framework and improvements in audit results following the implementation of a money laundering prevention audit project. Test results show that the BDGF developed in this study effectively reflects the data governance framework of the Taiwanese case bank.