物聯網環境下企業風險管理與內部控制稽核機制之研究

Enterprise Risk Management and Auditing Mechanism of Internal Control for IoT Governance

張碩毅(She-I Chang) ； 張麗敏(Li-Min Chang) ； 萬貴然(Grand Wan) ； 廖展群(Jhan-Cyun Liao)

《電子商務學報》 21卷1期 (2019/06) Pp. 77-119

https://doi.org/10.6188/JEB.201906_21(1).0003

摘要

本研究目的為發展物聯網環境下企業風險管理與內部控制稽核機制。在質性研究法及Gowin's Vee知識地圖的基礎下，首先透過文獻探討的方式整理物聯網環境風險因子與內部控制稽核項目；各類風險因子與稽核項目，在企業交叉風險及COSO內部控制整合框架的對應下產生問卷雛型，並透過德爾菲專家問卷的訪談來修正問卷。其次，本研究運用國際內部稽核協會（IIA）所建立的三道防線及能力成熟度整合模型（CMMI）之概念，來進一步發展稽核流程與評估方法。最後，本研究以三家公司來進行個案實證，以驗證所產出的稽核機制被運用在企業內部控制稽核的可行性。本研究成果可貢獻於學術界強化質性研究知識，與實務界在物聯網環境下實施企業風險管理與內部控制稽核之參考。

關鍵字

物聯網 ； 企業風險管理 ； IT治理 ； 內部控制 ； 稽核機制

並列摘要

The aim of this research is to explore the factors influencing enterprise risk management and auditing mechanism of internal control in the internet of things (IoT) environment. Applying a qualitative research approach and following the Gowin's Vee research strategy, firstly, this study reviewed the relevant literature and used the Delphi expert assessment method to identify risk factors as well as auditing items in the IoT environment. Secondly, according to the nature of eight types of intersecting risks and internal control framework of COSO 2013, this study constructed the three lines of defense in effective risk management and internal control mechanism based on the evaluation criteria of Capability Maturity Model Integration (CMMI). Lastly, this research conducted empirical case study from three enterprises to verify that whether the risk factors and auditing mechanism can be effectively used for internal risk control assessment within the corporation. The audit mechanism established in this study and the empirical process of case study can be referenced by academia for enhancing the knowledge of qualitative research, and also by industries as IT governances in the IoT environment.

並列關鍵字

Internet of Things (IoT) ； enterprise risk management ； IT governance ； auditing mechanism ； internal control

參考文獻

林育震（2010）。掌控風險－發揮雲端效益。資訊安全通訊，16（4），138-149。

Mihaela, D., & Iulian, S. (2012). Internal control and the impact on corporate governance, in Romanian listed companies. Journal of Eastern Europe Research in Business & Economics, 2012, 1-10.

Akhtaruddin, M., & Ohn, J. (2016). Internal control deficiencies, investment opportunities, and audit fees. International Journal of Accounting and Finance, 6(2), 127-144.

Amid, A., & Moradi, S. (2013). A Hybrid Evaluation Framework of CMM and COBIT for Improving the Software Development Quality. Journal of Software Engineering and Applications, 6(5), 280-288.

Ayre, C., & Scally, A. J. (2014). Critical values for Lawshe's content validity ratio revisiting the original methods of calculation. Measurement and Evaluation in Counseling and Development, 47(1), 79-86.