銀行業資訊部門作業風險關鍵因素之研究

Critical Factors of Operational Risk in Bank‘s Information Technology Department

游麗藎(lichin.yu)

指導教授 ： 邱垂昱

國立臺北科技大學/管理學院/工業工程與管理系碩士班/碩士(2012年)

摘要

銀行扮演資金供需橋樑的角色，是台灣經濟發展重要的一環，其資訊部門隨著銀行近年來歷經金融改革、金融整合、資本市場快速成長與金融商品推陳出新，電腦技術與設備必須不斷地配合業務策略快速發展，在發展過程中因為銀行內部人員的疏忽、控管流程不當、系統失誤與外部的衝擊，均會造成銀行面臨嚴重的作業風險。
本研究透過文獻探討初步訂定銀行業資訊部門作業風險層級與因素，再運用德爾菲法專家問卷及分析層級程序法等研究方法彙集相關資深專家人士的意見，建構歸納出各項因素之相對重要程度與權重。
經整理後，得出三個主要層級架構。其中第一個層級為目標層級「銀行業資訊部門作業風險之關鍵因素」，第二層級共計有4個構面，第三層級共計21 項因素。在第二層級以「人員構面」最為重要；在第三層級權重依序為「員工共謀/詐欺」、「內控/資安失當」、「機電設備異常」、「網路設備異常」、「系統運作異常/當機」、「系統存取控制未落實」與「密碼未適當的選擇及保護」等7項因素最為重要。最終歸納出「銀行業資訊部門作業風險之關鍵因素」的權重排序表，並期望能以本研究結果，使管理者能更準確地掌握風險項目，以利資源分配運用，提早採取因應措施，以降低作業風險。其中排名第一的「員工共謀/詐欺」與第二重要的關鍵因素「內控/資安失當」合計共佔7項關鍵因素的58%，建議慎選適當人員，定期施予充足的教育訓練提高對道德的認知，加強其應有的法律責任，利用制度面的設計，並強化政策、指導原則、程序或作業流程等之設計，以防範發生。

關鍵字

關鍵因素 ； 作業風險 ； 德爾菲法 ； 分析層級程序法 ； 銀行資訊部門

並列摘要

Hierarchy Process, Banking Information Technology Department Banks are thebridges which link supply and demand in the capital markets, and have played a
significant role in the economic development of Taiwan. With the recent financial eformreform in Taiwan, increasing global financial integration, the rapid growth of capital markets and the introduction of the new financial commodities, Information Technology departments in banks need to lead the renewal of information technology and equipment to support the strategic growth of the banks. Until the necessary transformation is complete, banks will be subject to serious operational risks due to negligence of employees, improper control over processes, system failures, or external shocks.
In this study, the author identified a preliminary set of operational risk levels and factors from papers, and used the Delphi Survey and Analytic Hierarchy Process (AHP) to gather and analyze the opinions from senior experts in order to construct an analysis model for the relative importance and consequent weighting of each risk factor.
The author constructs three main hierarchical levels for the analysis of operational risks. The first level is the target level of “critical operational risk factors for the information technology departments of banks”. The second level consists of four constructs in which the “People Construct” is the most influential. The third level contains twenty one key factors, with “Employee Conspiracy/Fraud”, “Inappropriate Internal Control over Information Security”, “Electrical/Mechanical Equipment Failure”, “Network Equipment Failure”, “System Failure”, "Inadequate Control of System Storage" and “Inappropriate Handling of Password” as the seven most critical factors. Of the seven most critical factors, "Employee Conspiracy/Fraud" and "Inapproprate Internal Control over Information Security" account for 58% of the importance. In order to prevent them, the author suggests that banks select IT employees carefully, develop and implement the standard procedure as well as guidlines, and give the employees sufficient training to raise their ethical awareness and educate them of their legal responsibilities. Finally, the author devises a weighted score card for critical operational risk factors for Information Technology departments of banks. The score card is designed to be used by management for more accurate risk assessment in order to take necessary actions responsively at an early stage.

並列關鍵字

Key Factors ； Operational Risk ； Delphi Method ； Analytic Hierarchy Process

參考文獻

2. 余序江、許志義、陳澤義，科技管理導論：科技預測與規劃，台北：五南書局，1998。

6. 沈大白、黃追，「從作業風險自評落實風險管理」，會計研究月刊，第270期，2008。

7. 沈大白、黃追，「各國監理機關對作業風險量化規定之差異及發展」，會計研究月刊，第307期，2011。

8. 沈大白，企業風險管理，台北：新陸書局，2010。

9. 何文榮、許光華、黃君葆，「我國新銀行資訊系統發展策略之研究」，朝陽學報，第3期， 1998。