企業內部控制有關資訊系統與安全的個案研討

A Case Study of Enterprise Internal Control for Information System and Security

楊金炎(Kim-Yin Yeoh)

指導教授 ： 劉士豪 ； 顧裔芳

中原大學/商學院/資訊管理研究所/碩士(2001年)

https://doi.org/10.6840/cycu200100409

摘要

本研究透過兩個個案的訪談，實地了解個案公司資訊系統內部控制作業與資訊安全作業情形，研究結果顯示，企業的資訊系統內部控制無法確實發揮功能，歸咎其主要原因為：資訊科技的衝擊、高階主管對資訊安全政策的認知、審查作業的改變、稽核人員缺乏適當訓練。這也反應現階段國內企業既有的資訊系統內部控制度仍待加強，企業對於資訊技術的控管與評估仍嫌不足。

關鍵字

內部控制 ； 資訊安全 ； 資訊系統 ； 個案研究

並列摘要

This study discussed two cases through personal interview and surveys to investigate the situation of internal control in information systems and security in the two companies.

The results showed that the internal control in the Information Systems Department of this two companies need to be improved in many ways. The internal control policies can not be accomplished due to the following reasons: The impact of rapid changes in information technology; the high level manager’s cognition of the importance of information security; the changes of inspection procedures, and the lack of training programs for auditors.

The results also indicated that, the internal control for information technology and systems security still need to be improved, the abilities to control, to manage, and to evaluate the information technology still can be enforced.

並列關鍵字

information system ； internal control ； case study ； computer security

參考文獻

9.馬秀如，公開發行公司實施內部控制之研究，財團法人中華民國會計研究發展基金會，民　國86年。

2.Badenhorst, K. P.,and Jan H.P. Elloff “Framework of A Methodology for the Life cycle of computer Security in an oragnization”, Computer & Security, August , 1989, pp.433-442.

3.Baskerville, R. “Risk Analysis: An Interpretive Feasibility Tool in Justifying Information Systems Security,”European Journal of Information Systems (1:2), 1991,pp.121-130.

6.Committee of Sponsoring Organizations of the Treadwy Commission,COSO,“Internal Control─Integrated Framework,” New York：AICPA, 1992&1994.

8.Deborah Russell and G.T. Gangemi Sr.“Computer Security Basics,”California：O’Reilly & Associates, Inc. 1992.