資訊系統委外風險之研究─以A銀行為例

黃明達(Ming-Dar Hwang)；黃龍琤(Long-Cheng Huang)

資訊系統委外 ； 委外生命週期 ； 委外風險 ； Information system outsourcing ； Outsourcing life cycle ； Outsourcing risk

電腦稽核

28期（2013 / 07 / 13）

61 - 71

繁體中文

資訊系統委外盛行的當今，如何讓委外專案成功的執行顯得格外重要。本研究希望透過個案研究的方式，瞭解資訊系統委外所可能發生的風險，進而預防風險以利提升資訊系統委外專案的成功率。本研究首先透過文獻探討，並綜合實務經驗，產出一個以資訊系統委外生命週期為基礎的風險研究架構，並以國內某外商A銀行企業金融資訊處做為研究對象，搜集三年內的23個資訊系統委外合約的相關資料，進行風險的回顧分析，探討各委外階段所可能發生的風險，最後提出個案分析的主要發現以及相關建議作為研究結論。研究結果顯示，委外生命週期中最常發生風險的階段為「合約中階段」，最容易發生風險的主要管理活動為「6.委外專案執行」。主要常見的風險項目為「C7.1缺乏評價測量標準和工具」、「B4.2合約未指定不履約處罰」、「B4.1合約未指定適當的量表」、「B6.5變更和逐漸產生的目標/範圍/需求」、「A2.1不適當的預估時程表及所需資源」、「B4.10供應商鎖定（Lock-in）」及「B6.1過度依賴供應商」。

Information system outsourcing is very popular nowadays, therefore to be successful when outsourcing a project is particularly important. The purpose of this case study is to understand the risk of information system outsourcing, and thus preventing the risks and improve the success rate of information system outsourcing projects.From literature reviews and practical experiences, this paper developed a conceptual framework of information system outsourcing risks based on an outsourcing life cycle. 23 samples of outsourcing contracts and within the period of 3 years and its related information were extracted from the Bank A for this case study. This paper reviews the risks from the selected 23 outsourcing projects and discusses the possible risks for each phases of the outsourcing life cycle. The major findings and implication of the case study are also discussed in this paper.The result shows that the most risky phase of the outsourcing life cycle is ”Contract phase”. The most risky managerial activity is” 6. Outsourcing project execution”. The most common risk items are ”C 7. 1 Lake of assess measurement, metrics, and tools”, ”B 4. 2 Failure to specify non-performance penalties”, ”B 4. 1 Failure to specify appropriate measures”, ”B 6. 5 Changing & creeping objectives/ scope/requirements”, ”A 2. 1 Unrealistic estimation of schedule & required resources”, ”B 4. 10 Vendor lock-in”, ”B 6. 1 Over dependence on the vendor”.

1. 行政院主計總處（2008）。政府機關「資訊系統委外開發」概況調查報告，政府機關資訊通報第249期調查報告。民102年4月13日，取自http://www.dgbas.gov.tw/public/Data/87311203471.pdf
2. Abdullah, L. M.(2010).School of Computer Science and Engineering, The University of New South Wales.
3. Abdullah, L. M.,Verner, J. M.(2012).Analysis and application of an outsourcing risk framework.Journal of Systems and Software
4. Addison, T.,Vallabh, S.(2002).Controlling software project risks: an empirical study of methods used by experienced project managers.Paper presented at the Proceedings of the 2002 annual research conference of the South African institute of computer scientists and information technologists on Enablement through technology
5. Arnold, U.(2000).New dimensions of outsourcing: a combination of transaction cost economics and the core competencies concept.European Journal of Purchasing & Supply Management,6(1),23-29.
6. Aubert, B. A.,Patry, M.,Rivard, S.(2005).A framework for information technology outsourcing risk management.ACM SIGMIS Database,36(4),9-28.
7. Boehm, B. W.(1991).Software risk management: principles and practices.Software, IEEE,8(1),32-41.
8. Cao, J.,Zhang, J.(2010).Risk Identification of FM Service Outsourcing Based on Outsourcing Life Cycle.Paper presented at the Internet Technology and Applications, 2010 International Conference on
9. Chou, D. C.,Chou, A. Y.(2009).Information systems outsourcing life cycle and risks analysis.Computer Standards & Interfaces,31(5),1036-1043.
10. Dibbern, J.,Goles, T.,Hirschheim, R.,Jayatilaka, B.(2004).Information systems outsourcing: a survey and analysis of the literature.ACM SIGMIS Database,35(4),6-102.
11. Duarte, G.,Sackett, P.,Evans, S.(2004).Step by step: breaking outsourcing down into manageable phases.Engineering Management Journal,6,28-30.
12. Grover, V.,Cheon, M. J.,Teng, J. T. C.(1994).A descriptive study on the outsourcing of information systems functions.Information & Management,27(1),33-44.
13. Institute, P. M.(2009).A Guide to the Project Management Body of Knowledge: PMBOK Guide.Project Management Institute.
14. Lacity, M. C.,Khan, S. A.,Willcocks, L. P.(2009).A review of the IT outsourcing literature: Insights for practice.The Journal of Strategic Information Systems,18(3),130-146.
15. Willcocks, L. P.,Lacity, M. C.,Kern, T.(1999).Risk mitigation in IT outsourcing strategy revisited: longitudinal case research at LISA.The Journal of Strategic Information Systems,8(3),285-314.
16. 李慈光(2002)。碩士論文(碩士論文)。高雄市，國立中山大學公共事務管理研究所。
17. 孫思源(2001)。碩士論文(碩士論文)。高雄市，國立中山大學資訊管理學系研究所。
18. 郭尤美(2007)。碩士論文(碩士論文)。臺北市，世新大學資訊管理學研究所（含碩專班）。
19. 陳德欽(2012)。碩士論文(碩士論文)。新北市，國立臺北大學企業管理學系碩士在職專班。
20. 游芷萍(2006)。碩士論文(碩士論文)。台北市，臺灣大學會計學研究所。