【作者】 王勇；

【导师】 赖静文；

【作者基本信息】 西南财经大学 ， 高级管理人员工商管理（EMBA）， 2014， 硕士

【摘要】 A商业银行成立于2001年6月,是由原A市的10家城市信用社合并组建的。经过多年的发展,现有营业网点46个,跨3个地州市,员工人数1000余人,资产规模500亿元。A商业银行IT建设从2001年起步,主要采取自建的方式,由A商业银行的IT部门负责实施。A商业银行IT部门目前拥有员工23人。IT的管理方式介于集权制和分散制。重大的基础性IT建设由IT部门主导,一些规模较小、功能单一的应用程序由业务部门或支行自行采用。经过多年投入,目前已经建立了能够基本上能满足其业务和管理的需要的IT系统。尽管银行管理层核心并没有认为IT是企业最重要的战略性资产之一,但管理层普遍认为IT是实现银行战略目标的借助手段之一。IT对A商业银行的重要性虽然已经充分显现,但IT风险管理的缺失也会对业务发展带来负面影响。本文对A商业银行怎样进行有效的IT风险管理的整个工作实践进行了梳理和总结,从而为其他同类商业银行IT风险管理体系建设和实践提供借鉴。另一方面,也可以为有关高校的IT风险管理研究工作提供研究案例。本文依据相关理论文献和行业相关规范,通过调研、访谈和观察的方法,结合对风险理论的学习和使用,联系A商业银行的IT实践,参考和借鉴国际IT服务管理的最佳实践,探索出符合实际、具有操作性、满足A商业银行IT风险管理工作需要的完整体系。本文结构安排如下：第一章为绪论,介绍研究背景、研究的问题和研究方法。第二章从简单的风险、风险管理概念介绍开始,引出商业银行IT风险及管理的概念,确定了本文对IT风险及IT风险管理的定义,并根据风险管理理论指出了A商业银行IT风险管理的目标,并介绍了IT风险管理最佳实践IS020000。第三章阐述了A商业银行IT风险的识别和评估方法、IT风险管理体系的内容。第四章探讨了A商业银行IT风险管理体系建设。其内容包含组织体系建设、制度体系建设和技术体系建设。第五章通过风险管理理论在商业银行IT风险管理的引用,论述了在A商业银行的IT风险管理实践工作对技术的运用的必要性和重要性,并详细记录了前述理论和方法的落地。第六章结束语,叙述本论文的研究结论。本文的研究结论如下：1、商业银行的IT风险管理工作必须依据风险管理理论指导,参照IT服务管理最佳实践IS020000,才能有效建立IT风险管理体系；2、商业银行IT风险管理体系的有效运行一是要依靠商业银行全体人员的风险意识培养,还离不开各种技术工具；3、技术的进步和新技术的运用、观念的创新会从多个方面给A商业银行的IT风险管理工作带来良好的影响。4、商业银行的IT风险因素蕴含在整个商业银行的IT活动中,所以要进行有效的IT风险管理就必须建立覆盖所有IT活动的IT风险管理体系,并在所有员工中灌输IT风险意识。更多还原

【Abstract】 Commercial bank A was established in June2001, which was formed by the merge of10city credit cooperatives of A city. After years of development, commercial bank A owns46branches across3prefectures, more than1000employees, and assets around50billion Yuan.IT construction of commercial bank A started in2001, and the A bank’s IT department, with23staff, was responsible for the IT construction and implementation. IT management of A bank is not centralized or decentralized. The IT department is in charge of the major IT construction projects, while business department or branches can choose their own applications of small size or single function.After years of investment, commercial bank A has established IT system that can basically meet its business and management demands. Although the core managers do not think that IT is one of the most important strategic asset of the bank, the general management layer agrees that IT is a necessary tool to achieve the strategic goals of the bank. Hence, the significance of IT construction has been fully realized, but the lack of IT risk management will have a negative impact on business development of the bank.This paper gives a systematic introduction and summary of A bank’s experience on IT risk management, which provides references for other similar commercial banks in constructing risk management system. On the other hand, it also offer case study to colleges and universities for their researches on IT risk management.According to the related theories, documents and regulations, this paper applies the research method of interview and observation. Based on the IT practices of A bank and international IT management experience, this paper aims at establishing a practical and systematic operation mode to meet the demand of A bank’s IT risk management This paper is divided into six parts as follows:The first chapter is the introduction of the research background, research problems and methods.The second chapter introduces the concepts of risk, risk management, as well as the IT risk management of commercial banks. Based on the concepts clarified above and risk management theories, this paper gives a detailed explanation on IT risk management goals of A bank, and also introduces the best IT risk management method that is ISO20000.The third chapter elaborates on the IT risk identification and assessment methods, as well as the IT risk management system of commercial bank AThe fourth chapter analyzes the A bank’s IT risk management construction, including organization design, system construction and technological support.Based on the A bank’s working experience in applying risk management theory, the fifth chapter emphasizes the significance of technological support in IT risk management practices. And this part also gives a detailed record of theories and research methods discussed above.The sixth chapter is the conclusion of this paper.The conclusions of this paper are listed as follows:IT risk management of commercial banks must be in accordance with the risk management theories. And banks can establish the effective IT risk management system by learning from ISO20000, the best IT service management method.The lack of risk awareness of employees and various technological tools may lead to the malfunction of IT risk management system of commercial banks.IT risk management of A bank can benefit a lot from the technological improvement, conceptual innovations, and application of new technologies.IT risk in activities of commercial banks can not be avoided. As a result, to combat IT risks effectively, commercial banks should establish a comprehensive IT risk management system covering all IT activities and promote the risk awareness of all employees.更多还原