基于生命周期的信息系统内部控制风险管理研究  

Research on the Risk Management of Information System Internal Control Based on Life Cycle

作　　者：吴炎太[1] 林斌[2] 孙烨[2] 

机构地区：[1]广东金融学院计算机系 [2]中山大学管理学院

出　　处：《审计研究》2009年第6期87-92,共6页Auditing Research

基　　金：国家自然科学基金(70972076);教育部人文社科规划项目;财政部重点会计课题(2008KJA12)的资助

摘　　要：加强信息系统内部控制,降低信息系统风险,具有重要意义。本文介绍了COSO和COBIT有关信息系统内部控制的理论,分析了COBIT的控制思想和存在的不足,介绍了我国信息系统内部控制规范发展状况,分析了我国《企业内部控制应用指引——信息系统》的基本思想。论述了信息系统生命周期与风险管理之间的关系,提出了以信息系统生命周期为基础,根据信息系统不同阶段的风险特征进行信息系统风险控制的方法。本文按照信息系统生命周期的不同阶段,对信息系统内部控制主要风险进行了探讨,指出了信息系统各个阶段存在的主要风险,并据此提出了相应的信息系统内部控制风险管理方法。It is very important to strengthen the information system internal control and reduce the risk of information system. This article introduces the COSO and COBIT＇s theory related to information system internal control, and analyses the COBIT＇s control ideas and deficiencies. The article introduces the development of Chinese information system internal control criteria, and analyses the basic idea of Chinese the Application Guideline to Enterprise Internal Control： Information System. The article discusses the relationship between the life cycle of information system and risk management, and puts forward information system risk control practices based on the life cycle of information system according to the risk characteristics of information system＇s different stages. The major internal control risks of information system are discussed in accordance with different stages of information system life cycle, and the major risks of information system at all stages are pointed out. For every stage of information system, corresponding internal control risk management practices of information system are put forward.

关 键 词：生命周期 信息系统 内部控制 风险管理 

分 类 号：F275[经济管理—企业管理]