Organisatsiooni IT juhtimise, riskihalduse ja vastavuse raamistik

Date

2017

Journal Title

Journal ISSN

Volume Title

Publisher

Abstract

Ettevõtted on hakanud mõistma, et infotehnoloogias (IT) ei ole vaid tehnilised aspektid. IT haldamiseks on vaja (IT) juhtimist, (IT) riskihaldust ja (IT) vastavust. Klassikalise lähenemise kohaselt on kõigiga eraldiseisvana tegeldud, mis aga ei ole väga efektiivne – äri toodab väärtust ning kõiki protsesse püütakse optimeerida. Probleemi lahenduseks on ärimaailmast üle toodud paradigma „GRC“ (Governance – juhtimine, Risk management –riskihaldus ja Compliance – vastavus), mis need kõik omavahel ühendaks. Käesolev magistritöö esitleb süstemaatilist kirjandusülevaadet IT GRC-teemal ning selle tulemustest koostatud IT GRC raamistikku, mille eesmärgiks on lihtsustada ettevõtete pingutusi oma IT protsesside kohandamisel. Lõppkasutaja abistamiseks on loodud raamistikule ka veebirakendus, mis on abiks raamistiku kasutamisel. Loodud raamistik põhineb teaduslikel artiklitel ning on läbinud ka esmase validatsiooni.
Today, enterprises have reached to understanding that Information Technology (IT) is more than just a technical issue. Disciplines such as IT governance, (IT) risk management and (IT) compliance have been established to steer it. Though, there has been some improvements, these domains are usually focused separately in silos, which raises a problem of performance and efficiency, where less business value is created due to complexity of the process flows. In order to cure it, there has been an adoption from business world, referred as “GRC” which covers all the three disciplines of governance, risk management and compliance. The paper conducts a systematic review on the discipline of IT GRC, taking out best practices. Researching what has been done to integrate them and proposing an synthesized framework from the review results. The framework, unifying the disciplines is supposed to ease the adoption of IT GRC in an enterprise, providing a structure to manage the IT and business together, thereby improve business performance. In addition to proposing an IT GRC framework, the paper presents a web application to support the framework adoption. The proposed model is based on the scientifically proven best practices of the state of the art which would give a certainty of its value. The empirical study will help to contribute to improving the effectiveness IT GRC compared to traditional approach which is commonly practiced in enterprises.

Description

Keywords

Citation