Organisatsiooni IT juhtimise, riskihalduse ja vastavuse raamistik
Files
Date
2017
Authors
Journal Title
Journal ISSN
Volume Title
Publisher
Abstract
Ettevõtted on hakanud mõistma, et infotehnoloogias (IT) ei ole vaid tehnilised aspektid. IT haldamiseks on vaja (IT) juhtimist, (IT) riskihaldust ja (IT) vastavust. Klassikalise lähenemise kohaselt on kõigiga eraldiseisvana tegeldud, mis aga ei ole väga efektiivne – äri toodab väärtust ning kõiki protsesse püütakse optimeerida. Probleemi lahenduseks on ärimaailmast üle toodud paradigma „GRC“ (Governance – juhtimine, Risk management –riskihaldus ja Compliance – vastavus), mis need kõik omavahel ühendaks. Käesolev magistritöö esitleb süstemaatilist kirjandusülevaadet IT GRC-teemal ning selle tulemustest koostatud IT GRC raamistikku, mille eesmärgiks on lihtsustada ettevõtete pingutusi oma IT protsesside kohandamisel. Lõppkasutaja abistamiseks on loodud raamistikule ka veebirakendus, mis on abiks raamistiku kasutamisel. Loodud raamistik põhineb teaduslikel artiklitel ning on läbinud ka esmase validatsiooni.
Today, enterprises have reached to understanding that Information Technology (IT) is more than just a technical issue. Disciplines such as IT governance, (IT) risk management and (IT) compliance have been established to steer it. Though, there has been some improvements, these domains are usually focused separately in silos, which raises a problem of performance and efficiency, where less business value is created due to complexity of the process flows. In order to cure it, there has been an adoption from business world, referred as “GRC” which covers all the three disciplines of governance, risk management and compliance. The paper conducts a systematic review on the discipline of IT GRC, taking out best practices. Researching what has been done to integrate them and proposing an synthesized framework from the review results. The framework, unifying the disciplines is supposed to ease the adoption of IT GRC in an enterprise, providing a structure to manage the IT and business together, thereby improve business performance. In addition to proposing an IT GRC framework, the paper presents a web application to support the framework adoption. The proposed model is based on the scientifically proven best practices of the state of the art which would give a certainty of its value. The empirical study will help to contribute to improving the effectiveness IT GRC compared to traditional approach which is commonly practiced in enterprises.
Today, enterprises have reached to understanding that Information Technology (IT) is more than just a technical issue. Disciplines such as IT governance, (IT) risk management and (IT) compliance have been established to steer it. Though, there has been some improvements, these domains are usually focused separately in silos, which raises a problem of performance and efficiency, where less business value is created due to complexity of the process flows. In order to cure it, there has been an adoption from business world, referred as “GRC” which covers all the three disciplines of governance, risk management and compliance. The paper conducts a systematic review on the discipline of IT GRC, taking out best practices. Researching what has been done to integrate them and proposing an synthesized framework from the review results. The framework, unifying the disciplines is supposed to ease the adoption of IT GRC in an enterprise, providing a structure to manage the IT and business together, thereby improve business performance. In addition to proposing an IT GRC framework, the paper presents a web application to support the framework adoption. The proposed model is based on the scientifically proven best practices of the state of the art which would give a certainty of its value. The empirical study will help to contribute to improving the effectiveness IT GRC compared to traditional approach which is commonly practiced in enterprises.