資訊系統委外盛行的當今，如何讓委外專案成功的執行顯得格外重要。本研究希望透過個案研究的方式，瞭解資訊系統委外所可能發生的風險，進而預防風險以利提升資訊系統委外專案的成功率。

本研究首先透過文獻探討，並綜合實務經驗，產出一個以資訊系統委外生命週期為基礎的風險研究架構，並以國內某外商A銀行企業金融資訊處做為研究對象，搜集三年內的23個資訊系統委外合約的相關資料，進行風險的回顧分析，探討各委外階段所可能發生的風險，最後提出個案分析的主要發現以及相關建議作為研究結論。

研究結果顯示，委外生命週期中最常發生風險的階段為「合約中階段」，最容易發生風險的主要管理活動為「6.委外專案執行」。主要常見的風險項目為：合約前階段的「A2.1 不適當的預估時程表及所需資源」，合約中階段的「B4.1 合約未指定適當的量表」、「B4.2 合約未指定不履約處罰」、「B4.10 供應商鎖定 (Lock-in)」、「B6.1 過度依賴供應商」、「B6.5 變更和逐漸產生的目標/範圍/需求」，以及合約後階段的「C7.1 缺乏評價測量標準和工具」。

Information system outsourcing is very popular nowadays, therefore to be successful when outsourcing a project is particularly important. The purpose of this case study is to understand the risk of information system outsourcing, and thus preventing the risks and improve the success rate of information system outsourcing projects.

From literature reviews and practical experiences, this paper developed a conceptual framework of information system outsourcing risks based on an outsourcing life cycle. 23 samples of outsourcing contracts and within the period of 3 years and its related information were extracted from the Bank A for this case study. This paper reviews the risks from the selected 23 outsourcing projects and discusses the possible risks for each phases of the outsourcing life cycle. The major findings and implication of the case study are also discussed in this paper.

The result shows that the most risky phase of the outsourcing life cycle is "Contract phase". The most risky managerial activity is "6. Outsourcing project execution". The most common risk items are "A2.1 Unrealistic estimation of schedule & required resources" of pre-contract phase, "B4.1 Failure to specify appropriate measures", "B4.2 Failure to specify non-performance penalties", "B4.10 Vendor lock-in", "B6.1 Over dependence on the vendor", "B6.5 Changing & creeping objectives/scope/requirements" of contract phase, and "C7.1 Lake of assess measurement, metrics, and tools" of post-contract phase.

目次	V
表目錄	VII
圖目錄	IX
第一章	緒論	1
第一節	研究背景與動機	1
第二節	研究目的	2
第三節	論文架構	3
第二章	文獻探討	4
第一節	資訊系統委外	4
第二節	風險的定義	7
第三節	資訊系統委外相關風險探討	8
第四節	資訊系統委外生命週期	12
第三章	研究設計	15
第一節	研究架構	15
第二節	研究對象	18
第三節	研究流程	19
第四節	研究範圍及限制	20
第四章	個案研究與資料分析	21
第一節	個案資料描述	21
第二節	資料基本分析	28
第三節	資料交叉分析	35
第四節	主要發現	46
第五章	結論與建議	51
第一節	結論	51
第二節	建議	54
參考文獻	56
附錄、資訊系統委外生命週期之個案風險統計表	60

表目錄
表2-1  資訊系統委外定義彙整表	5
表2-2  資訊科技委外常見風險項目表	8
表2-3  資訊策略系統委外風險架構表	9
表2-4  軟體專案風險項目表	11
表3-1  資訊系統委外之風險項目彙整表	15
表3-2  資訊系統委外生命週期之風險架構	17
表4-1  研究資料來源與說明表	22
表4-2  研究個案合約清單	23
表4-3  個案風險清單及風險發生次數統計表	25
表4-4  資訊系統委外五大常見風險統計表	29
表4-5  系統開發合約各階段五大常見風險統計表	30
表4-6  系統維護合約各階段五大常見風險統計表	33
表4-7  廠商A、B各合約階段五大常見風險統計表	36
表4-8  廠商C各合約階段五大常見風險統計表	37
表4-9  廠商D各合約階段五大常見風險統計表	38
表4-10  廠商E各合約階段五大常見風險統計表	39
表4-11  各合約階段之廠商風險統計比較表	40
表4-12  小型系統開發專案合約各階段五大常見風險統計表	43
表4-13  中型系統開發專案合約各階段五大常見風險統計表	45

圖目錄
圖2-1  資訊系統委外生命週期	12
圖3-1  研究流程圖	19

一、 中文文獻
[1] 任慶宗、方顯光、羅兆清，〈委外產品類型與供應商依賴類型、委外風險關係之研究〉，華人經濟研究，第8卷，第2期，頁23-45，2010年9月。
[2] 行政院主計總處，〈政府機關「資訊系統委外開發」概況調查報告〉，政府機關資訊通報第249期調查報告，網址：http://www.dgbas.gov.tw/public/Data/87311203471.pdf ，上網日期：2013年4月13日。
[3] 吳百昌、尹延齡，〈資訊委外風險評估程序之研究-以國軍某單位為例〉，第十八屆國防管理學術暨實務研討會，頁 472-491，國防大學。
[4] 李慈光，《地方政府資訊業務委外策略研擬》，碩士論文，國立中山大學公共事務管理研究所，2002。
[5] 孫思源，《由社會交換理論探討資訊系統委外合夥關係之影響因素》，博士論文，國立中山大學資訊管理學系研究所，2001。
[6] 徐綺憶、王存國，〈資訊系統委外程度之影響因素探討〉，資訊管理研究，第3卷，第1期，頁107-129，2001年1月。
[7] 郭尤美，《資訊委外風險的失效模式與效應分析》，碩士論文，私立世新大學資訊管理學研究所(含碩專班)，2007。
[8] 陳德欽，《金融業務資訊系統委外作業之風險因素研究》，碩士論文，國立臺北大學企業管理學系碩士在職專班，2012。
[9] 游芷萍，《資訊系統服務委外之風險管理》，碩士論文，國立臺灣大學會計學研究所，2006。
[10] 楊靜麒，《政府機關資訊業務委外問題之個案探討》，碩士論文，私立華梵大學資訊管理學系碩士班，2009。
 
二、 英文文獻
[11] Abdullah, L. M. "Strategic IT system development outsourcing risks from the client perspective," The University of New South Wales, 2010.
[12] Abdullah, L. M., and Verner, J. M. "Analysis and application of an outsourcing risk framework," Journal of Systems and Software (85:8) 2012, pp. 1930-1952.
[13] Addison, T., and Vallabh, S. "Controlling software project risks: an empirical study of methods used by experienced project managers," Proceedings of the 2002 annual research conference of the South African institute of computer scientists and information technologists on Enablement through technology, South African Institute for Computer Scientists and Information Technologists, Port Elizabeth, South Africa, 2002, pp. 128-140.
[14] Arnold, U. "New dimensions of outsourcing: a combination of transaction cost economics and the core competencies concept," European Journal of Purchasing & Supply Management (6:1) 2000, pp. 23-29.
[15] Aubert, B. A., Patry, M., and Rivard, S. "A framework for information technology outsourcing risk management," The Database for Advances in Information Systems (36:4) 2005, pp. 9-28.
[16] Aundhe, M. D., and Mathew, S. K. "Risks in offshore IT outsourcing: A service provider perspective," European Management Journal (27:6) 2009, pp. 418-428.
[17] Boehm, B. W. "Software risk management: principles and practices," Software, IEEE (8:1) 1991, pp. 32-41.
[18] Cao, J., and Zhang, J. "Risk Identification of FM Service Outsourcing Based on Outsourcing Life Cycle," Internet Technology and Applications, 2010 International Conference on, 2010, pp. 1-4.
[19] Cheon, M., Grover, V., and Teng, J. "Theoretical perspectives on the outsourcing of information systems," Journal of information Technology (10:4) 1995, pp. 209-219.
[20] Chou, D. C., and Chou, A. Y. "Information systems outsourcing life cycle and risks analysis," Computer Standards & Interfaces (31:5) 2009, pp. 1036-1043.
[21] Chou, D. C., and Chou, A. Y. "Innovation outsourcing: Risks and quality issues," Computer Standards & Interfaces (33:3) 2011, pp. 350-356.
[22] Crosby, D. "Project risk management in smaller software teams," AUT University, 2007.
[23] Cullen, S., Seddon, P., and Willcocks, L. P. "Managing Outsourcing: The Life Cycle Imperative," MIS Quarterly Executive (4:1) 2005, pp. 229-246.
[24] Dibbern, J., Goles, T., Hirschheim, R., and Jayatilaka, B. "Information systems outsourcing: a survey and analysis of the literature," The Database for Advances in Information Systems (35:4) 2004, pp. 6-102.
[25] Duarte, G. M., Sackett, P., and Evans, S. "Step by step: breaking outsourcing down into manageable phases," Engineering Management Journal (6:6) 2004, pp. 28-30.
[26] Fitzgerald, G., and Willcocks, L. "Contracts and Partnerships in the Outsourcing of IT," Proceedings of the 15th International Conference on Information Systems, Vancouver, Canada, 1994, pp. 91-98.
[27] Gewald, H., and Rouse, A. "Comparing Business Process and IT Outsourcing Risks--An Exploratory Study in Germany and Australasia," System Science (HICSS), 2012 45th Hawaii International Conference on, 2012, pp. 275-284.
[28] Grover, V., Cheon, M. J., and Teng, J. T. C. "A descriptive study on the outsourcing of information systems functions," Information & Management (27:1) 1994, pp. 33-44.
[29] Hancox, M., and Hackney, R. "Information technology outsourcing: conceptualizing practice in the public and private sector," Systems Sciences, 1999. HICSS-32. Proceedings of the 32nd Annual Hawaii International Conference on, 1999.
[30] Hu, Q., Saunders, C., and Gebelt, M. "Research Report: Diffusion of Information Systems Outsourcing: A Reevaluation of Influence Sources," Information Systems Research (8:3) 1997, pp. 288-301.
[31] Institute, P. M. A Guide to the Project Management Body of Knowledge: PMBOK® Guide, (Forth Edition ed.) Project Management Institute, 2009.
[32] Kern, T. "The Gestalt of an information technology outsourcing relationship: an exploratory analysis," Proceedings of the eighteenth international conference on Information systems, Association for Information Systems, Atlanta, Georgia, USA, 1997, pp. 37-58.
[33] Kishore, R., Rao, H. R., Nam, K., Rajagopalan, S., and Chaudhury, A. "A relationship perspective on IT outsourcing," Communications of the ACM (46:12) 2003, pp. 86-92.
[34] Lacity, M. C., and Hirschheim, R. A. Information Systems Outsourcing; Myths, Metaphors, and Realities John Wiley & Sons, Inc., 1993.
[35] Lacity, M. C., Khan, S. A., and Willcocks, L. P. "A review of the IT outsourcing literature: Insights for practice," The Journal of Strategic Information Systems (18:3) 2009, pp. 130-146.
[36] Loh, L., and Venkatraman, N. "Determinants of information technology outsourcing: a cross-sectional analysis," Journal of Management Information Systems (9:1) 1992, pp. 7-24.
[37] Olzmann, M., and Wynn, M. "How to Switch IT Service Providers: Recommendations for a Successful Transition," International Journal On Advances in Intelligent Systems (5:1 and 2) 2012, pp. 209-219.
[38] Teece, D. J., Rumelt, R., Dosi, G., and Winter, S. "Understanding corporate coherence: Theory and evidence," Journal of Economic Behavior & Organization (23:1) 1994, pp. 1-30.
[39] Willcocks, L. P., and Lacity, M. C. "IT outsourcing in insurance services: risk, creative contracting and business advantage," Information Systems Journal (9:3) 1999, pp. 163-180.
[40] Willcocks, L. P., Lacity, M. C., and Kern, T. "Risk mitigation in IT outsourcing strategy revisited: longitudinal case research at LISA," The Journal of Strategic Information Systems (8:3) 1999, pp. 285-314.