Study On IT Risk Management Practice Of Commercial Bank A

Commercial bank A was established in June2001, which was formed by the merge of10city credit cooperatives of A city. After years of development, commercial bank A owns46branches across3prefectures, more than1000employees, and assets around50billion Yuan.IT construction of commercial bank A started in2001, and the A bank’s IT department, with23staff, was responsible for the IT construction and implementation. IT management of A bank is not centralized or decentralized. The IT department is in charge of the major IT construction projects, while business department or branches can choose their own applications of small size or single function.After years of investment, commercial bank A has established IT system that can basically meet its business and management demands. Although the core managers do not think that IT is one of the most important strategic asset of the bank, the general management layer agrees that IT is a necessary tool to achieve the strategic goals of the bank. Hence, the significance of IT construction has been fully realized, but the lack of IT risk management will have a negative impact on business development of the bank.This paper gives a systematic introduction and summary of A bank’s experience on IT risk management, which provides references for other similar commercial banks in constructing risk management system. On the other hand, it also offer case study to colleges and universities for their researches on IT risk management.According to the related theories, documents and regulations, this paper applies the research method of interview and observation. Based on the IT practices of A bank and international IT management experience, this paper aims at establishing a practical and systematic operation mode to meet the demand of A bank’s IT risk management This paper is divided into six parts as follows:The first chapter is the introduction of the research background, research problems and methods.The second chapter introduces the concepts of risk, risk management, as well as the IT risk management of commercial banks. Based on the concepts clarified above and risk management theories, this paper gives a detailed explanation on IT risk management goals of A bank, and also introduces the best IT risk management method that is ISO20000.The third chapter elaborates on the IT risk identification and assessment methods, as well as the IT risk management system of commercial bank AThe fourth chapter analyzes the A bank’s IT risk management construction, including organization design, system construction and technological support.Based on the A bank’s working experience in applying risk management theory, the fifth chapter emphasizes the significance of technological support in IT risk management practices. And this part also gives a detailed record of theories and research methods discussed above.The sixth chapter is the conclusion of this paper.The conclusions of this paper are listed as follows:IT risk management of commercial banks must be in accordance with the risk management theories. And banks can establish the effective IT risk management system by learning from ISO20000, the best IT service management method.The lack of risk awareness of employees and various technological tools may lead to the malfunction of IT risk management system of commercial banks.IT risk management of A bank can benefit a lot from the technological improvement, conceptual innovations, and application of new technologies.IT risk in activities of commercial banks can not be avoided. As a result, to combat IT risks effectively, commercial banks should establish a comprehensive IT risk management system covering all IT activities and promote the risk awareness of all employees.