企業實施有效的內部控制制度，可以協助企業在營業的過程中遵行法令之規定，產出可靠的財務資訊，提昇營運的效率及確保營運效果的達成。近年來由於爆發企業內部舞弊案，而使得各公司開始重視企業內部控制管理的制度，內部控制之目的將傳統的內部控制轉變成整合性之企業風險管理，說明內部控制是一個過程，應用於企業內之策略設定，同時用以辨認影響企業之潛在事件，以提供完成企業目標之合理保證。本研究乃藉由德爾菲法(Delphi Method)萃取企業內部控制之構面，進而建構企業內部控制評鑑指標之層級架構，另亦運用層級程序分析法(Analytic Hierarchy Process; AHP)探討指標間相對重要程度分析，冀望作為企業推動內部控制時參考之依據。結果顯示本研究企業內部控制制度之關鍵因素其構面為控制環境、風險評估、控制作業、資訊與溝通及監督五大構面而以控制環境最重要，其十大關鍵因素分別為誠正與品德價值觀、管理哲學與經營風格、授權與權責之劃分任務、組織結構、設置測試環境、權責與責任、控制作業之架構、建立系統安全措施、稽核人員之超然獨立及制定資訊系統控制程序。

Implementation of an effective internal control system at an enterprise can help it follow laws and regulations during operations, generate reliable financial information, and achieve operations efficiency and effectiveness. Internal frauds of enterprises in recent years have made corporations started to value their enterprise internal control and management systems. Traditional internal control has been turned into integrated enterprise risk management. This explains that internal control is a process applied to plan enterprise internal strategies; meanwhile, it is used to identify potential incidents influential to the enterprise so that reasonable assurance is provided to achieve corporate objectives. The study extracted dimensions of enterprise internal control with the Delphi method to further construct a hierarchical structure of enterprise internal control evaluation indicators. The Analytic Hierarchy Process (AHP) was used to explore the important levels of those indicators, which was expected to serve as a reference to enterprises for internal control planning. The results of the study suggested that “control environment” was the most important among the five dimensions of the internal control system, i.e. control environment, risk assessment, control activities, information and communication, and monitoring. Additionally, the top ten critical factors were: integrity and ethical values, management philosophy and operating style, assignment of authority and responsibility, organizational structure, establishment of the testing environment, responsibility and liability, structure of control activities, establishment of system security measures, detachment and independence of auditors, and formulation of the information system’s control procedures.