A gestão de riscos no planejamento de auditoria interna e no monitoramento das recomendações de auditoria em uma instituição federal de ensino superior

Abstract

This dissertation comprises two technological papers and deals with risk management in internal audit planning and monitoring of audit recommendations in a federal institution of higher education. To this end, two overall objectives were drawn: 1) to describe the risk management methodology adopted by Auditoria Geral da Universidade Federal de Uberlândia (AUDIT/UFU, the audit committee of the Federal University of Uberlândia) concerning the planning of internal audit, namely the set of criteria for prioritizing audit actions listed in the Planos Anuais de Auditoria Interna (PAINTs, Annual Internal Audit Plans) 2017 and 2018; to point out possible inconsistencies in the method; to map the process and to propose improvements to the current methodology; and 2) to describe the process of internal control and monitoring of audit recommendations and to suggest functional requirements that should be part of the Sistema Informatizado de Monitoramento de Recomendações (Computerized Recommendation Monitoring System), to be developed for the use of AUDIT/UFU. In the first chapter, the 2017 and 2018 PAINTs of UFU were analyzed, in order to describe, analyze and map the risk-based methodology elaborated by AUDIT/UFU for selecting the work actions that were set forth in those documents. This is a case study with applied nature, qualitative approach and descriptive characteristic. The technological contribution of this research developed in the second chapter resulted in the mapping of the process of prioritization/selection of audit actions and the proposition of improvements to the methodology elaborated and currently adopted by AUDIT/UFU. In the second chapter, based on the relevance of carrying out an effective monitoring of the implementation of the Audit recommendations, this investigation aimed at identifying which functional requirements should comprise a software of monitoring, so that it can adequately contribute to the management process of audit recommendations. In chapter three, the qualitative, descriptive study is supported by the need to adapt the monitoring process to the determinations of the Ministério da Transparência e Controladoria-Geral da União (Ministry of Transparency and the Comptroller General of the Union) and the Tribunal de Contas da União (Court of Cons of the Union), as well as by the benefits that could come from the use of a computerized system specific to the monitoring of this management process, namely: mitigation of the risk of failure, by the audited areas, to comply with the recommendations, rapid exchange of information, record of the history of monitoring, issue of managerial reports, among others. The technological contribution comprises a document on functional requirements to be delivered to the Centro de Tecnologia da Informação (UFU’s Information Technology Center), the area responsible for the development of UFU electronic systems.