O Futuro da Auditoria Interna - Gardener of Governance

O futuro da auditoria interna neste novo contexto corporativo é um tema recorrente nos encontros e grupos de auditores.

Em minhas pesquisas para consolidar minha visão sobre o tema, me deparei com um artigo, onde os autores utilizam o jardineiro como uma metáfora para tratar dos atributos que a auditoria interna deverá perseguir para se manter relevante nesta nova dinâmica de negócios.

Em um encontro com os autores, para compreender um pouco melhor o ponto de vista deles, resolvemos traduzir o artigo para compartilhar com os profissionais dos países de língua portuguesa. Vocês podem baixar o artigo pelo link abaixo.

Boa leitura e ótima reflexões.

https://marketing.egoi.page/1eue1IL0/signup

Let's make enterprise risk management simple!

 

Today I want to bring to our reflection a fundamental theme for the consolidation of corporate governance.

Let's talk about enterprise risk management.

I was preparing the course, and I came across a slide that I use to explain, the structure applied to risk management, and I felt motivated to bring this topic to our discussion.

Anyone who follows me on social media knows that I always try to bring a simple view to important topics related to management and governance, facilitating understanding and their application in corporate activities.

Simplicity is currently a competitive advantage for the organization, but understand that being simple does not mean being superficial.

Well, let's get back to our topic, which is risk management.

In a simple way, I can say that:

“Managing risks is a proactive activity, looking to the future, understanding the events, external and/or internal, that may materialize and adversely impact the company's or process's ability to achieve its objectives; evaluates them for their magnitude, and treats them based on the acceptable levels of risk defined by the corporation.”

The primary objective of risk management is to allow the corporation, in the pursuit of fulfilling its mission, to conduct, direct and maintain its activities, actions and decisions, within its acceptable level of risk, defined by risk appetite.

The starting point for risk management is the correct understanding of objectives, whether strategic, corporate and/or operational. If we do not know the objectives clearly, it is difficult to know the risks in a comprehensive way.

Not using objectives as a basis for identifying risks is the most common mistake I find in corporations, causing time and resources to be spent in a wrong and ineffective way.

Remember that the risk event directly impacts the ability to achieve the objectives.

Regarding the operational objectives, those that relate to the various existing processes for the operationalization of the organization's activities, I recommend the definition of the objectives inherent to each of the processes, as well as the objectives related to legal compliance, objectives related to moral values of the organization, and objectives related to the consistency, integrity, confidentiality and recoverability of the processed data.

The better the definition of objectives, the more effective the identification of risks tends to be.

Well, since we have already determined the objectives, we now begin the process of identifying the events, external and/or internal, that may impact the corporation.

Then, in a simple way, we begin to identify the risks that, if materialized, will adversely impact the organization's ability to achieve its objectives. We can see risk as the negative view of the objective, for example: If one of the inherent objectives of a purchase process is to buy only products and/or services necessary for the operation of the corporation, the risk may be the purchase of products and/or or services not necessary for the operation.

Based on the understanding of the objectives, try to identify all risk events that relate to it. This is a brainstorming activity. There is no Cartesian way of doing this.

Once all the perceived risks are related, the next step is to know their causes, that is, the events that could materialize the risk.

It is the risk factors (causes) that we assess the magnitude of and that we treat, so it is important to be judicious in identifying them.

To illustrate, let's go back to the example of the purchasing process, why can the corporation buy products and/or services not necessary for the operation? The answers to this question will allow us to identify the risk factors. Example: a. A wrong purchase requisition, b. Lack of inventory planning, c. A fraud.

This procedure must be performed for all identified risks, without exception.

Very well, at this point, our risk matrix already has three basic columns: Column of objectives, column of risks related to each of the objectives and column of risk factors related to each of the identified risks.

The next step is the analysis and assessment of risk factors through the matrix reading of probability (frequency) and impact (in several dimensions, such as financial, image, market-share and others).

At this point, it is important that the corporation has metrics, approved by senior management, to assess the magnitude (probability and impact) of risk factors.

It is also important that the company already has a risk appetite defined by top management. As a suggestion, to facilitate the risk management process, guide senior management to define the risk appetite based on the heat map resulting from the metrics, indicating the quadrant that should be considered as the accepted level risk.

I like to use metrics with five levels of probability and five levels of impact, so that the heat map has quadrants from 01 to 25. In this case, risk appetite can be defined as being one of the existing quadrants, for example the high management can direct your risk appetite to quadrant six, so anything above will need to be addressed.

One of the problems that I come across, in this evaluation stage, is in relation to the use of complex metrics, with the inclusion of weights, weighted average and other calculations that only bring complexity and delay to the process.

Note that, more important than the accuracy of the risk factor measurement, is the action that management takes to address it. It doesn't matter if the risk is 15,234 or 15, what really matters is the action that management takes to mitigate the risk factor.

The calculation is simple: probability x impact = gross risk

Another important point at this stage of the evaluation is the definition of impact, that is, if the event materializes, what impact will it bring to the organization. Some corporations seek to assess impact through a weighted average across the various dimensions. The suggestion is to work with the dimension that receives the primary impact, and not with a weighted average of the impact in the different dimensions, because, note that this is not how it happens in reality. Example: if the event materializes and impacts the image, it will not necessarily impact, simultaneously, the other dimensions measured, so it is best to focus on treating the effect on the image, ensuring that it does not affect secondarily the other dimensions.

Okay, now that we know the magnitude (gross risk) for all risk factors, whether inherent, compliance, fraud, or IT, the next step is to compare the magnitude obtained with the risk appetite, and based on in this, determine the best treatment to align the raw risk with the risk appetite determined by the organization.

Keep in mind that the primary objective of risk management is to enable the corporation to act within its acceptable level of risk, formalized through the definition of risk appetite.

Risk factor treatment can be: Accept, Share, Avoid and Mitigate.

We can accept the risk, when the gross risk is already aligned or below the risk appetite, however accepting the risk does not mean doing nothing, but monitoring the risk factors, because today it is low, tomorrow it may change and with this change our treatment.

Another important point is in relation to who can accept the risk, and my suggestion is that it need to be accepted by the statutory managers, since legally they are the ones who take the risk for the company, including their private assets.

Sharing risk is a process where another corporation, be it a financial institution or an insurance company, accepts to take part of the risk for the company. Example: Insurance policies, or foreign exchange hedge. Note that this is an answer on impact and not probability.

Another form of treatment for risk factors is risk avoidance. It is one of the most difficult answers to work with, because in order to avoid risks, the organization can no longer be exposed to risk, which means, in most cases, strategic decision-making, such as the company's exit from a market, or closing a unit, or not carrying out an operation, etc.

Finally, we have the possibility of mitigating the risk factor, which operationally speaking, requires the implementation of an internal control to mitigate the probability of the risk event materializing.

Just remembering that internal controls are:

“Actions, formalized in policies and procedures, aimed at mitigating the probability of materialization of the risk event. These are actions of review, checking, certification, validation, authorization, approval, etc.”

Depending on the materiality and nature of the risk, in addition to the probability response, it will be necessary to prepare a contingency plan, which aims to minimize the effect of the impact, when the risk event materializes.

Once the responses have been determined and implemented, the next step is to calculate the residual risk, which is the effect remaining after the treatment action, and make sure it aligns with the risk appetite defined by the corporation.

Remember that simplicity is currently a competitive advantage! Bring simplicity to operation, not superficiality!

Be happy!

A structured view of the attributes and nature of Internal Controls.

In the literature on internal controls, there is no standardization for the attributes and classification of internal control. Each professional institution and/or each author ends up using their understanding of the categorization of control, which does not necessarily follow the same pattern.

This lack of standardization generates some misunderstandings, which negatively impacts the understanding of the first line of management about this important instrument for the mitigation of risk factors.

This article aims to bring to our reflection a more structured view of the topic of internal controls, and who knows how to start a conceptual standardization.

So, we can start this journey, reviewing the definition of internal control, based on the COSO ICF.

It says that:

"Internal control is an event or action, formalized in policies and procedures, which aims to mitigate the probability of the risk event materializing and adversely impacting the process's ability to achieve its objectives."

Looking at this definition, two points become clear:

•         The existence of an internal control is closely related to its alignment in mitigating one or more risk factors, and
•      That it is only effective when there is a condition of probability management. It is neither adequate nor effective for impact mitigation.

Now let's understand the difference between a control and a task. I still find a lot of confusion in the understanding of these concepts in organizations. It is very important, for the quality of risk and process management, to know how to clearly identify the control, differentiating it from a task, especially when we are modeling or mapping an operational process.

Let's look at the concept of tasks:

•           Task – By concept, a task is an activity that must be performed to help the operational process achieve its objectives and deliverables. It can be a registration, calculation, listing, filing, elaboration, filling and others,

Now, let's look at the control:

•          Control – It is an action that aims to mitigate the materialization of a risk event that will adversely impact the performance of a task, data and/or information processing, or the quality of the product object of the process. It can be a review, conference, recalculation, approval, validation, authorization and others.

In theory, the control activity is the action that confirms that the task or processing was performed in accordance with the pre-established procedures.

Any nonconformity in the performed task is promptly identified by the control, thus requesting that the task be reworked. Not allowing this non-compliance to contaminate the process and impact the quality of the product of the process.

This dynamic of “Doing” and “Reviewing”, during the processing of activities, increases the ability of the process to achieve its objectives and deliver products with the required quality.

Continuing on our journey, we now need to know the attributes of internal control. These attributes are important for us to model or evaluate an internal control, mainly in the evaluation of the design (efficiency) of the control.

Objectively, the basic attributes of control are: objective, action, evidence and periodicity.

Let's look at these attributes in a little more detail:

Attribute I - Objective: It relates to the risk factor that it mitigates, it is possible to say that it is the positive view of the risk factor, for example:

o Risk Factor: wrong registration of the invoice information in the system.

o Control Objective: Ensure the consistency of the invoice registration in the electronic system.

Attribute II - Action: it is the control execution activity, it can be a review, a check, a recalculation, an approval and so on. Taking into account the example in item I, we can exemplify the action:

o Control action: Checking the data recorded in the system against the invoice.

Attribute III - Evidence: it is the “mark” that demonstrates that the control has been executed, which can be a stamp, a check, a tick, a check box in the system, a log, an e-mail and others. Considering the example above, we can say that the evidence is:

o Evidence: Checked mark, in a check box on the system screen where the invoice is registered.

Attribute IV - Periodicity: It refers to when the control needs to be executed, which can be daily, weekly, monthly, by event and others.

o Frequency: The verification of the invoice registration in the system must happen at each registration event.

Note that these attributes provide us with a more detailed view of the control, which for professionals specializing in internal controls and/or internal auditors, is essential so that they can model, evaluate the efficiency and/or effectiveness of the control.

Now, to complement this understanding, it is also important to define the types of control, based on and performance characteristics. We can classify the control in: manual, electronic and automatic.

•           Manual control is the one that only needs the individual to be executed,
•          While electronic control needs the individual interacting with the electronic system
•          And automatic control, it ony needs the system to run.

Before electronic systems, controls were manually done. With the application of electronic systems in corporate processes, controls migrated to electronic controls. Now, with the convergence of automation and digitization of operational processes, we are experiencing the second wave of controls, also converging towards automated controls, based mainly on algorithms.

Now, to complement our study of internal controls, we need to work on understanding the nature of control.

The view that we bring about the nature of control is based on a process view, which has the beginning access, the processing and at the end the delivery of its products.

Considering this, we define the nature according to the essence of control, which can be: preventive, detective and corrective.

Let’s take a look at the concept and definition of each one:

•           Preventive controls are those located before the start of the process. They aim to prevent access by people without a profile or authorization, incomplete or wrong documents, unauthorized data or information, etc,
•       Detective controls are controls in place during the processing of process activities, after the beginning of the process until the end of the process. The purpose of these controls is to mitigate the probability of the task being performed outside the schedule and/or of information or data being processed without consistency and/or integrity. They detect, and request correction, before moving on to the next task. 
•      Corrective controls, on the other hand, are controls performed on the product originating from the process, which aim to request the correction of the product of the process, if any anomaly or problems of quality, integrity and/or consistency of the product are identified. of the process.

Remember that the effectiveness of internal control is related to its ability to bring the risk factor to an acceptable level of risk, which must be aligned with the risk appetite defined by the corporation.

Now we have a more structured view of the attributes and nature of internal controls, however, it is important to point out that these controls must be part of a systemic and integrated set applied to the operational process, which we call system and internal control, but this will be topic for another article

I hope this article will help you to delve deeper into the study of internal control and thereby consolidate your understanding of the subject, but at the end of the day, what matters is that you,

Be happy!

Uma visão estruturada sobre os atributos e natureza dos Controles Internos.

 Não existe, na bibliografia sobre controles internos, uma padronização para os atributos e classificação do controle interno. Cada instituição profissional e/ou cada autor, acabam utilizando o seu entendimento sobre a categorização do controle, os quais, não necessariamente seguem o mesmo padrão.

Esta falta de padronização gera alguns entendimentos equivocados, o que impacta negativamente o entendimento da primeira linha de gestão sobre este importante instrumento para a mitigação dos fatores de riscos.

Este artigo, tem como objetivo, trazer para nossa reflexão, uma visão mais estruturada para o tema controles internos, e quem sabe iniciar uma padronização conceitual.

Para que possamos iniciar esta jornada, vamos, primeiro, com base no COSO ICF, relembrar o conceito de controle interno.

Ele diz que:

“Controle interno é um evento ou ação, formalizada em políticas e procedimentos, a qual tem como objetivo a mitigação da probabilidade do evento de riscos se materializar e impactar adversamente a capacidade do processo em alcançar seus objetivos.”

Analisando esta definição, dois pontos ficam claros:

·         A existência de um controle interno está intimamente relacionada com seu alinhamento na mitigação de um ou mais fatores de riscos,

·         E que ele somente é efetivo quando existe condição da gestão da probabilidade. Ele não é adequado e nem efetivo para a mitigação do impacto.

Agora vamos entender a diferença entre o controle e uma tarefa. Ainda encontro muita confusão no entendimento destes conceitos nas organizações. É muito importante, para a qualidade do gerenciamento de riscos e dos processos, saber identificar de forma clara o controle, diferenciando-o de uma tarefa, principalmente quando estamos modelando ou mapeando um processo operacional.

Vejamos o conceito de tarefas:

·         Tarefa – Por conceito, uma tarefa é uma atividade que deve ser realizada para auxiliar o processo operacional alcançar seus objetivos e entregas. Pode ser uma emissão, registro, cálculo, listagem, arquivamento, elaboração, preenchimento e outros,

Agora, vejamos o controle:

·         Controle – É uma ação que visa mitigar a materialização de um evento de risco que impactará adversamente a realização de uma tarefa, processamento de dados e/ou informações, ou na qualidade do produto objeto do processo. Pode ser uma revisão, conferência, recálculo, aprovação, validação, autorização e outros.

Em tese, a atividade de controle é a ação que confirma que a tarefa ou processamento foi realizada em conformidade com os procedimentos pré-estabelecido.

Qualquer não conformidade na tarefa executada é prontamente identificada pelo controle, solicitando assim, que a tarefa seja retrabalhada. Não permitindo que esta não conformidade contamine o processo e impacte na qualidade do produto do processo.

Esta dinâmica de “Fazer” e “Revisar”, durante o processamento das atividades, aumenta a capacidade do processo em alcançar seus objetivos e entregar produtos com a qualidade requerida.

Prosseguindo em nossa caminhada, precisamos agora, conhecer os atributos do controle interno. Estes atributos são importantes para que possamos modelar ou avaliar um controle interno, principalmente na avaliação do desenho (eficiência) do controle.

De forma objetiva, os atributos básicos do controle são: objetivo, ação, evidência e periodicidade.

Vejamos estes atributos com um pouco mais de detalhe:

·         Atributo I - Objetivo: Se relaciona com o fator de risco que mitiga, é possível dizer que ele é a visão positiva do fator de risco, exemplo:

o   Fator de Risco: registro errado, no sistema, das informações da nota fiscal.

o   Objetivo do Controle: Assegurar a consistência do registro da nota fiscal no sistema eletrônico. 

·         Atributo II - Ação: é a atividade de execução do controle, pode ser uma revisão, uma conferência, um recálculo, uma aprovação e etc. Levando em conta o exemplo no item I, podemos exemplificar a ação:

o   Ação do controle: Conferência dos dados registrados no sistema em comparação com a nota fiscal. 

·         Atributo III - Evidência: é a “marca” que demonstra que o controle foi executado, podendo ser um carimbo, um visto, um tick, um check box no sistema, um log, um e-mail e outros. Considerando o exemplo acima, podemos dizer que a evidência é:

o   Evidência: Marca de conferido, em um check box na tela do sistema onde acontece o registro da nota fiscal.

·         Atributo IV - Periodicidade: Refere-se quando o controle precisa ser executado, o qual pode ser diário, semanal, mensal, por evento e outros.

o   Periodicidade: A conferência do registro da nota fiscal no sistema deve acontecer a cada evento de registro.

Observe que estes atributos nos proporciona uma visão mais detalhada do controle, o que para os profissionais especialistas em controles internos e/ou os auditores internos, é essencial para que possam modelar, avaliar a eficiência e/ou eficácia do controle.

Agora, para a complementarmos este entendimento, é importante também definirmos os tipos de controle, tomando como base as características de execução. Podemos classificar o controle em: manual, eletrônico e automático.

·         O controle manual é aquele que precisa apenas do indivíduo para ser executado,

·         Enquanto que o controle eletrônico precisa do indivíduo interagindo com o sistema eletrônico,

·         E o controle automático, precisa apenas do sistema para ser executado.

Antes dos sistemas eletrônicos, os controles eram manuais. Com a aplicação dos sistemas eletrônicos nos processos corporativos, os controles migraram para controles eletrônicos. Agora, com a convergência da automação e digitalização dos processos operacionais, estamos vivenciando a segunda onda dos controles, também convergindo para controles automatizados, baseados principalmente em algoritmos.

Para complementar nosso estudo sobre controles internos, precisamos trabalhar o entendimento sobre a natureza do controle.

A visão que trazemos sobre a natureza do controle é baseada em uma visão de processo, o qual tem o início, o processamento e no final a entrega de seus produtos.

Considerando isto, definimos a natureza conforme a essência do controle, podendo ser: preventivos, detectivos e corretivos.

Vejamos o conceito e a definição de cada uma delas:

·         Os controles preventivos são aqueles localizados antes do inicio do processo. Eles têm como objetivo prevenir o acesso de pessoas sem perfil ou autorização, documentos incompletos ou errados, dados ou informações não autorizadas e etc.

·         Os controles detectivos são os controles existentes durante o processamento das atividades do processo, após do início até o final do processo. O objetivo destes controles é mitigar a probabilidade de a tarefa ser executada fora do previsto e/ou das informações ou dados serem processados sem consistência e/ou integridade. Eles detectam, e solicitam a correção, antes de passar para a próxima tarefa.

·         Já os controles corretivos, são os controles executados sob o produto oriundo do processo, os quais tem o objetivo de solicitar a correção do produto do processo, se for identificado alguma anomalia ou problemas de qualidade, de integridade e/ ou de consistência do produto do processo.

Lembre-se que a efetividade do controle interno está relacionada com sua capacidade de trazer o fator de risco para um nível aceitável de risco, o qual deve estar alinhado ao apetite a risco definido pela corporação.

Agora já temos uma visão mais estruturada sobre os atributos e natureza dos controles internos, entretanto, é importante salientar que estes controles devem fazer parte de um conjunto sistêmico e integrado aplicado no processo operacional, o qual chamamos de sistema e controle interno, mas isto será tema para um outro artigo

Espero que este artigo o ajude a se aprofundar no estudo sobre controle interno e com isto consolidar sua compreensão sobre o tema, mas no final de tudo, o que importa é que você,

Seja Feliz!