A aderência do controle externo de tecnologia da informação às normas internacionais de auditoria: o caso do Tribunal de Contas do Estado do Ceará

Abstract

With the expansion of the use of information technology by the public sector, it is notorious and growing the need to control the use of public resources invested in information technology. In order to help improve the external control performed by Supreme Audit Institutions, international organizations such as INTOSAI have developed international auditing standards with the objective of establishing technical and behavioral standards. With the adoption of these best practices, a Court of Auditors can achieve a qualification in the conduct of the work and the auditor's assurance of sufficient and technically consistent performance and opinion (TCU, 2017). The ISSAI 5300 standard, developed by INTOSAI, aims to be a global reference on the fundamentals of IT auditing. In this sense, the present work aimed to map the scenario of information technology control in the State Audit Courts of Brazil regarding adherence to international auditing standards. In order for this objective to be achieved, it was necessary to identify the structural and human resources characteristics, as well as the requirements of the norm with greater positive prominence and greater negative prominence in the units of information technology control in the State Audit Courts of Brazil, in addition to the requirements with greater positive discrepancy and greater negative discrepancy, and of the best practices carried out and of the obstacles faced by the Court of Audit of the State of Ceará for the implementation of the requirements of the INTOSAI ISSAI 5300 standard. This is a mixed method research, that is, quantitative and qualitative. For the quantitative research, a structured questionnaire was used and for the qualitative research, semi-structured interviews were conducted, both instruments developed based on the requirements of ISSAI 5300. The research universe was composed of managers and auditors of the Brazilian State Courts of Accounts. For the analysis of the results, was performed descriptive statistics and content analysis based on Bardin (2011). The results of the research indicated that only 8 (30.77%) State Audit Courts in Brazil have a structured sector for IT audit. The most prominent requirement was “Scope of IT Audit” and with negative emphasis was “IT Audit Annual Planning”. The requirement with the greatest positive discrepancy was “Selecting appropriate sample for IT audit” and with greater negative discrepancy “Materiality”. The most relevant best practice identified was “Use of pre-formatted matrices for the audit phases”, and the most relevant obstacle was “Little previously available information about the audited entity or object”.