The subject of this thesis is a detailed description of the methodics and the sets of best practices for the information processes management and informatics as such, and their comparison as far as history, content, specialization and structure are concerned. The thesis mainly concentrates on a set of the best practices called Information Technology Infrastructure Library (ITIL). Furthermore, the relations between individual methods and between ITIL V2 and V3 are described. In addition, attention is also paid to the possibilities of utilizing these methods in order to attain maximal synergetic effect. The first chapter deals with ITIL. It describes the history of the second version in particular. A separate chapter is devoted to showing the differences between v2 and v3 and mapping of the processes from the second version to the third. This chapter also provides the basic principles of ITIL v3 and a detailed description of individual publications and main processes. The next part deals with ČSN/ISO 20 000, Cobit and ITGPM. A description, advantages of its implementation and the relation to ITIL is provided for each of these documents. Furthermore, the way to obtain the ČNS/ISO 20 000 certification is also described. In the following section, ITIL, Cobit and ČSN/ISO 20 000 are compared in detail. The criteria for the comparison are: type, subject, size of the organization, sector, availability, organization certification, individuals certifications, linkage to other methods, extent, concept of the life cycle, processes description, weak and strong spots. The practical part of the thesis deals particularly with the service catalogue optimalization and creation of the SLA prototype for the IT department of radio Free Europe. The practical part is the biggest contribution of this thesis.

The aim of this work is to create a framework to classify internal controls due to the management level in which they appear, and to apply this framework to internal controls in a small organization. First, the reader is briefly introduced to the definition of control, types of control and the structure of control. Another part is a description of the established framework for the classification and subdivision of controls in terms of the levels of management. Each level of control is also clearly accompanied by the examples from the above documents. In the end, this system is applied to an organization that has almost no internal control system yet, and the framework of the controls at the individual levels is introduced.

[EN] EHealth plays an essential role in supporting healthcare in today's digital society; it is perceived as crucial for high quality and cost-effective healthcare. However, getting the expected benefits from eHealth has been difficult to demonstrate. There has been a raising interest in adopting eHealth Governance frameworks to obtain re-assurance that investments return the expected results in health care. How IT Governance is implemented within healthcare, the actual impact on strategic alignment and its influence to the information society progress, remains poorly understood. For this purpose we have explored the application of these frameworks within the National Health Service in Scotland and their impact on the following three aspects: eHealth Governance maturity, strategic alignment with healthcare and local progress of digital societies. This research is a longitudinal study (2008-2013), involving an exploratory and explanatory multi-case analysis of three representative organisations across Scotland. A combination of empiric methods has been used: semi-structured interviews with implementers, surveys (Strategic Alignment Model), cross-sectoral/national benchmarking based on a literature review and a qualitative analysis of established eHealth progress indicators. Ninety-two participants have been involved across three case studies. The outcomes of this study have been published over a period of 5 years representing a composite thesis based on relevant publications. Results sustain that EHealth Governance is in its infancy across sectors and countries. 80% of the organisations worldwide are in a transition point between a "committed" and an "established" process. Our results support that the more mature eHealth Governance is, the better the strategic alignment between eHealth and health care organisations (HCOs), hence the better progress of eHealth and the Digital Society. The Strategic alignment is slowly maturing across organisations (15% since 2008), indicating a faster development than the overall Digital Society (Scotland) progress indicators. The National eHealth Strategy shows signs of steady progress and very positive eHealth uptake in society with an overall growth of 12% since 2008, despite the deep economical recession within the period of this research. The conclusions of this study as a longitudinal analysis are limited and more research over the forthcoming years is required. For this purpose, a simplified and adapted method to monitor these trends in future HCOs research has also been provided. / [ES] La eSalud juega un papel esencial en el desarrollo de la asistencia médica en sociedades digitales; se percibe como un elemento crucial en la provisión de servicios médico-sanitarios alta calidad y costo-efectivos. A pesar de ello, hasta ahora ha sido difícil demostrar la materialización de los beneficios esperados de la eSalud, pero hay un interés creciente en la adopción de marcos de referencia basados en buenas prácticas, y estándares profesionales internacionales para la gestión y dirección de la eSalud, con el propósito de asegurar que las inversiones revierten los resultados esperados en el cuidado y servicios de la salud. Hasta ahora se sabe muy poco sobre el fenómeno de cómo la eSalud es integrada en el cuidado y servicios de la salud, y del impacto que esta tiene en la alineación estratégica de la eSalud. Igualmente, sabemos muy poco de la influencia real que estas prácticas tienen en el progreso de sociedades digitales. Este estudio se centra en explorar la aplicación de buenas practicas y estándares internacionales como marco de referencia en el gobierno de la eSalud en el servicio de salud Escocés; también contrastamos y comparamos el fenómeno con otros países y sectores. Esta investigación es un estudio longitudinal (2008-2013) que incorpora un análisis exploratorio y explicativo de casos. Se obtuvieron un total de noventa y dos participantes a lo largo de los tres casos estudiados, con representación de los principales grupos de interés (médicos y no médicos). Los resultados se han divulgado a lo largo del periodo de investigación en un compendio de publicaciones relevantes que conforman la tesis. Los principales hallazgos muestran que el gobierno de la eSalud está en su infancia en los sectores y países analizados: el 80% de las organizaciones a nivel mundial presentan este proceso en un punto de transición entre "comprometido" y "establecido" (Modelo SAM). Los resultados corroboran que cuanto más maduro es el gobierno de la eSalud, mayor alineación estratégica entre la eSalud y la organización, y mayor progreso de la variable eSalud en los indicadores de la sociedad de la información. La alineación estratégica esta madurando lentamente (15% desde 2008), sin embargo este crecimiento es mas rápido que el progreso observado en los indicadores de la sociedad digital (Escocia). La estrategia nacional Escocesa muestra signos de progreso sostenido y de integración (por uso o adopción) de las iniciativas de eSalud en la sociedad (crecimiento del 12% desde 2008), a pesar de la profunda depresión económica durante el periodo de investigación. Las conclusiones de esta investigación, como estudio longitudinal, son limitadas y requieren la captura de más datos y observaciones durante los próximos anos. Con el fin de facilitar este proceso, se ha propuesto un método simplificado y adaptado al sector salud, que permite capturar observaciones, comparar y monitorizar estas tendencias en futuras investigaciones en el sector salud. / [CAT] La eSalut juga un paper essencial en el suport a l'assistència sanitària a la societat digital de hui en dia; es percep com crucial per a l'alta qualitat i efectivitat del servicis de salut. No obstant això, ha estat difícil de demostrar la obtenció dels beneficis esperats de la eSalut. Hi ha hagut un interès en augmentar l'adopció de marcs de governança de la eSalut per obtenir re-assegurament que les inversions retornen els resultats esperats en els servicis sanitaris. Com s'implementa la governança de les TIC dins de l'assistència sanitària, l'impacte real en l'alineació estratègica i la seua influència en el progrés de la societat de la informació, continua sent poc conegut. Aquest estudi explora l'aplicació d'aquests estàndards i marcs de referència dins dels Serveis Nacionals de Salut d'Escòcia i el seu impacte en els tres aspectes següents: la maduresa de la governança de la eSalut", l'alineació estratègica amb l'assistència sanitària i, finalment, el progrés local de les societats digitals. Aquesta investigació és un estudi longitudinal (2008-2013), que implica una anàlisi multi cas exploratori i explicatiu de tres organitzacions representatives del servici nacional de salut de Escòcia. S'ha utilitzat una combinació de mètodes empírics: entrevistes semi estructurades, enquestes (Model SAM) comparatives de mercat intersectorial i internacional basat en una revisió bibliogràfica i, finalment, una anàlisi qualitativa dels indicadors de progrés eSalut. Noranta dos participants han informat a través de tres estudis de casos. Els resultats s'han divulgat al llarg del període d'investigació en un compendi de publicacions rellevants que conformen la tesi. Els resultats assenyalen que la governança de la eSalut està en la seua infància en tots els sectors i països. 80% de les organitzacions de tot el món es troben en un punt de transició entre un procés "compromès" i "establint". Els nostres resultats apunten que quan més madur es la governança de la eSalut, millor serà l'alineació estratègica entre la eSalut i les organitzacions d'atenció sanitària (HCOs), per tant el millor progrés de la sanitat electrònica a la Societat Digital. L'alineació estratègica està madurant lentament en les organitzacions (15% des de 2008); aquest desenvolupament és més ràpid que el progrés de la societat digital (Escòcia). L'estratègia Nacional de eSalut mostra signes de progrés constant i l'absorció de la eSalut en la societat es prou positiva, amb un creixement global del 12% des de l'any 2008, tot i la profunda recessió econòmica durant el període de temps d'aquesta investigació. Les conclusions d'aquest estudi com una anàlisi longitudinal són limitades i es requereix més investigació en els propers anys. / Beratarbide Sobrado, ME. (2016). Longitudinal analysis of eHealth Governance within healthcare organizations as a critical factor in the adaptation to the Information Society in Scotland [Tesis doctoral no publicada]. Universitat Politècnica de València. https://doi.org/10.4995/Thesis/10251/63456 / TESIS

This thesis deals with metrics of IT management. The main goal of the thesis is to design a web application for assessing the quality of IT service management. The resulting application will determine the aforementioned quality based on the specified criteria and values. In the first part of the thesis, there are elaborated current methodologies, which are focused on quality assessment of IT administration and management. These methodologies also include metrics to assess this quality. In the third chapter, the quality assessment process is processed using the IT Quality Index. The fourth and fifth chapter describes the design and implementation of the web application itself. Validation of application results is processed in the fifth chapter. The created application is deployed on the server and used to assess IT quality. In the last chapter of this work is described practical use of work results and possible extensions of the web application.

Användandet av IT relaterade tjänster har ökat kraftigt de senaste åren och visar inga tecken på att avstanna. Men i takt med att användningen ökar så ökar även riskerna, för vad händer egentligen när de IT-tjänster som så många företag och privatpersoner förlitar sig på plötsligt fallerar eller på annat sätt blir oåtkomliga? För att skydda sig mot sådana scenarier så blir det allt vanligare bland företag som driver IT-tjänster att använda sig incidenthantering, vars syfte är att genom fördefinierade processer återställa IT-tjänster till fungerande läge när en incident väl inträffar. För att implementera en incidenthanteringsprocess är det vanligt att verksamheter använder någon form av ramverk eller metod för att underlätta och effektivisera arbetet, i skrivande stund heter de mest använda ramverken ITIL och COBIT. Det är mycket vanligt att en incidenthanteringsprocess i en verksamhet bygger på någon form av system eller applikation vars syfte är att underlätta och effektivisera hanteringen av incidenter, ett sådant system benämns ofta som incidenthanteringssystemet. Trots att ramverk som ITIL och COBIT är använda i stor utsträckning världen över så uppstår det ett problem i att de båda saknar fokus på incidenthanteringssystemet och vad ett sådant system skall klara av. För när ramverken inte tar upp en sådan central del av incidenthanteringsprocessen så innebär det att den implementerande verksamheten själva måste lägga tid och resurser på att reda ut hur ett sådant system skall fungera. Denna studie adresserar problemet med att de vanligast använda ramverken för incidenthantering inte behandlar det, för processen, så centrala incidenthanteringssystemet genom att undersöka och besvara följande forskningsfrågor. Vilka implicita och explicita krav bör ett incidenthanteringssystem uppfylla?  Vilka krav på incidenthanteringssystemet går att utläsa från de mest använda ramverken för incidenthantering?  Hur matchar de framtagna kraven de krav som ställts av en verksamhet ur näringslivet? Denna studie riktar sig framförallt till de verksamheter eller individer som anser sig ha nytta av en sammanställning av de krav som ett incidenthanteringssystem bör uppfylla och kan fungera som ett stöd vid implementering eller inköp av ett nytt incidenthanteringssystem. Genom att identifiera kraven som ställs på ett incidenthanteringssystem utifrån de mest använda ramverken för incidenthantering så bidrar studien med resurser för implementationen av nämnt system drastiskt minskar. Samt genom att presentera ett konkret exempel, fallstudien, och jämföra det med kraven från ramverken bidrar studien med en referenspunkt för verksamheter att utgå ifrån när de implementerar eller köper ett nytt incidenthanteringssystem. / The use of IT-related services has increased massively over the past years and it shows no signs to stop. But alongside the usage increasing the risks also increases, because what will happen when the IT-services that so many rely upon suddenly cease to function, or in other ways become inaccessible? To protect against such scenarios it is increasingly more common for IT-service businesses to use incident management, whose purpose is to recover IT-services to their functional state, using predefined processes, should an event occur. It is common for IT-service businesses when implementing an incident management process to use some kind of framework or method to facilitate and streamline its work process, and as of writing this paper, the most used frameworks are ITIL and COBIT. It is very common for an IT-service business that in the incident management process develop a system or application whose purpose is to facilitate and streamline the incident management, and these are commonly referred to as Incident Management Systems. Even though ITIL and COBIT being widely used worldwide, there are some weaknesses in them, regarding Incident Management Systems, since both of the frameworks lack focus and depth of what an Incident Management System should manage. Such lack of focus and depth of a vital and central part of the Incident Management process, may prove expensive to IT-service businesses since the business needs to investigate what the system needs to manage, and how to manage it. This paper address the problem with ITIL and COBIT lack of focus and depth regarding the central part of the incident management process, the Incident Management System by investigating and reciprocate the following questions. Which implied and explicit requirements should an Incident Management System meet?  Which Incident Management System requirements can be found from the most used frameworks regarding Incident Management?  How well does the identified requirements match those requirements made by a real world company? The target audience for this paper is mainly IT-service business or individuals that considers themselves in need of a compilation of requirements that an Incident Management System should meet and can be used as a supporting tool when implementing or purchasing a new Incident Management System. By identifying requirements that an Incident Management Systems should meet from the most used framework regarding Incident Management, this paper will contribute with means for the implementation of the Incident Management System, reducing the costs for the investigation of demands of such a system. It will also present interested parties with a concrete example, the single case study, to compare with the requirements from the frameworks, contributing with a benchmark for IT-service business to start from when implementing or purchasing an Incident Management System.

Submitted by Nadir Basilio (nadirsb@uninove.br) on 2016-06-21T18:42:22Z No. of bitstreams: 1 Marcia Cristina Machado.pdf: 1557218 bytes, checksum: dc8f3badcae604c5d5af5bf370d02232 (MD5) / Made available in DSpace on 2016-06-21T18:42:22Z (GMT). No. of bitstreams: 1 Marcia Cristina Machado.pdf: 1557218 bytes, checksum: dc8f3badcae604c5d5af5bf370d02232 (MD5) Previous issue date: 2016-02-15 / This study proposes a verification of the relationship between CoBIT framework and the GRI sustainability indicators, and the identification of sustainable practices measured in technology companies that adopt CoBIT model in its management and control. In check the activities of software companies, without further analysis has perception that these are sustainable, since the production chain is electronic, distribution recently adopted is cybernetics and disposal also occurs electronically, not generating waste materials. For the study was used the methodology of study of multiple cases with the application of semi-structured interviews, analysis of documents obtained from the companies analyzed, as well as theoretical research in journals, books and CoBIT guidelines and GRI. As a result, identified a strong relationship between economic and environmental aspects proposed by the GRI indicators with the requirements of CoBIT model and a weak relationship of the social aspects of the GRI with CoBIT model. Regarding the adoption of the model CoBIT observed that companies that using the CoBIT model in its management and control, also practice and manage their sustainable actions, while promoting the dissemination of indicators through the GRI report. It was identified that even technology companies with adhere to other models of management and control, measuring their sustainable practices, do not publish their sustainability reports. The study found that organizations that do not employ models of management and control, and it does not measure its sustainable practices consequently do not publish sustainability reports. This discovery led to the development of a tool that seeks to help Brazilian software companies in the implementation of sustainable practices, and the adoption of management and control models. / Este estudo se propõe entender a relação entre o modelo CoBIT e os indicadores de sustentabilidade GRI, identificando as práticas sustentáveis mensuradas nas empresas de tecnologia que adotam o modelo CoBIT em sua gestão e controle. Ao verificar as atividades das empresas de software, sem uma análise mais aprofundada, poderá ter-se a percepção que estas são sustentáveis, uma vez que sua cadeia produtiva é eletrônica, sua distribuição recentemente adotada é a cibernética e seu descarte também ocorre eletronicamente, não gerando resíduos materiais. Para realizar o estudo foi empregado a metodologia de estudo de casos múltiplos, com a aplicação de entrevistas semiestruturadas, análise dos documentos obtidos junto às empresas analisadas, além da pesquisa teórica em periódicos, livros e nos guidelines CoBIT e GRI. Como resultado identificou-se uma forte relação dos aspectos econômicos e categorias análise e estratégia, engajamento dos stakeholders e governança propostos pelos indicadores do GRI com os requisitos do modelo CoBIT e uma fraca relação dos aspectos sociais e ambientais do GRI com o modelo CoBIT. No que tange a adoção do modelo CoBIT observou-se que as empresas que adotam este modelo em sua gestão e controle, praticam e gerenciam suas ações sustentáveis e promovem a divulgação de seus indicadores por meio do relatório GRI. Identificou-se ainda que as empresas de tecnologia que aderem a outros modelos de gestão e controle, executam e mensuram suas práticas sustentáveis, mas não realizam a publicação de relatórios de sustentabilidade. O estudo também revelou que as organizações que não empregam modelos de gestão e controle, também não mensuram suas práticas sustentáveis e por consequência não publicam relatórios de sustentabilidade. Esta descoberta propiciou como contribuição para a prática a elaboração de uma cartilha modelo que busca auxiliar as empresas de software brasileiras na implantação de práticas sustentáveis, e na adoção de modelos de gestão e controle.

The thesis focuses on the concept of information management, its history and definition by various authors and also according to Cobit 5 methodology particularly its part Cobit 5: Enabling Information. The aim of the thesis is the application of Cobit 5 information model on a specific problem with information in the selected company and assessing the suitability of this application.

Made available in DSpace on 2016-04-04T18:31:18Z (GMT). No. of bitstreams: 1 Poncinelli_Final_revisada22052007-3.pdf: 2496152 bytes, checksum: 2e7cfb0d28420c6b16ef51f9ebff00d5 (MD5) Previous issue date: 2007-04-27 / Research for the development of a process-mapping model based on control patterns to manage information technology. There is a trend for organizations to try and have their management processes under control; however, choosing, implementing and using the models which would best adapt to their reality are not easy tasks. This paper proposes the development of an information technology Management process using the systems study method named Sistemografia in order to meet the demands of the Sarbanes-Oxley law. This process is based on a model of control by objective, named Control Objectives for Information and related Technology (COBIT). All of these factors are embedded in companies that manage their technologies, especially telecommunications companies related to tele-information technology and to the multi-service nets. In short, the objectives are: to describe the elements that compose Company Management and Architecture; to describe the articles of the Sarbanes-Oxley law, relating them to the COBIT model; to describe the management model using the sistemografia method; and to propose a framework for data management and metadata for the Management of IT, associating a dashboard, and based on the maturity of the processes, so as to measure them at their present stage and plan the aimed strategic stage. / Pesquisa para desenvolvimento de um modelo para mapeamento de processos baseado em controles para a governan?a de tecnologia da informa??o. As organiza??es t?m procurado cada vez mais, ter sob controle seus processos de governan?a, por?m, escolher, adotar e utilizar modelos que melhor se adaptem ?s sua realidade n?o ? tarefa f?cil. Este trabalho prop?e o desenvolvimento de um processo de Governan?a de Tecnologia da Informa??o utilizando o m?todo de estudo de sistemas, denominado Sistemografia para atender as determina??es da Lei Sarbanes-Oxley. Tal processo est? baseado em modelo de controles por objetivos, denominado Control Objectives for Information and related Technology (COBIT). Todos esses fatores est?o intrinsecamente presentes nas empresas que fa?am gest?o de suas tecnologias, principalmente empresas de telecomunica??es que est?o relacionadas com a teleinform?tica e as redes multi-servi?o. De forma espec?fica os objetivos s?o: descrever os elementos que comp?em as Governan?a e a Arquitetura Empresariais; descrever as Se??es da Lei Sarbanes- Oxley, relacionando-as com o modelo COBIT; descrever o processo para gest?o utilizando o m?todo de sistemografia; e propor uma moldura (framework) para a gest?o dos dados e metadados para Governan?a de TI, associando um painel de controle (dashboard), baseado na maturidade dos processos, de maneira a medilos em seu estado atual e projetar o est?gio estrat?gico desejado.

Made available in DSpace on 2016-04-04T18:31:24Z (GMT). No. of bitstreams: 1 Rafael Rodrigo Martinati.pdf: 892328 bytes, checksum: bb06e7a9c52ea61c8c7545d477f6b0f3 (MD5) Previous issue date: 2009-06-19 / The objective of this paper is to analyze the development of Service Level Agreement to Voice over Internet Protocol over WIFI services in compliance with COBIT, ITIL and ISO / IEC 20.000-1:20005 and ISO 38.500 frameworks, specially using perceived quality of speech as a SLA requirement . The models MOS, PESQ and E MODEL published by the ITU for evaluation of quality of speech analyzed was identified the hypothesis that the E MODEL provide compliance with the frameworks of ICT governance. It was emulated a Voice over Internet Protocol over WIFI scenario and measured is the variation of the R FACTOR, in different encoders and compared with the changes in jitter and rate of loss packets. We can conclude that E model has characteristics that make it able to be inserted into a Service Level Agreements for Voice over Internet Protocol over WIFI service. / Este trabalho discorre sobre acordos de n?vel de servi?os, ou Service Level Agreements (SLA) para servi?os Voice over Internet Protocol (VoIP) sobre redes Wireless Local Area Network (WLAN). Foram considerados como fundamentos os frameworks Control Objectives for Information and related Technologies (CobiT), Information Technology Infrastructure Library (ITIL) e as normas ISO/IEC 38.500 e ISO/IEC 20.000-1 e constatouse que a qualidade de fala percebida deve ser um requisito de um SLA para VoIP. Foram analisados os modelos de avalia??o de qualidade de fala Mean Opinion Score (MOS), Perceptual Evaluation of Speech Quality (PESQ) e Modelo E, publicados pela International Telecommunications Union (ITU) onde foi identificada a hip?tese de que o Modelo E esteja em conformidade com os frameworks de governan?a de Tecnologia da Informa??o e Comunica??o (TIC), por fornecer um indicador, o fator R, que pode ser considerado como um indicador de SLA. Para comprova??o desta hip?tese, foram analisados dados, obtidos em uma emula??o de um ambiente real de redes WLAN para medi??o da varia??o do fator R, utilizando-se de dispositivos codificadores (CODEC) e cen?rios diferentes. Constatou-se que o fator R apresentou a mesma tend?ncia de qualidade de fala nos diferentes dispositivos CODEC. Foram ent?o comparadas as varia??es de jitter e taxa de perda de pacotes nos mesmos cen?rios e codificadores para analisar se a varia??o destas m?tricas possui relacionamento com as medidas do fator R. Identificou-se ent?o que o fator R apresenta caracter?sticas que permitem que ele seja inserido em um SLA de um servi?o VoIP, viabilizando assim a requisitos de governan?a e gest?o de servi?os de TIC.

Submitted by Nara Lays Domingues Viana Oliveira (naradv) on 2015-06-18T18:35:02Z No. of bitstreams: 1 josemaximo.pdf: 1274434 bytes, checksum: 0e93483599c366fda03ccb17a754776b (MD5) / Made available in DSpace on 2015-06-18T18:35:02Z (GMT). No. of bitstreams: 1 josemaximo.pdf: 1274434 bytes, checksum: 0e93483599c366fda03ccb17a754776b (MD5) Previous issue date: 2013-04-25 / SESCOOP/RS - Serviço Nacional de Aprendizagem do Cooperativismo do Estado do Rio Grande do Sul / A adoção de boas práticas de governança corporativa tem beneficiado organizações públicas e privadas. Nesse sentido as entidades paraestatais, modelo jurídico objeto desta pesquisa, são instigadas a seguir as boas práticas de gestão e a adotar estruturas de governança para estabelecer, avaliar e monitorar a eficácia dos controles internos. Assim, cumprem com a conformidade exigida quanto aos aspectos da prestação de contas e da transparência. O objetivo desta pesquisa foi avaliar a contribuição dos processos de controles internos e de TI na governança corporativa, especificamente no aspecto relacionado à conformidade. Trata-se de um estudo descritivo, com abordagem qualitativa, realizado sob a forma de estudo de caso, incluindo 13 entrevistas. Foi criado um novo framework teórico alinhado à conformidade em que a fundamentação de COBIT e COSO foi aplicada em ambiente de entidade sem fins lucrativos com atividade voltada ao serviço social. Os principais achados evidenciam que os processos encontram-se num nível de limitada maturidade e os controles internos são mantidos diante das constantes auditorias. A falta de processos, sistemas e controles padronizados e sistematizados foi destacada como um fato determinante para a manutenção da conformidade. E, embora a conformidade tenha ligação direta com o cumprimento de normas internas e externas, há a necessidade de se instituir um sistema de integridade corporativa. / The adoption of good practices in corporate governance has benefited public and private organizations. Accordingly, parastatal entities, the legal form which is the object of this research, are urged to follow good management practices and adopt governance structures to establish, monitor and evaluate the effectiveness of internal controls. Therefore they comply with the required compliance in the matters of accountability and transparency. The objective of this research was to evaluate the contribution of the internal controls and IT in corporate governance, specifically in the aspect related to compliance. A new theoretical framework was created which's aligned to the compliance wherein the fundamentation of COBIT and COSO was applied in an environment in which the entities does not aim profit and is geared to the social service. The main findings show the processes are in a limited level of maturity and the internal controls are maintained in the face of constant audits. The lack of processes, systems and controls standardized and systematized was highlighted as a determining factor for maintaining compliance. Although compliance has a direct connection with the implementation of internal and external standards, there is a need to establish a system of corporate integrity.