Submitted by Fabio Sobreira Campos da Costa (fabio.sobreira@ufpe.br) on 2017-07-28T14:17:30Z No. of bitstreams: 2 license_rdf: 811 bytes, checksum: e39d27027a6cc9cb039ad269a5db8e34 (MD5) Dissertação _2016_ - Cosmo Alves (versão final).pdf: 1791510 bytes, checksum: 88b79efb065d2308e81db5208508b5bf (MD5) / Made available in DSpace on 2017-07-28T14:17:30Z (GMT). No. of bitstreams: 2 license_rdf: 811 bytes, checksum: e39d27027a6cc9cb039ad269a5db8e34 (MD5) Dissertação _2016_ - Cosmo Alves (versão final).pdf: 1791510 bytes, checksum: 88b79efb065d2308e81db5208508b5bf (MD5) Previous issue date: 2016-02-29 / Controle interno é um processo integrado efetuado pela direção e corpo de funcionários, e é estruturado para enfrentar os riscos e fornecer razoável segurança de que, para a consecução da missão da entidade, os seguintes objetivos gerais serão alcançados: execução ordenada, ética, econômica, eficiente e eficaz das operações; cumprimento das obrigações de accountability; cumprimento das leis e regulamentos aplicáveis; e salvaguarda dos recursos para evitar perdas, mau uso e dano. Como o estabelecido pela AS/NZS 4360 – Standards Australia e Standards New Zealand; o do COSO – Committee of Sponsoring Organizations of The Treadway Commission; o CoCo – Criteria of Control Committee of Canadian Institute of Chartered Accountants e o Turnbull Report. Dentre as metodologias existentes, o framework COSO é um dos mais recomendados por vários estudiosos. Historicamente, estes modelos foram emitidos para as entidades privadas, contudo, recentemente, diversas pesquisas tem se voltado para a análise da aplicabilidade na administração pública. Com vistas à melhoria dos processos de planejamento, gestão e controle, o Tribunal de Contas da União (TCU) vem avaliando os órgãos públicos com base nas premissas e orientações do COSO, sendo um destes trabalhos o Acórdão nº 1.074/2009 que proferiu diversas determinações às instituições integrantes do Poder Judiciário. Com fulcro nesta decisão, os Tribunais, por meio de suas Unidades de Auditoria Interna, passaram a adotar medidas necessárias ao cumprimento do citado Acórdão. Por esta razão, tornou-se imprescindível avaliar se o sistema de controles internos do Tribunal Regional Eleitoral da Paraíba encontra-se adequado aos pilares mestres do framework COSO, o qual foi fundamento para as determinações do TCU. Para orientar a referida avaliação, foi lançado como objetivo geral: verificar o grau de adequabilidade à metodologia COSO ERM do sistema de controles internos do Tribunal Regional Eleitoral da Paraíba. Para tanto, realizou-se uma pesquisa survey com todos os 340 servidores, dos quais 195 responderam. As respostas foram convertidas e examinadas utilizando-se o coeficiente de Jaccard, o qual calcula o grau de semelhança e dessemelhança entre o Modelo referencial COSO e o sistema de controles internos do Tribunal, captado pelo questionário. Os resultados demonstraram baixo nível de adequabilidade para todos os componentes (Ambiente de Controle (15,78%), Definição de Objetivos (14%), Identificação de Eventos (0%), Avaliação de Riscos (8,3%), Resposta aos Riscos (0%), Procedimentos de Controle (7,6%), Informação e Comunicação (18,18%) e (0%) para o Monitoramento) e para todo o sistema (10,55%), o que demonstra, na perspectiva do COSO ERM, fragilidade de controles e da gestão riscos corporativos. / Internal control is an integrated process carried out by the management and personnel, and is structured to address the risks and provide reasonable assurance that, to achieve the organization's mission, the following general objectives will be achieved: orderly execution, ethical, economic, efficient and effective operations; fulfillment of accountability obligations; compliance with applicable laws and regulations; and safeguarding of resources to prevent loss, misuse and damage. For better inter-relate these objectives, various international bodies have issued documents defining theoretical and practical framework for implementation, which are referred to in the literature as models of internal controls, as established by AS / NZS 4360 - Standards Australia and Standards New Zealand; the COSO - Committee of Sponsoring Organizations of the Treadway The Commission; CoCo - Criteria of Control Committee of the Canadian Institute of Chartered Accountants and the Turnbull Report. Among the existing methodologies, the COSO framework is one of the most recommended by various scholars. Historically, these models have been issued to private entities, however, recently, several studies have focused on the analysis of the applicability of the public administration. In order to improve the planning, management and control, the Tribunal de Contas da União (TCU) has been evaluating public bodies based on assumptions and COSO guidelines, one of them works the Judgment nº. 1,074 / 2009 issued several determinations to the Judiciary member institutions. Fulcrum with this decision, the courts, through its Internal Audit Units have adopted necessary measures to comply with the said judgment. For this reason, it has become essential to assess whether the system of internal controls of the Tribunal Regional Eleitoral da Paraíba is appropriate for teachers pillars of the COSO framework, which was the basis for TCU determinations. To guide this evaluation, was released as a general objective: to verify the degree of appropriateness of the methodology COSO ERM system of internal controls of the Tribunal Regional Eleitoral da Paraíba. To this end, we carried out a survey research on all 340 servers, of which 195 responded. The answers were converted and examined using the coefficient of Jaccard, which calculates the degree of similarity and dissimilarity between the reference model and the COSO internal control system of the Court, captured by the questionnaire. The results showed a low level of fitness for all components (Control Environment (15.78%), Objective Setting (14%), Event Identification (0%), Risk Assessment (8.3%), risk Response (0%) Control activities (7.6%), Information and Communication (18.18%) and (0%) for monitoring) and for the entire system (10.55%), which demonstrates, in view of the COSO ERM, weak controls and enterprise risk management.

[pt] A auditoria e o monitoramento contínuo visam melhorar a eficiência das operações na empresa, identificando e avaliando riscos de maneira tempestiva e provendo rapidamente informações críticas à alta administração para uma melhor tomada de decisão. Mediante a adoção de ferramentas de controle incorporadas aos sistemas de informação ou a utilização de softwares apropriados, a auditoria e o monitoramento contínuo propiciam o acompanhamento em tempo real dos processos empresariais. Esta dissertação tem como objetivo principal desenvolver e aplicar em uma empresa do setor elétrico brasileiro uma metodologia para estabelecer e hierarquizar regras de monitoramento de processos de negócio, na perspectiva de implementação futura de uma plataforma tecnológica de auditoria contínua. Mais especificamente, a metodologia compreende a seleção dos processos auditáveis com maior exposição ao risco; identificação de eventos de risco associados a esses processos; e estabelecimento e hierarquização de regras de monitoramento propriamente ditas. A pesquisa pode ser considerada aplicada, descritiva e participativa e teve como estratégia principal a adoção do método de estudo de caso, com a realização de oficinas de trabalho para a coleta de dados primários. Destacam-se como resultados: (i) a revisão crítica da literatura existente sobre auditoria contínua; (ii) uma metodologia para estabelecer e hierarquizar regras de monitoramento associadas a processos de maior exposição a risco para fins do projeto de auditoria continua em uma empresa do setor elétrico brasileiro; e (iii) demonstração da aplicabilidade e efetividade da metodologia proposta, conforme descrito no estudo de caso. / [en] Continuous monitoring and audit aim at improving the efficiency of operations at the company, identifying and timely assessing risks for providing critical information to senior management for better decision-making processes. By adopting control tools embedded in company s information systems or by using specialized software, continuous monitoring and audit provide real-time assessment of business processes. This dissertation aims to develop and apply in a Brazilian power energy company a methodology for establishing and hierarchizing monitoring rules for the purpose of continuous monitoring and audit. The proposed methodology encompasses selection of business processes with greater exposure to risk; identification of risk events associated with those processes; and establishment of monitoring rules themselves. This research can be classified as applied, descriptive, methodological and participatory. Its methodological approach includes the development of a case study and workshops for collecting primary data. The main results can be summarized as follows: (i) critical review of existing literature on continuous audit; (ii) a methodology designed for establishing and hierarchizing monitoring rules with the purpose of continuous monitoring and audit at a Brazilian power energy company selected for this research; and (iii) demonstration of the applicability and effectiveness of the proposed methodology according to the results presents in the case study.

Bakgrund och Problem: Det har visat sig att en gemensam nämnare bland de bakomliggande orsakerna till den senaste finanskrisen var bristande intern kontroll. Det var även en av orsakerna till att en svensk bank i augusti år 2010 gick i konkurs och det kan ses som högst oväntat med tanke på de utvecklade regler, ramverk och granskningar som finns för de svenska bankerna idag. För att den interna kontrollen i ett företag ska fungera väl måste den integreras i hela verksamheten. I dagsläget finns det tecken på att det råder en lucka mellan den interna kontroll som styrelse vill uppnå och den som når fram till medarbetarna i banken. Syfte: Uppsatsens syfte är att studera hur de fyra svenska storbankerna arbetar med intern kontroll idag samt analysera kommunikationen och integrationen av den interna kontrollen i verksamheten. Vidare vill vi bidra till en insikt om hur intern kontroll integreras och blir en del av det dagliga arbetet i banken. Metod/Empiri: Då studien undersöker hur kommunikationen och integrationen av intern kontroll ser ut i de svenska storbankerna, ansågs en enbart kvalitativ metod med intervjuer av personer som aktivt arbetar med intern kontroll inte vara tillräckligt. Det empiriska materialet består därför av intervjuer med personer som arbetar aktivt med den interna kontrollen i de fyra svenska storbankerna samt en enkätundersökning bland medarbetarna ute i verksamheten. Slutsats: Arbetet med den interna kontrollen i de svenska storbankerna fungerar väl och det går att märka en tendens till ökat fokus inom området. En samlad bedömning och en jämförelse av intervjurespondenternas svar och enkäternas svar visar att ett gap i kommunikationen angående den interna kontrollen kan anas. Det finns därmed också en brist i integrationen av den interna kontrollen. / Background and Problem: It was shown that the lack of internal control was a common denominator among the reasons for the recent financial crisis. It was also one of the reasons that a Swedish bank in August 2010 went bankrupt and this can be seen as highly unexpected due to the developed rules, frameworks and reviews that exist for the Swedish banks today. In order for a company to accomplish a well functional internal control it must be integrated throughout the whole organization. In the current situation there is evidence confirming an existence of a gap between the internal control a board request and what is accessible to employees in the bank. Aim: The purpose of this thesis is to study how the four major Swedish banks are operating the internal control today, also, analyzing the communication and integration of the internal control within the organization. We also wish to contribute to an understanding of how internal control is integrated and how it becomes a part of the daily work in the bank. Method/Empirics: Since this study examines how communication and integration of internal control appears in the major Swedish banks, a purely qualitative approach with interviews of people who actively work with the internal control was not considered as sufficient. Therefore, the empirical data consists of interviews with employees who are actively working with internal control in the four major Swedish banks and additionally, a survey was sent to the employees working in the daily business. Conclusions: The work with internal control in the major Swedish banks is well functioning and it is possible to notice a tendency for increased focus for the subject. An overall assessment and comparison of responses from the interviews and the survey indicates a gap in communication regarding internal control. Thus, there is a lack of integration of the internal control.

Made available in DSpace on 2016-04-25T18:40:13Z (GMT). No. of bitstreams: 1 Joseth Ferreira Brandao.pdf: 1284075 bytes, checksum: 1fbf41051d6cee86095f7b8f3639df96 (MD5) Previous issue date: 2015-12-22 / Internal control of a public institution must be suited to your needs, in order to provide reasonable security of your information. It is true that information is one of the basic inputs of society becoming thus a fundamental good for any activity. Thus, this rummage aimed to conduct a study on the Internal Control System of the Federal University of Alagoas analyzing their suitability to the model proposed by COSO in order to foster a culture of internal controls in the institution, with the risk assessment, activities control, information and communication, as well as by monitoring through ongoing management activities. The data collection was conducted through survey research using a structured questionnaire with closed and open questions, which was applied to teachers and technicians of the University. During the processing and analysis of the results it was applied Palfi and Boot- Avram model that consists of comparing international models of internal control obtaining the degree of similarity and dissimilarity between them from the calculation of the Jaccard coefficient. The results show that there is high dissimilarity among the COSO model and Internal Control System UFAL especially with regard to the monitoring component / O controle interno de uma instituição pública deve estar adequado às suas necessidades, de modo a proporcionar uma razoável segurança de suas informações. É certo que a informação é um dos insumos básicos da sociedade tornando-se, portanto, um bem fundamental para qualquer atividade. Nesse sentido, esta pesquisa teve por objetivo conduzir um estudo sobre o Sistema de Controles Internos da Universidade Federal de Alagoas analisando sua adequação ao modelo proposto pelo COSO com o intuito de fomentar a cultura de Controles Internos na Instituição, com a avaliação de riscos, atividades de controle, informação e comunicação, bem como através do monitoramento por meio de atividades gerenciais contínuas. A coleta de dados foi realizada por meio de pesquisa survey com a utilização de questionário estruturado com questões fechadas e abertas, o qual foi aplicado aos docentes e técnicos da Universidade. Durante o processamento e as análises do resultado foi aplicado o modelo Palfi e Bota-Avram, que consiste na comparação entre modelos internacionais de controle interno obtendo-se o grau de semelhança e dessemelhança entre eles a partir do cálculo do Coeficiente de Jaccard. Os resultados mostram que há grande dissimilaridade entre o modelo COSO e o Sistema de Controles Internos da UFAL, principalmente no que tange ao componente de Monitoramento

Submitted by Filipe dos Santos (fsantos@pucsp.br) on 2017-01-10T11:33:37Z No. of bitstreams: 1 Débora de Fátima Domingues.pdf: 1458320 bytes, checksum: 1be484475700367f8a680320ff9225fb (MD5) / Made available in DSpace on 2017-01-10T11:33:37Z (GMT). No. of bitstreams: 1 Débora de Fátima Domingues.pdf: 1458320 bytes, checksum: 1be484475700367f8a680320ff9225fb (MD5) Previous issue date: 2017-12-13 / The internal control environment through the COSO methodology contributes to the organization seeking to mitigate its business risks and for this, establishes guidelines for the organization, senior management, leadership and employees. At the heart of the issue of the control environment, it is the intellectual capital that, in the condition of an intangible asset, is considered the age of the knowledge and information, the great differential of competitive advantage to achieve results. Referring to intellectual capital as a competitive differential, it is only considered if it manifests in the organizational environment the skills needed for this contribution to the organization. In this sense, this research aimed to conduct a study on Internal Controls in companies and the improvement and engagement of intellectual capital in the control environment. The data collection was done through a questionnaire sent by email using structured questionnaire with closed questions, which was applied to employees of large companies. During the processing and analysis of the result, the correlation matrix was performed, which consists of the existence or not of a correlation between variables, which in this work, refers to the COSO elements with the Intellectual Capital and the control environment and the Individual Competences. The results show the strong correlation between the blocks of questions, especially regarding the intelligent controls, those that attend to the mutations and uncertainties to which they are submitted to the current organizations and being respected and valued. Moreover, the environment promotes human competence in practice, aimed at constant improvements of the controls, justifying the interdependence of the control environment with the improvement of intellectual capital / O ambiente de controles internos, através da metodologia do COSO, contribui para a organização na busca de mitigar riscos para os seus negócios e, para isso, estabelece diretrizes à organização, à alta administração, à liderança e aos colaboradores. No centro da questão do ambiente de controles, encontra-se o capital intelectual que, na condição de ativo intangível, é considerado na era do conhecimento e da informação, o grande diferencial de vantagem competitiva para atingir resultados. Referindo-se ao capital intelectual como diferencial competitivo, ele só é assim considerado se manifestar no ambiente organizacional as competências necessárias para a contribuição à organização. Nesse sentido, esta pesquisa objetivou conduzir um estudo sobre os controles internos nas empresas e o aprimoramento e engajamento do capital intelectual no ambiente de controle. A coleta de dados foi realizada por meio de pesquisa enviada por e-mail com a utilização de questionário estruturado com questões fechadas, o qual foi aplicado aos colaboradores de empresas de grande porte. Durante o processamento e as análises do resultado, foi realizada a matriz de correlação, que consiste na existência ou não de correlação entre variáveis, que neste trabalho, diz respeito aos elementos do COSO com o capital intelectual e o ambiente de controle e as competências individuais. Os resultados mostram a forte correlação entre os blocos de questões, principalmente no que tange aos controles inteligentes, aqueles que atendem às mutações e incertezas à que estão submetidas às organizações da atualidade e sendo respeitados e valorizados, e o ambiente que promove colocar a competência humana em prática, voltada para melhorias constantes dos controles, justificando a interdependência do ambiente de controle com o aprimoramento do capital intelectual

La presente tesis fue desarrollada con el objetivo de identificar el impacto financiero que un modelo de gestión de riesgos bajo el ISO 9001: 2015 tiene en las empresas del sector servicios prestados a empresas en términos de la información contable financiera que es inherente en los procesos y en los indicadores financieros, específicamente en cómo influirá en la implementación de modificaciones y/o publicaciones de nuevas normas contables (NIIF´s y NIC’s). EL motivo de la presente tesis no radica en implementar propiamente una NIIF o sistema COSO ERM en la empresa sino evaluar el impacto que tiene la gestión de riesgos en el proceso de transición hacia la adopción de una actualización de normas NIIF, es por ello que se hace énfasis en el desarrollo del modelo de gestión de riesgos, el cual nos ayudará a identificar los riesgos propios y evaluar la materialización del más relevante y su impacto en las finanzas-Dimensión 1 (influencia en los ratios financieros pertinentes) y en la información contable financiera-Dimensión 2 (atributos de ésta). Esta tesis se desarrolla en el sector de servicios prestados a empresas, localizándose en las empresas que realizan actividades profesionales, científicas y técnicas siendo estas relevantes debido a un crecimiento constante. Para ello se decidió evaluar una actividad en particular, a partir de la CIIU 74914-Obtención y dotación de personal es que se profundiza en el resultado financiero de la gestión de riesgos empresariales. De esta manera, se desarrolla la presente tesis, confiando en que sirva como aporte de una nueva perspectiva de cómo evaluar las ventajas de desarrollar estándares internacionales, como la ISO 9001:2015 o el COSO ERM 2017, en un sector relevante para el desarrollo del país. Es por ello por lo que contribuye en el fortalecimiento del avance empresarial en términos de gestión empresarial integral, preventiva y fáctica. Finalmente, con el fin ilustrar la problemática detectada, y siendo importante para el sector, se expondrá el proceso de ingresos provenientes de servicios prestados a terceros en el que se evaluará la transición hacia la NIIF 15; cabe mencionar que no es motivo de esta tesis evaluar el impacto propio de la NIIF 15. / This thesis was developed with the objective of determining the financial impact that a risk management model under the ISO 9001:2015 has in the companies of the service sector provided to companies in terms of the financial accounting information that is present in the Processes and financial indicators, settling specifically on how it will influence the implementation of modifications and/or publications of new accounting Standards (NIIF´S and IAS). The reason for this thesis is not to properly implement an IFRS or COSO ERM System in the company, but to evaluate the impact that risk management has on the transition process makes the adoption of an IFRS norm update. This thesis is developed in the sector of services provided to companies, being in companies that carry out professional, scientific and technical activities being relevant due to constant growth. It was decided to evaluate a particular activity, from ISIC 74914-Obtaining and equipping personnel is that the financial result of the management of business risks is deepened. In this way, the present thesis is developed, trusting that it serves as Contribution of a new perspective on how to evaluate the advantages of developing international standards, such as ISO 9001:2015 or COSO ERM 2017, in a sector relevant to the development of the country. This is the main reason why it contributes to the strengthening of business advancement in terms of comprehensive, preventive and factual business management. Finally, in order to illustrate the problem detected, and being important for the sector, the income process will be exposed in which the transition to IFRS 15 is assessed; It is worth mentioning that there is no reason This Thesis Evaluate the own impact of IFRS 15. / Tesis

The primary objective of this study was to develop an Enterprise Risk Management Maturity Framework (ERMMF) for use in the assessment of Enterprise Risk Management (ERM) maturity levels of the insurance industry in Botswana. The ERMMF incorporated elements from the Committee of Sponsoring Organisations of the Treadway Commission (COSO)’s ERM framework and the AON risk maturity model. Five criteria were utilised to define each of the eight components of ERM used to measure ERM maturity levels. The framework was developed qualitatively through literature review. The ERMMF was tested empirically to evaluate the ERM maturity levels of the insurance industry in Botswana. Data was collected from 12 respondents from long-term insurance companies, 15 from short-term insurance companies, 4 from reinsurers and 59 from brokerages. The findings revealed that the whole insurance industry is at the Defined stage of ERM maturity level as the responses bordered around 3 on the developed scale of measurement. The findings implied that the insurance sector in Botswana has generally implemented ERM but not enough follow-ups had been made to ensure that ERM became a continuous process. Results further indicated that although the whole sector was at the defined stage of ERM, the responses in each component differed per stratum. Literature indicates that insurance organisations, regardless of stratum within which they are, are faced with similar risks generally. The differing responses could be due to the magnitude of risks that could differ according to unique characteristics of each stratum. The study further recommended an enterprise risk management implementation procedure for the insurance industry in Botswana. / Business Management / D. Admin (Business Management)

The purpose of this diploma thesis is to understand financing of drug development from an enterprise risk management perspective as well as to critically assess the efficiency of the ISO framework and risk management techniques used for determining whether to fund drug development or not. The diploma thesis is divided into theoretical and practical part. The first part starts with perception and assessment of uncertainty and risk in the past. It describes how risk-averse individuals attempted to deal with uncertainty and different risk. This is followed by the evolution of traditional risk management into the fast developing enterprise risk management. The text further analyses commonly used risk management standards COSO ERM and ISO 31000:2009. However, the main focus is on the critical assessment of analytical tools which are frequently used for evaluating and assessing risks, especially financial ones, during drug development. The theoretical part is finished by a drug development process, whose phases are briefly described. The practical part was written in co-operation with AstraZeneca, a top-notch pharmaceutical company. The overview of its business is preceded by an explanation of current issues in the pharmaceutical industry. Furthermore, the risk analysis is conducted with respect to the ISO framework. Subsequently, selected risk assessment techniques are applied on the simplified financial model of two different drugs, which was created based on AstraZeneca's real data. These risk assessment tools are used in different phases of drug development so it could be seen clearly how the results are changing during a project. The outcomes of this risk analysis are compared with original plans used by AstraZeneca which were used for deciding whether to fund drug development or not.