This study aims to contribute to internal auditing´s body of knowledge. This will be done by identifying and evaluating the approaches taken by internal auditors in assuring in the management of an organisation's cybersecurity. Qualitative research has been undertaken for this study by collecting data through semistructured interviews. A total of five internal auditors, also members of the IIA, were interviewed for the data. Thematic analysis was used to analyse the data. Previous literature was examined, and four concepts were identified to analyse the data. These are internal auditing, cybersecurity, information security and assurance. Data collected through the interviews have been studied through these concepts and the theory of the Three Lines of Defence Model. Results showed that internal auditors assure reasonable cybersecurity through their audits from an independent position. Both internal auditors and information security are critical for cybersecurity. Assuring cybersecurity is challenging due to the people factor. Furthermore, internal auditors exert huge influence within organisations which should be used with integrity and objectivity. The study shows that internal auditors should expand their skills and competencies to assure cybersecurity in today´s new risk landscape. Internal auditors should also use their influence actively to assist in building a cybersecurity-aware culture.

No / In this article, the authors examine how the internal audit function maintains its legitimacy when enterprise resource planning systems are introduced. This work centers on an in-depth case study of a multinational bank and finds that enterprise resource planning systems impose an institutional logic of control based on interlinked assumptions. These assumptions motivate changes in the practice and structure of the internal audit function to become an integrated and comprehensive function to maintain its legitimacy.

The advent of democracy in 1994 prompted the South African government to provide public goods to the entire population as opposed to providing services along racial lines, as was the case during the apartheid era. Consequently, government expenditure increased considerably. However, continuous service delivery protests in recent years indicate that government has not been operating optimally. The Department of Planning, Monitoring and Evaluation and National Treasury introduced Organisational Performance Management (OPM) to improve service delivery. Government also adopted internal auditing as a mechanism to improve OPM because of internal auditing’s mandate, role and body of knowledge. This study explored the implementation of OPM as a management tool to assist national departments in effectively delivering goods and services to the public economically and efficiently. The study also explored the adoption of internal auditing by national departments as a mechanism to improve OPM. The study followed a sequential mixed methods approach. The chief audit executives of eighteen national departments participated in the quantitative phase. Interviews were held with employees from four national departments as well as two monitoring departments. Departmental officials included five deputy directors-general, three chief directors, four directors, one deputy director and one senior internal auditor. Seven focus group discussions were held with twenty-two internal auditors from the four departments. Sixty-four documents were analysed. The study found that national departments have implemented systems of OPM and the reporting of quarterly performance information but are at different levels of maturity. However, governance and reporting fatigue and a reluctance to implement effective consequence management for poor performance may be undermining optimal performance. National departments may be also preparing strategic plans, annual performance plans and annual reports simply for compliance rather than for optimal performance. The study also found that internal auditors may not have a thorough understanding of the department’s performance environment and consequently undertake limited assessments of OPM, focusing mainly on quarterly performance information (PI) and documentation rather than on organisational strategy. However, management’s expectations from internal auditing go beyond assessing the quarterly PI and require advice and guidance on strategic imperatives. The appropriate skills, knowledge and training of internal auditors therefore require review. Management expects assurance of sustainable future performance of the department. Internal auditing currently stands positioned to make an evolutionary transformation into becoming the most important strategic partner to management. However, under-theorisation and a restricted internal auditing approach inhibit its natural evolution. / College of Accounting Sciences / D. Phil. (Accounting Sciences)

Thesis (MPA (School of Public Management and Planning))--University of Stellenbosch, 2005. / Public sector reform in South Africa became a reality with the change in political dispensations in 1994. In South Africa the transformation of the public sector became critical in order to provide for a better life for all. This required regulatory frameworks that could establish good governance and a holistic transformation of the public sector. Similar, to other countries financial management reform became critical to establish high performance public sector institutions, but specific to South Africa, to support equity in society. In this study the assumption is made that Internal Audit has a critical role toward the supply chain management framework, especially in relation to the two broad underlying motivations for procurement reform in South Africa. These are good governance and preferential procurement toward socio-economic empowerment. Both Internal Audit and supply chain management are private sector management methodology that forms part of the financial management reform of the public sector.

Made available in DSpace on 2015-12-03T18:35:12Z (GMT). No. of bitstreams: 1 Gilberto_Caetano.pdf: 626973 bytes, checksum: d5e81868517dfe9728b1dad8534972d7 (MD5) Previous issue date: 2010-03-31 / This dissertation is a bibliometric study of scientific articles on Internal Control and Risk Management presented and published at the USP Congress on Financial Control and Accounting and at EnANPAD between 2001 and 2008. The subject was chosen because of the importance and current relevance that Internal Control and Risk Management have taken on in the global and complex society of today. Researching the evolution and theoretical concepts related to these issues has become essential nowadays. The research method employed was the descriptive one, of the survey type, with a quantitative focus and bibliographical and documental characteristics. Of the 6,960 articles presented and published by the USP Congress and EnANPAD in the period 149 (2.1% of the total 6,960) were selected, 90 from EnANPAD and 59 from the USP Congress. This was the volume of articles used in the research. The application of Lotka's Law showed in this study that there is not yet an elite group of authors that have written on Internal Control and Risk Management at the USP Congress and at EnANPAD. The study also revealed that: in the two events taken together the quantity of articles signed by up to two authors in the period reached 49% of the total (44.1% in the USP Congress and 52.3% at EnANPAD); 78.6% are male; 68.1% of them are University lecturers; and that only 23.5% of the articles on Internal Control and Risk Management at the USP Congress and EnANPAD were published afterwards in specialist periodicals. / Esta disserta????o trata do estudo bibliom??trico dos artigos cient??ficos que abordam a tem??tica Controle Interno e Gest??o de Riscos apresentados e publicados no Congresso USP de Controladoria e Contabilidade e no EnANPAD entre 2001 e 2008. Tal tema foi escolhido em fun????o da import??ncia e da atualidade que assume em uma sociedade globalizada e complexa como a atual, de forma que pesquisar sobre a evolu????o e os conceitos te??ricos relacionados a esses assuntos tornou-se imprescind??vel nos dias de hoje. O m??todo de pesquisa empregado foi o descritivo, do tipo levantamento, com enfoque quantitativo e com caracter??sticas bibliogr??fica e documental. Do total de 6.960 artigos apresentados nos eventos supracitados, selecionaram-se 149 (2,1%), sendo 90 do EnANPAD e 59 do Congresso USP. Esse foi o volume de artigos utilizados na pesquisa. O presente estudo demonstrou, por meio da aplica????o da Lei de Lotka, que ainda n??o existe uma elite de autores que escrevem sobre Controle Interno e Gest??o de Riscos no Congresso USP e no EnANPAD. Revelou ainda que, no somat??rio de ambos os eventos, a quantidade de artigos assinada por at?? dois autores no per??odo chegou a 49% do total (44,1% no Congresso USP e 52,3% no EnANPAD); 78,6% dos autores s??o do sexo masculino; 68,1% deles s??o professores universit??rios; e que somente 23,5% dos artigos foram publicados posteriormente em peri??dicos especializados.

Idag råder en företagsmiljö som består av digitaliserade strukturer i form av informations- och affärssystem där den digitala informationen är central. Den nya företagsmiljön kräver enligt forskningen nya metoder för utvärdering och rapportering. Medan digitaliseringen kommit långt i utveckling inom företagande och samhället i stort så har redovisnings- och revisionsmetoder stått stilla.Ett koncept som har kommit att bli aktuellt i tomrummet mellan digitaliseringens framväxt och revisionsmetoders traditionella utförande är Continuous Auditing. Konceptet har forskats kring under en relativt lång tid, varvid förhoppningen var att företag skulle ta till sig konceptet och byta ut sina omoderna revisionsmetoder. Bland annat förespråkas att revisionen borde utföras på ett mer proaktivt sätt och att automatiserade lösningar ska ersätta manuella utföranden. Undersökningar har visat på att Continuous Auditing enbart har tillämpats i en begränsad utsträckning. Syftet med denna studie är därmed att utreda varför så är fallet genom att undersöka huvudanvändarna, internrevisorernas inställning till konceptet.För att genomföra undersökningen tillämpar denna studie en kvalitativ forskningsansats med hjälp av semistrukturerade intervjuer med internrevisorer. Intervjuerna och analysen kring dessa har utgått ifrån en teoretisk referensram bestående av tidigare litteratur och forskning inom internrevision, Continuous auditing och teori kring teknologitillämpning.Bland annat ger resultatet uttryck för att studiens internrevisorer är öppna för att införa närliggande koncept och upplever att det finns ett behov av att införa sådana i företag. Däremot råder det tveksamheter kring vilka användarna av sådana koncept ska vara. / There is a discussion about the current way of conducting business that contains a digitalized structure in the form of information- and enterprise systems where the digital information is vital. According to research this new environment requires new methods for measurement and reporting. While the development of the digitalization in businesses and society has gone far, the accounting and auditing methods have not.One concept that has become relevant in the process of digitalization is Continuous Auditing. There has been research about the concept for a while and there was a hope that businesses would start adopting it and switch from traditional auditing methods. For instance, the research has spoken about the possibility to do auditing in a more proactive way and implement automated technology. However, the research has shown that the concept only has been implemented in a few cases. This study has the purpose to examine why through examining the main users, the internal auditors` attitudes towards the concept.This study has applied a qualitative approach with the help of semi-structured interviews with internal auditors. The interviews and the analysis have been formed by previous literature and conducted research on internal auditing, continuous auditing and also theory about technology adoption.For instance, the results of this study were that internal auditors are willing to adopt similar concepts and are feeling the need to implement such. However, it is unclear whether the users should be internal auditors.

Idag råder en företagsmiljö som består av digitaliserade strukturer i form av informations- och affärssystem där den digitala informationen är central. Den nya företagsmiljön kräver enligt forskningen nya metoder för utvärdering och rapportering. Medan digitaliseringen kommit långt i utveckling inom företagande och samhället i stort så har redovisnings- och revisionsmetoder stått stilla. Ett koncept som har kommit att bli aktuellt i tomrummet mellan digitaliseringens framväxt och revisionsmetoders traditionella utförande är Continuous Auditing. Konceptet har forskats kring under en relativt lång tid, varvid förhoppningen var att företag skulle ta till sig konceptet och byta ut sina omoderna revisionsmetoder. Bland annat förespråkas att revisionen borde utföras på ett mer proaktivt sätt och att automatiserade lösningar ska ersätta manuella utföranden. Undersökningar har visat på att Continuous Auditing enbart har tillämpats i en begränsad utsträckning. Syftet med denna studie är därmed att utreda varför så är fallet genom att undersöka huvudanvändarna, internrevisorernas inställning till konceptet. För att genomföra undersökningen tillämpar denna studie en kvalitativ forskningsansats med hjälp av semistrukturerade intervjuer med internrevisorer. Intervjuerna och analysen kring dessa har utgått ifrån en teoretisk referensram bestående av tidigare litteratur och forskning inom internrevision, Continuous auditing och teori kring teknologitillämpning. Bland annat ger resultatet uttryck för att studiens internrevisorer är öppna för att införa närliggande koncept och upplever att det finns ett behov av att införa sådana i företag. Däremot råder det tveksamheter kring vilka användarna av sådana koncept ska vara. / There is a discussion about today’s current way of conducting business that contains a digitalized structure in the form of information- and enterprise systems where the digital information is vital. According to research this new environment requires new methods for measurement and reporting. While the development of the digitalization in businesses and society has gone far, the accounting and auditing methods have not. One concept that has become relevant in the process of digitalization is Continuous Auditing. There has been research about the concept for a while and there was a hope that businesses would start adopting it and switch from traditional auditing methods. For instance, the research has spoken about the possibility to do auditing in a more proactive way and implement automated technology. However, the research has shown that the concept only has been implemented in a few cases. This study has the purpose to examine why through examining the main users, the internal auditors` attitudes towards the concept. This study has applied a qualitative approach with the help of semi-structured interviews with internal auditors. The interviews and the analysis have been formed by previous literature and conducted research on internal auditing, continuous auditing and also theory about technology adoption. For instance, the results of this study were that internal auditors are willing to adopt similar concepts and are feeling the need to implement such. However, it is unclear whether the users should be internal auditors.

The aim of this Master's thesis is to evaluate the model of internal audit in CEZ Group primarily in terms of compliance with applicable laws and the International Professional Practices Framework of Internal Auditing. The research was conducted by comparing the internal regulations and other CEZ Group's documents with current legislation and international Standards of internal audit. As expected, the main criteria are in accordance with current legislation. The main contribution of this model is cost-effective executing of internal audit and sharing the best practice across the CEZ Group. I think, main disadvantages are: dependence on the Board and CEO of CEZ, insufficient use of experts outside the CEZ Group, excluding profit from the price calculation of internal audit and certain conditions for the provision of internal audit services in subsidiaries.

Made available in DSpace on 2015-12-03T18:35:23Z (GMT). No. of bitstreams: 1 Juarez_Pinto.pdf: 4503783 bytes, checksum: 089eab96f0128a4cefa7708bb566f655 (MD5) Previous issue date: 2012-08-06 / Because of the development in the transactions between entities arising from globalization, internal auditing is setting itself and assuming a relevant role in the context of organizations, consulting and supporting management. In this context one question arises about the actions of internal auditing in the technical aspect and in its contribution related to the management aspects. In view of this, the present work was based on a proposal from the following question: what is the perception of managers on the role that internal audit plays in management practices and decision making within the entities / companies? The objective of this study was to analyze and evaluate the perception of managers of companies in the state of S??o Paulo, with shares traded on the stock exchange, using the internal audit, in order to highlight the role it plays in management practices and the decision making in corporations. The methodology used for the study was quantitative descriptive since the primary data was obtained through a questionnaire. The collected data were selected, coded, tabulated and analyzed allowing to draw conclusions. Mathematical and statistical tools of computer resources were used. It was concluded that internal auditing, in the perception of managers of organizations, is a tool to support management, helping companies to achieve their objectives through the information provided, contributing to decision making through risk assessment and strengthening of strategic internal control of systems we also concluded that there is need of further studies to explore the theme, which should include a larger number of companies to be surveyed / Devido ?? evolu????o nas transa????es entre as entidades, oriunda da globaliza????o, a auditoria interna est?? se afirmando e assumindo papel relevante no contexto das organiza????es, assessorando e apoiando a gest??o. Neste cen??rio surge o questionamento quanto ?? atua????o da auditoria interna tanto no aspecto t??cnico quanto na sua contribui????o relacionada aos aspectos de gest??o. Diante do exposto, o presente trabalho baseou-se na proposta da seguinte indaga????o: qual a percep????o dos gestores sobre o papel que a auditoria interna exerce nas pr??ticas de gest??o e tomadas de decis??o no ??mbito das entidades/sociedades? Assim, o objetivo deste estudo foi analisar e avaliar a percep????o de como os gestores de empresas do Estado de S??o Paulo, com a????es negociadas na bolsa de valores, utilizam a auditoria interna, de maneira a evidenciar o papel por ela exercido nas pr??ticas de gest??o e tomadas de decis??o nas corpora????es. A metodologia utilizada para o estudo foi a descritiva quantitativa, visto que se utilizou dados prim??rios obtidos atrav??s da aplica????o de question??rio. Os dados coletados foram selecionados, codificados, tabulados e analisados, o que permitiu obter conclus??es. Utilizou-se para o mister instrumentos matem??ticos e estat??sticos atrav??s de recursos computacionais. Concluiu-se que a auditoria interna, na percep????o dos gestores das organiza????es, ?? uma ferramenta de apoio ?? gest??o, auxiliando as empresas a atingirem os seus objetivos, por meio das informa????es fornecidas, contribuindo, com a avalia????o de riscos estrat??gicos e fortalecimento dos sistemas de Controle Interno, para a tomada de decis??es. Entendeu-se, tamb??m, que h?? necessidade de novos estudos para explorar o tema, inclusive com um maior n??mero de empresas a serem pesquisadas

Submitted by Elba Lopes (elba.lopes@fecap.br) on 2018-03-26T16:30:03Z No. of bitstreams: 2 Marta de Lourdes Ferreira.pdf: 815747 bytes, checksum: 5a3ca6df9a2d575450bc76d1bec0c528 (MD5) license_rdf: 0 bytes, checksum: d41d8cd98f00b204e9800998ecf8427e (MD5) / Made available in DSpace on 2018-03-26T16:30:03Z (GMT). No. of bitstreams: 2 Marta de Lourdes Ferreira.pdf: 815747 bytes, checksum: 5a3ca6df9a2d575450bc76d1bec0c528 (MD5) license_rdf: 0 bytes, checksum: d41d8cd98f00b204e9800998ecf8427e (MD5) Previous issue date: 2016-09-06 / The main objective of this research was to raise and present isomorphism???s evidences in Operational Risk Management (ORM) of Financial Institutions (FIs) operating in Brazil. As specific objectives, to identify convergences and evaluate why they occur. It was made a qualitative and descriptive study of the historical development of ORM in FIs, regulations and similar works. It was carried out content analysis of "Pillar 3" Reports from ten IFs (75% of total assets) that acted in Brazil between 2013 and 2015. It was used descriptive categorizations of situations/events based on the theoretical framework, classified as performance evidence. It was found the presence of 100% of categories from coercive mechanism, 78% from the normative and 70% from the mimetic, proving the simultaneous performance of the mechanisms. The main categories for mechanism and disclosure index were: a) Coercive: related to legal compliance (100%); other risk management beyond the mandatory (89%); Business Continuity Plan (78%), a model of the three defense lines (56%), and prioritization of risks (56%). b) normative: committee responsibilities, executive officers and alike (100%); training in operational risk (78%), and dissemination of the risk culture (67%). c) mimetic: the use of technology in ORM (100%) and in loss databases (78%); the standardization of procedures between headquarters and branches (78%), as well as the use of indicators (78%). As a convergence point, there is a search for improvement of the ORM, and the compliance with requested criteria for approval of internal models to calculate capital requirements. The homogenization of the ORM was due to the legal demands, and its beneficial effects positively change the environment. The public disclosure of principles, the best practices and "Pillar 3" Reports allow other companies to use the main information and implement their own ORM structures. As future researches, we suggest the evolution of operational losses and evidence of the ORM performance; the current development stage of internal models; the profile analysis of people hired in the area, from the perspective of normative isomorphism; the technologies used in the ORM to identify mimetic isomorphism; the categories update of each mechanism, including technology area characteristics and human resources; as well as the research replication for companies subject to specific regulations, such as SOX and capital markets. / O objetivo principal da pesquisa ?? levantar e apresentar evid??ncias do isomorfismo na Gest??o de Riscos Operacionais (GRO) de Institui????es Financeiras (IFs) que operam no Brasil. O objetivo espec??fico ?? identificar pontos de converg??ncia e avaliar porque ocorrem. Realizada pesquisa qualitativa e descritiva da evolu????o hist??rica da GRO em IFs, regulamenta????es e trabalhos semelhantes. Efetuada an??lise de conte??do do Relat??rio ???Pilar 3??? de dez IFs (75% do total de ativos) que atuaram no Brasil entre 2013 e 2015. Utilizadas categoriza????es descritivas de situa????es/eventos conforme referencial te??rico, classific??veis como evid??ncias de atua????o. Constatou-se a presen??a de 100% das categorias do mecanismo coercitivo, 78% do normativo e 70% do mim??tico, comprovando a atua????o simult??nea dos mecanismos. Principais categorias por mecanismo e ??ndices de evidencia????o: a) coercitivo: relacionadas ao atendimento legal (100%); gest??o de outros riscos al??m dos obrigat??rios (89%); Plano de Continuidade de Neg??cios (78%), Modelo das Tr??s Linhas de Defesa (56%) e prioriza????o de riscos (56%). b) normativo: responsabilidades de comit??s, diretores e assemelhados (100%); treinamento em risco operacional (78%) e dissemina????o da cultura de risco (67%). c) mim??tico: uso de tecnologias na GRO (100%) e em bancos de dados de perdas (78%); padroniza????o de procedimentos entre matriz e filiais (78%) e o uso de indicadores (78%). Como ponto de converg??ncia, v??-se a busca pelo aperfei??oamento da GRO e o atendimento aos requisitos necess??rios para aprova????o de modelos internos para c??lculo de requerimentos de capital. A homogeneiza????o da GRO ocorreu em fun????o das demandas legais e seus efeitos ben??ficos alteram positivamente o ambiente. A divulga????o p??blica de princ??pios, melhores pr??ticas e relat??rios ???Pilar 3??? permite que outras organiza????es usem as informa????es como base e implantem suas pr??prias estruturas de GRO. Sugest??es de pesquisa: evolu????o de perdas operacionais e com evid??ncias de atua????o da GRO; est??gio atual de desenvolvimento dos modelos internos; an??lise do perfil dos profissionais contratados na ??rea, sob a ??tica do isomorfismo normativo; tecnologias usadas na GRO buscando evid??ncias do isomorfismo mim??tico; e replica????o da pesquisa para organiza????es sujeitas a regulamenta????es espec??ficas como SOX e mercado de capitais.