Risk-based auditing in the internal control of Brazilian public administration: The case of the Minas Gerais State Comptroller General’s Office

Abstract

Risk-based auditing (RBA), the application of which is encouraged by internationally recognized auditing institutions such as the Institute of Internal Auditors (IIA), has been incorporated by Brazilian control bodies such as the Federal Court of Accounts (TCU) and the Office of the Comptroller General (CGU), among others. The article discusses the adoption of the instrument by internal control bodies in sub-national governments, with reference to the Comptroller General of the State of Minas Gerais (CGE/MG). The theoretical lens of the analysis is the contributions of sociological neoinstitutionalism, which sets it apart from other academic works on the subject, and is based on documentary research, combined with the organization of focus groups with the agency’s auditors and interviews with its auditor general. The main results obtained can be summarized in three main aspects. Firstly, the adherence to the new methodology by the CGE/MG reflects the presence of elements of an isomorphic nature in relation to the institutional environment in which the agency operates. Secondly, work with this profile is still incipient, with compliance audits prevailing. Thirdly, in the perception of the agency’s auditors, its implementation takes on a ceremonial connotation. The conclusions highlight the challenges faced by the CGE/MG in moving beyond ceremonialism in the application of the ABR, including the absence of a risk management policy on the part of the state public administration and the agency’s relative lack of operational preparation for its effective incorporation into the daily routine of auditing activities.
Keywords: internal control system; public administration; internal audit; risk-based audit; neoinstitutionalism; CGE/MG.