Auditoria interna e gestão de riscos nas entidades públicas gestoras de fundos de segurança social obrigatória em Moçambique

Abstract

The search for better corporate risk management has influenced the development of universal governance and internal control standards, including the COSO-ERM model. At the same time, the interest in minimizing conflicts and agency costs in organizations has stimulated the improvement of internal auditing standards. In the public sector, these trends are gaining momentum, especially in the current context of replacing the bureaucratic management model with New Public Management, based on the greater efficiency, effectiveness and economy. Thus, the traditional internal audit approach, which is retrospective, procedural and focused on the generality of internal controls, is tending to give way to risk-based auditing. In this context, Mozambique has been passing laws aimed at strengthening corporate governance, internal control and risk management through internal auditing. Of particular note is Decree No. 41 (2018), which made it mandatory for public institutes to have an internal auditor; Decree No. 81 (2019), which defined risk audit procedures, strengthened the decentralization of auditing and instituted subscription to the standards of The Institute of Internal Auditors; Law No. 14 (2020), which established the objectives of internal auditing as adding value to institutions through risk-based assessments and consultancy; and Ministerial Order No. 10 (2021), which defined, among the essential responsibilities of entities, the mapping of risks and the preparation of respective management matrices. However, many studies have found inadequate internal auditing practices in the public sector in various countries, even though they have many legal standards. This means that standards are not relevant in themselves if they are not put into practice. In view of this, this study aimed to assess the role of internal auditing practices adopted by public entities that manage compulsory social security funds in Mozambique in corporate risk management. This is an applied, descriptive, bibliographical, documentary, qualitative and single-case study of the National Social Security Institute of Mozambique. To collect and analyse the data, the techniques of questionnaires, interviews and document analysis were triangulated. The questionnaire was administered to 11 internal auditors of the entity studied. The interview was conducted with three members of the Board of Directors of the same entity, as well as with two auditors from the national public internal audit supervisory unit, the General Inspectorate of Finance. The documentary analysis assessed the content of the audit reports, activity plans, recommendation matrices, action plans and work programs relating to the audits carried out during the 2020-2022 triennium. Specifically, the results showed that there was no institutional risk management plan at the entity studied, that internal audit practices were not fully in line with the COSO-ERM components, that the risks identified by managers were not aligned with the areas prioritized by the audits carried out, and that risk was not assessed when carrying out the audit stages. Overall, the study found that risk-based internal auditing was not carried out during the period analysed and that the role of auditing in corporate risk management was reduced. The study contributes to academia by reducing the gap in Mozambican research; to the market by being able to stimulate the attraction of investors to Mozambique; and to society by influencing the improvement of auditing practices and the reduction of conflicts and agency costs in the public sector, whose principal is the society.