Modelo de mensuração da maturidade em gestão de riscos e controles internos em órgãos da administração pública federal: estudo em um hospital universitário

Abstract

The institutionalization of risk management and internal controls is crucial for strengthening governance and decision-making within public organizations. Although Joint Normative Instruction Nº. 01/2016 (IN Conjunta nº 01/2016) (Brazil, 2016) established guidelines for implementing governance, risk management, and internal controls within the federal executive branch, challenges regarding the implementation and consolidation of these practices persist. This research aimed to develop a maturity measurement model for risk management and internal controls applicable to federal public administration agencies and entities. The study falls within the "Public Administration and Organizations" research area, contributing to the improvement of governance and public management. It is an applied, quantitative, and descriptive study conducted across the organizational units of the University Hospital of the Federal University of Grande Dourados (HU-UFGD). The model was structured around seven dimensions (Governance Environment and Structure; Risk Identification; Risk Analysis and Evaluation; Internal Controls; Risk Treatment; Communication and Information; and Monitoring and Review) and utilized a five point Likert scale instrument based on COSO, ABNT NBR ISO 31000:2018, and Joint Normative Instruction No. 01/2016. Data were analyzed using descriptive statistics, internal consistency measures, Spearman correlation, and non-parametric tests. The results revealed a Global Maturity Index of 2.17, corresponding to Level 2 – Initial/Informal. The highest mean scores were observed in the "Governance Environment and Structure" (2.48) and "Internal Controls" (2.47) dimensions, while the remaining dimensions scored lower than these two. The findings revealed nascent practices and isolated advances, still characterized by informality, low standardization, and weaknesses in the identification, analysis, treatment, and monitoring of risks. The study's originality lies in the integration of risk management and internal controls into a unified model applicable to public sector organizations. As a contribution, a technical-technological product was developed—the Risk Management and Internal Controls Maturity Measurement Model—which enables the assessment of institutional maturity levels, the identification of gaps, the recommendation of improvements, and support for decision-making.