Metodología para evaluar la efectividad del diseño y operación de los controles en la realización de auditorías basadas en riesgos

Abstract

La frecuente ocurrencia de eventos de riesgo operacional que generan pérdidas económicas y deterioro de la imagen en diferentes organizaciones, convoca a la reflexión de evaluar la efectividad de las diferentes actividades de control que se realizan en la operación del negocio y que hacen parte del sistema de control interno de la entidad. Por esta razón, existe un reto para las áreas de auditoría interna que consiste en diseñar, desarrollar e implementar nuevas metodologías estructuradas en tecnología eficiente y en el conocimiento de expertos, que permitan evaluar el diseño y efectividad de los controles claves de la entidad. La literatura actual plantea varios lineamientos conceptuales para trabajar el problema de valorar el diseño y la efectividad de los controles, no obstante, existen limitaciones en su implementación y ninguna de las fuentes referenciadas, plantea metodologías o modelos de cómo se debe realizar la valoración de la efectividad del diseño y operación de los controles. El objetivo de este trabajo, es contribuir con el desarrollo de una metodología y un modelo estructurado que permita evaluar de forma integral el diseño y efectividad de los controles. Para ello, el contenido del trabajo propone el diseño, estructura e implementación de una metodología y dos modelos cualitativos que permiten identificar los controles claves para valorar la efectividad del diseño y operación de los controles claves, a partir del relacionamiento de variables cualitativas previamente definidas y valoradas por expertos en temas de riesgos y auditoría interna. /Abstract:The frequent occurrence of operational risk events that generate economic losses and deterioration of the organizational image, invites to a reflection and to assess the effectiveness of different control activities performed in the operation of the business. They are part of the institution's internal control system. For this reason, there is a challenge for the areas of internal audit to design, develop and implement new technology efficiently, structured methodologies and knowledge of experts to evaluate the design and effectiveness of key controls in the entity. The current literature raises several conceptual solutions to the problem of evaluating the design and effectiveness of controls, nonetheless, there are limitations in its implementation and none of the referenced sources explains methodologies or models of how to make the assessment of the effectiveness of design and operation of controls. The aim of this paper is to contribute to the development of a methodology and a structured model to assess comprehensively and objectively the design and effectiveness of controls. To do this, the paper proposes the design, structure and application of a methodology and two qualitative models that identify key controls for auditing and assessing the effectiveness of the design and operation of key controls, from the relationship of qualitative variables previously defined and valued by experts on risk and internal audit. The application of the methodology and the models proposed in this paper, add value to organizations by reducing costs, the subjectivity introduced by the auditor on the effectiveness of controls and the risk of failure in carrying out internal audit activities, who should ensure the effectiveness of the internal control system within the organization. The practical exercise of this paper is geared towards the application of the methodology and the proposed models, which will be supported by the development of a risk assessment and the effectiveness of the design and operation of the controls associated with those risks. The result of the exercise will enable the auditor to conclude on the effectiveness of key controls, as well as compare and conceptualize on the risk assessment conducted by those in charge of the processes, comparing it with the result of a risk-based audit.