5/26/2018 Auditoria Baseada em Riscos Aplicada a Sistemas de Gesto

1/8

Frngeased Ca Emeed

NQCMSD_MNONUANCN AJ

_MUEDU NYBMENCN NUMUSAJNU CALAUSD

Jnrd/?9>3

5/26/2018 Auditoria Baseada em Riscos Aplicada a Sistemas de Gesto

2/8

N u c m t d r m n O n s a n c n a j _ m s e d s N p b m e n c n n U m s t a j n s c a L a s t d ?9>3, ^U

Jnrd ca ?9>3

QJ GDVD CAUNFMD YN_N DUNQCMSD_AU MGSA_GDU CA UMUSAJNU CA LAUSD

Nucmtdrmn Onsancn aj _msedsNpbmencn n Umstajns ca Lastd

(A nbmghncn s gdvns MUD =99>;?9>1, MUD >399>;?9>1,MUD 31999;?9>6, ate.)

pdr Frngeased Ca Emeed>

D fded cd trnonbhd cds nucmtdras mgtargds ca smstajns ca lastd pdca jucnredgsmcarnvabjagta edj n puobmend cnsgdvns gdrjns MUD =99>;?9>1, MUD >399>;?9>1 a

MUD 3199>;?9>6,agtra dutrns. Ydr enusn cds gdvds raqumsmtds cassns gdrjns a pdr rnzasca eustd a afmeemn, asparn-sa qua sakn cncn aspaemnb gfnsa Nucmtdrmn Onsancn aj_mseds(NO_).

Nucmtdrmn Onsancn aj _mseds uj tarjd onstngta utmbmzncd gd jugcd tdcd, jns nmgcnjumtd jnb edjpraagcmcd. Astapnpar taj pdr dokatmvd nprasagtnr n nodrcnlaj cd ^UYpnrn n NO_ Npbmencn n Umstajns ca Lastd, oaj edjd vmsn fdrgaear cmratrmzas osmenssdora edjd nodrc-bn a edbde-bn aj prtmen.

Asta trnonbhd fdm mgspmrncd gd Jngunb Edjd mjpbajagtnr n Nucmtdrmn Onsancn aj_mseds gns drlngmznas; ujn nodrcnlaj mgdvncdrn, bngncd aj ?99< pabd ^UY.

Edgtaxtd

Edgfdrja dNgaxd UB cns gdvns Cmratmvns MUD,tdcns ns gdrjns MUD ca smstajns calastd, puobmencns n pnrtmr ca ?9>?, cavard trnzar n salumgta cafmgmd ca Nucmtdrmn;

"Yrdeassd smstajtmed, mgcapagcagta a cdeujagtncd, pnrn dotar avmcgemn ca nucmtdrmna nvnbm-bn dokatmvnjagta, pnrn catarjmgnr n axtagsd gn qunb ds ermtrmds canucmtdrmn sd ntagcmcds.

GDSN > Qjn nucmtdrmn pdca sar ujn nucmtdrmn mgtargn (ca prmjamrn pnrta) du ujnnucmtdrmn axtargn (ca salugcn pnrta du ca tareamrn pnrta), a pdca sar ujn nucmtdrmnedjomgncn (edjomgnd ca cuns du jnms cmsempbmgns).

>Cmratdr axaeutmvd cd ^UY - Eagtrd cn ^unbmcnca, Ualurngn a Yrdcutmvmcnca.

A-jnmb;qspIqsp.drl.or.Sabafdga; (>>) 5

5/26/2018 Auditoria Baseada em Riscos Aplicada a Sistemas de Gesto

3/8

N u c m t d r m n O n s a n c n a j _ m s e d s N p b m e n c n n U m s t a j n s c a L a s t d ?9>3, ^U

GDSN ? N avmcgemn ca nucmtdrmn" a ds "ermtrmds ca nucmtdrmn" sd cafmgmcds gn NOGSGO_ MUD >=9>>;?9>?.

Ydr sun vaz, n GO_ MUD >=9>>;?9>? - Cmratrmzas pnrn nucmtdrmn ca smstajns ca lastd -mgtrdcuzmu d edgeamtd ca rmsedpnrn assns nucmtdrmns. D agfdqua ncdtncd sa rabnemdgn

edj d rmsed cd prdeassd ca nucmtdrmn aj gd ntmglmr saus dokatmvds a edj d rmsed cnnucmtdrmn mgtarfarmr edj ds prdeassds a ntmvmcncas cn drlngmznd nucmtncn.

N gdvn GO_ MUD >=9>> gd fdrgaea cmratrmzas aspaefmens sdora d Yrdeassd ca Lastd ca_msedscn drlngmznd (gaj sdora Nucmtdrmn Onsancn aj _mseds), jns raedghaea qua nsdrlngmznas pdcaj fdenr d asfdrd cn nucmtdrmn aj nssugtds ca mjpdrtgemn pnrn dsmstajn ca lastd.

Axmstaj jumtds rmseds cmfaragtas nssdemncds nd astnoabaemjagtd, mjpbajagtnd,jdgmtdrnjagtd, ngbmsa ertmen a jabhdrmn ca uj prdlrnjn ca nucmtdrmn qua pdcajnfatnr d nbengea cds saus dokatmvds. N GO_ MUD >=9>>;?9>? raedjagcn qua n passdn qua

laragemn d prdlrnjn ca nucmtdrmn edgsmcara assas rmseds gd sau casagvdbvmjagtd.Snms rmseds pdcaj astnr rabnemdgncds n;

-pbngaknjagtd(pdr axajpbd, fnbhn aj astnoabaear ds dokatmvds partmgagtas cnnucmtdrmn a catarjmgnr n nornglgemn cd prdlrnjn ca nucmtdrmn)0

- raeursds(pdr axajpbd, tajpd mgsufmemagta pnrn casagvdbvar d prdlrnjn ca nucmtdrmndu pnrn ranbmznr n nucmtdrmn)0

- sabad cn aqumpa ca nucmtdrmn(pdr axajpbd, n aqumpa gd taj n edjpatgemn

edbatmvn pnrn ranbmznr nucmtdrmns ca fdrjn afmenz)0

- mjpbajagtnd(pdr axajpbd, edjugmend mgafmenz cd prdlrnjn ca nucmtdrmn)0

- ralmstrds a saus edgtrdbas(pdr axajpbd, fnbhn aj prdtalar ca fdrjn ncaquncn dsralmstrds ca nucmtdrmn pnrn cajdgstrnr n afmeemn cd prdlrnjn ca nucmtdrmn)0

- jdgmtdrnjagtd, ngbmsa ertmen a jabhdrmn cd prdlrnjn ca nucmtdrmn(pdr axajpbd,jdgmtdrnjagtd mgafmenz cds rasubtncds cd prdlrnjn ca nucmtdrmn).

Gn futurn MUD =99>;?9>1- Umstajns ca lastd cn qunbmcnca - _aqumsmtds, pdr axajpbd,

d edgeamtd ca rmsedgd edgtaxtd cn gdvn gdrjn mr sa rafarmr mgeartazncn drlngmzndaj nbengnr ds salumgtas dokatmvds;

- prdpdremdgnr edgfmngn gn sun enpnemcnca ca fdrgaear edgsmstagtajagta nds ebmagtasoags a sarvmds edgfdrjas0

- nujagtnr n sntmsfnd cds ebmagtas.

5/26/2018 Auditoria Baseada em Riscos Aplicada a Sistemas de Gesto

4/8

N u c m t d r m n O n s a n c n a j _ m s e d s N p b m e n c n n U m s t a j n s c a L a s t d ?9>3, ^U

Ds nucmtdras mgtargds pdcaj mjpbajagtnr ujn nodrcnlaj onsancn aj rmsedsedjpntvab edj n nodrcnlaj ncdtncn pdr suns drlngmznas. H jumtds agfdquas quapdcaj sar utmbmzncds, capagcagcd ca qungtd n nucmtdrmn mgtargn enpnz ca sa npdmnr gdYrdeassd caLastd ca _mseds?cn drlngmznd. Mssd pdssmombmtn nd nucmtdr avmtnr ncupbmend cds prdeassds k ranbmzncds pabn drlngmznd a quastmdgnr ds prdeassds a ns

edgebusas cn cmrad/largemn sdora ds rmseds qua pdcaj nfatnr (pdsmtmvn dugalntmvnjagta) ds dokatmvds cd smstajn ca lastd.

Ydca sar qua ds nucmtdras mgtargds cmlnj qua sajpra edgeagtrnrnj saus asfdrds gnsrans a tajns ca jnmdras rmseds pnrn d smstajn ca lastd a pnrn n drlngmznd.Edgtucd, n axparmgemn jdstrn qua assn nodrcnlaj taj smcd cmraemdgncn pabn Nvnbmndca _mseds afatuncn pabn prprmn aqumpa ca nucmtdrmn. N prmgempnb cmfaragn qua d fdedcn NO_ agtagcar a ngnbmsnr n Nvnbmnd ca _mseds ranbmzncn pabn cmrad/largemn aonsanr ds asfdrds ca nucmtdrmn aj tdrgd cassn nvnbmnd.

Ds dokatmvds cn NO_ -Nucmtdrmn Onsancn aj _mseds

D prmgempnb dokatmvd cn NO_ fdrgaear lnrngtmn mgcapagcagtapnrn n cmrad/largemncn drlngmznd ca qua;

D Yrdeassd ca Lastd ca _msedsrabnemdgncd nds smstajns ca lastd (cn^unbmcnca, Njomagtnb, cn Ualurngn a Unca gd Srnonbhd, ate.) ast dparngcdedgfdrja d pbngakncd0

D trntnjagtdqua n cmrad/largemn taj cncd nds rmseds ncaquncd a afmenzaj tdrgnr ds gvams ca rmsed neamtvams du tdbarvams pnrn n drlngmznd0

Axmsta ujn astruturn sbmcn ca edgtrdbaspnrn jdcmfmenr sufmemagtajagta ds rmsedsqua n cmrad/largemn casakn trntnr.

N NO_ edjan edj ds dokatmvds cd galemd, pnssngcd pabds dokatmvds cn ^unbmcnca,Njomagtnms, ate., a sa edgeagtrn gds rmseds qua fdrnj mcagtmfmencds pabncmrad/largemn a qua pdcaj nfatnr, pdsmtmvn du galntmvnjagta, n edgsaeud cassasdokatmvds.

D pnpab cn nucmtdrmn mgtargn nvnbmnr nt qua pdgtd ujn nodrcnlaj pbngakncn ardoustn ca Lastd ca _mseds ncdtncn a npbmencn aj tdcn n drlngmznd pabncmrad/largemn, pnrn tdrgnr ds gvams ca rmsed neamtvams du tdbarvams (edgfdrja dsErmtrmds ca _msedcn drlngmznd). N nodrcnlaj cd ^UY pnrn n Nucmtdrmn Onsancn aj_mseds Npbmencn n Umstajns ca Lastd ast casermtn ca fdrjn asquajtmen gn plmgn nsalumr.

?D tarjd _msed, gn gdrjn GO_ MUD 5>999;?99=, cafmgmcd edjd Afamtd cn mgeartazn gds dokatmvds.Ydrtngtd, ds dokatmvds nornglmcds pabn Lastd ca _mseds mgebuaj tngtd ds dokatmvds astrntlmeds edjd dsdokatmvds aspaefmeds ca ujn drlngmznd (pdr axajpbd; ds dokatmvds cn ^unbmcnca, Njomagtnms, ca_aspdgsnombmcnca Udemnb, ca Edjpbmngea, ate.).

5/26/2018 Auditoria Baseada em Riscos Aplicada a Sistemas de Gesto

5/8

N u c m t d r m n O n s a n c n a j _ m s e d s N p b m e n c n n U m s t a j n s c a L a s t d ?9>3, ^U

Dokatmvds cn ^unbmcnca, Njomagtnms, ca UUS, ate.

Mcagtmfmend ca rmseds pnrnn edgsaeud cds dokatmvds

^unms sd ds Er mtrmds ca _ ms edcn drlngmznd4

D Yrdeassd ca Lastd ca _mseds ncaquncd a afmenz gn mcagtmfmend, ngbmsa,

nvnbmnd, trntnjagtd a edjugmend cds rmseds4

Qtmbmza n vmsd cnprprmn drlngmznd aj

rabnd nds rmseds,

tngtd qungtd pdssvab

Fnembmta nmcagtmfmend

ca rmseds kugtd

cmrad/largemn

Fnembmta n

jabhdrmn

Catarjmga d Qgmvarsd ca _mseds

Catarjmga d asedpd a n prmdrmcnca cns tnrafns ca Nucmtdrmn

Edj onsa gds rmseds, sabaemdga ns rans n saraj nucmtncns

Nvnbma d prdeassd a catarjmga edjd ncmrad/largemn dotj lnrngtmns ca quans ntmvmcncas ca Lastd ca _mseds astdsagcd ranbmzncns edgfdrja d bnga ncd

Fnembmta n mcagtmfmend ca rmseds a nnvnbmnd ca; rmseds mgaragtas

. edgtrdbas rmseds rasmcunms

C lnrngtmn dgca astmvar D@, du fnembmta n jabhdrmn dgca gd astmvar

Ynrn encn ran, ngnbmsa n ncaqund cdYrdeassd ca Lastd ca _mseds

Umj Gd

Ua astmvar qunsa tucd D@ Ua gd astmvar D@

Nodrcnlaj cd ^UY pnrn n NO_ Npbmencn n Umstajns ca Lastd

5/26/2018 Auditoria Baseada em Riscos Aplicada a Sistemas de Gesto

6/8

N u c m t d r m n O n s a n c n a j _ m s e d s N p b m e n c n n U m s t a j n s c a L a s t d ?9>3, ^U

N prtmen cn NO_ -Nucmtdrmn Onsancn aj _mseds

Nspaetds larnms mjpdrtngtas n saraj edgsmcarncds;

D asedpd cn NO_ pdca mgebumr rmseds astrntlmeds, rmseds cd galemd a rmsedsdparnemdgnms, mgebumgcd ds rabnemdgncds nds smstajns ca lastd cn drlngmznd.

D pdgtd ca pnrtmcn catarjmgnr sa n drlngmznd astnoabaeau dokatmvdsnprdprmncds, a agtd catarjmgnr sa n ajprasn taj du gd uj prdeassd ncaquncdpnrn mcagtmfmenr, ngnbmsnr, nvnbmnr, trntnr a edjugmenr ds rmseds qua nfatnj,pdsmtmvn du galntmvnjagta, assas dokatmvds.

Aj uj njomagta jncurd ca Lastd ca _mseds, d fded cn nucmtdrmn mgtargn pdcasar;

d Nucmtnr n astruturn pnrn laragemnr rmseds edjd, pdr axajpbd, raeursds,cdeujagtnd, jtdcds a rabntrmds0

d Nucmtnr d smstajn ca edgtrdbas ca tdcn n drlngmznd a ca encn ran,cmvmsd, capnrtnjagtd du prdeassd0

d _anbmznr nucmtdrmns mgcmvmcunms qua vmsaj pracdjmgngtajagta dlaragemnjagtd ca rmseds aspaefmeds. Ensd vrmds rmseds saknj edgtrdbncdsntrnvs ca ujUmstajn Mgtalrncd ca Lastddu prdeassd edjuj, tnbvazsakn nprdprmncd ranbmznr ujn nucmtdrmn edjomgncn cassa smstajn duprdeassd.

Aj njomagtas jagds jncurds ca Lastd ca _mseds, ensd ns nucmtdrmns mgcmvmcunmsfdenbmzaj pracdjmgngtajagta tdcd uj smstajn, prdeassd du ugmcnca ca galemd,

n nucmtdrmn mgtargn cava ngnbmsnr ermtmenjagta ds dokatmvds astnoabaemcds a dYrdeassd ca Lastd ca _mseds, cagtrd ca encn ujn cassns pnrtas nucmtvams.

Ua d Yrdeassd ca Lastd ca _mseds astmvar ncaquncd a agrnmzncd, n nucmtdrmnmgtargn, sajpra qua pdssvab, cava sa npdmnr gn prprmn vmsd cn drlngmznd edjrabnd nds rmseds, n fmj ca catarjmgnr d trnonbhd ca nucmtdrmn qua abn gaeassmtnedgcuzmr.

^ungcd abn gd pucar sa onsanr gd Yrdeassd ca Lastd ca _mseds, n nucmtdrmnmgtargn cava ranbmznr sun prprmn Nvnbmnd ca _mseds (aj edgkugtd edj n cmrad,

largemn, ate., a prafaragemnbjagta utmbmzngcd edjd rafargemn n gdrjnmgtargnemdgnb a ornsmbamrnGO_ MUD/MAE 5>9>9 - Lastd ca rmseds - Segmens pnrn d

prdeassd ca nvnbmnd ca rmseds), pnrn catarjmgnr d gvab praemsd cd trnonbhdgaeassrmd, a agtd fdenbmznr n jngamrn edjd n cmrad/largemn sa nssalurn caqua ns ntmvmcncas ca Lastd ca _mseds astd sagcd prntmencns edgfdrja dpbngakncd.

D rasubtncd fmgnb ca encn nucmtdrmn mgcmvmcunb cava sar d ca nssalurnr qua dsrmseds astd sagcd laragemncds cagtrd ca uj gvab neamtvab du tdbarvab

http://loja.risktecnologia.com.br/sistemas-integrados-de-gestao---requisitos-e-diretrizes-para-a-integracao-de-sistemas-de-gestao---pas-99-2012http://loja.risktecnologia.com.br/sistemas-integrados-de-gestao---requisitos-e-diretrizes-para-a-integracao-de-sistemas-de-gestao---pas-99-2012http://loja.risktecnologia.com.br/sistemas-integrados-de-gestao---requisitos-e-diretrizes-para-a-integracao-de-sistemas-de-gestao---pas-99-2012http://www.iso31000qsp.org/2012/05/publicada-finalmente-nbr-isoiec-31010.htmlhttp://www.iso31000qsp.org/2012/05/publicada-finalmente-nbr-isoiec-31010.htmlhttp://www.iso31000qsp.org/2012/05/publicada-finalmente-nbr-isoiec-31010.htmlhttp://www.iso31000qsp.org/2012/05/publicada-finalmente-nbr-isoiec-31010.htmlhttp://www.iso31000qsp.org/2012/05/publicada-finalmente-nbr-isoiec-31010.htmlhttp://www.iso31000qsp.org/2012/05/publicada-finalmente-nbr-isoiec-31010.htmlhttp://loja.risktecnologia.com.br/sistemas-integrados-de-gestao---requisitos-e-diretrizes-para-a-integracao-de-sistemas-de-gestao---pas-99-2012

5/26/2018 Auditoria Baseada em Riscos Aplicada a Sistemas de Gesto

7/8

N u c m t d r m n O n s a n c n a j _ m s e d s N p b m e n c n n U m s t a j n s c a L a s t d ?9>3, ^U

(edgfdrja cafmgmcd gds Ermtrmds ca _msedcn drlngmznd), du fnembmtnr a/ducafmgmr jabhdrmns edgfdrja gaeassrmd.

Yrdeassd edgtgud ca ncjmgmstrnd cds rmseds

ovmd, jns mjpdrtngta agfntmznr, qua gaj tdcns ns drlngmznas astd gd jasjdastlmd ca mjpbajagtnd cn Lastd ca _mseds. D quncrd n salumr astnoabaea ds lrnusca Jnturmcnca ca _mseds5a n nodrcnlaj cn nucmtdrmn mgtargn qua pdca sar ncdtncn ajencn astlmd.

Lrnu caJnturmcnca ca _mseds

EnrnetarstmensYrmgempnms

Nodrcnlaj cnNucmtdrmn Mgtargn

MglgudGaghujn nodrcnlajfdrjnb casagvdbvmcn pnrn nLastd ca _mseds.

Yrdjdva n Lastd ca _mseds asa onsamn gn Nvnbmnd ca_mseds cn prprmn nucmtdrmn.

EdgsemagtaNodrcnlaj pnrn n Lastdca _mseds cmsparsn ajsmbds.

Yrdjdva n nodrcnlajedrpdrntmvn cn Lastd ca_mseds a sa onsamn gnNvnbmnd ca _mseds ranbmzncnpabn prprmn nucmtdrmn.

Cafmgmcd

Astrntlmn a pdbtmensmjpbajagtncns aedjugmencns, Ermtrmds ca_msedcafmgmcds.

Fnembmtn n Lastd ca _mseds/_abnemdgn-sa edj n Lastd ca_mseds, a usn n Nvnbmnd ca_mseds ranbmzncn pabn cmrad/largemn qungcd nprdprmncd.

LaragemncdNodrcnlaj edrpdrntmvnpnrn n Lastd ca _mseds,casagvdbvmcn aedjugmencn.

Nucmtn d Yrdeassd ca Lastd

ca _mseds a utmbmzn n Nvnbmndca _mseds ranbmzncn pabncmrad/largemn edgfdrjanprdprmncd.

Hnombmtncd

Lastd ca _mseds aedgtrdbas mgtargdstdtnbjagta mgedrpdrncdss dparnas.

Nucmtn d Yrdeassd ca Lastdca _mseds a utmbmzn n Nvnbmndca _mseds ranbmzncn pabncmrad/largemn edgfdrjanprdprmncd.

Encn drlngmznd cava catarjmgnr edjd pratagca mjpbajagtnr/jabhdrnr n Lastd ca_mseds (prafaragemnbjagta ncdtngcd edjd rafargemn n gdrjn mgtargnemdgnb a ornsmbamrnGO_ MUD 5>999;?99= - Lastd ca rmseds - Yrmgepmds a cmratrmzas). Mssd nkucnr ncatarjmgnr ds Ermtrmds ca _mseda d gvab caJnturmcnca ca _msedscn drlngmznd. Ydraxajpbd, gaj tdcns ns ajprasns casaknrd ntmglmr edjpbatnjagta d lrnu ca

5Sarjd smjpbmfmencd qua utmbmznjds gd ^UY qungcd gds rafarmjds Jnturmcnca cn Lastd ca _msedsca ujn

drlngmznd.

http://www.iso31000qsp.org/2010/09/visualize-nova-nbr-iso-31000-de-gestao.htmlhttp://www.iso31000qsp.org/2010/09/visualize-nova-nbr-iso-31000-de-gestao.htmlhttp://www.iso31000qsp.org/2010/09/visualize-nova-nbr-iso-31000-de-gestao.htmlhttp://www.iso31000qsp.org/2010/09/visualize-nova-nbr-iso-31000-de-gestao.htmlhttp://www.iso31000qsp.org/2010/09/visualize-nova-nbr-iso-31000-de-gestao.html

5/26/2018 Auditoria Baseada em Riscos Aplicada a Sistemas de Gesto

8/8

N u c m t d r m n O n s a n c n a j _ m s e d s N p b m e n c n n U m s t a j n s c a L a s t d ?9>3, ^U

jnturmcnca Hnombmtncd, pdms tnbvaz taghnj qua pasnr ds eustds aj rabnd vmsd quatj cds oagafemds pdtagemnms. Enoa nbtn cmrad a aqumpa ca laragtas catarjmgnrajnt qua pdgtd cassa prdeassd edgtgud casaknrd ehalnr.

Nbj cn Jnturmcnca ca _msedscn drlngmznd, n axtagsd cn Nvnbmnd ca _mseds qua n

prprmn nucmtdrmn mgtargn mr ranbmznr, sa fdr d ensd, tnjoj capagca cd lrnu a cnvabdemcnca cns jucngns astrntlmens a drlngmznemdgnms.

Edgebusd

N Nucmtdrmn Onsancn aj _mseds ujn nodrcnlaj qua fdenbmzn ns quastas quaranbjagta mjpdrtnjpnrn n drlngmznd, aj qunbquar ran; Fmgngns, ^unbmcnca, JamdNjomagta, Ualurngn a Unca gd Srnonbhd, _aspdgsnombmcnca Udemnb, Edjpbmngea, ate.

N NO_ fdrgaea lnrngtmnsaj rabnd astruturn pnrn laragemnr rmseds cn ajprasn,pdssmombmtngcd qua n nucmtdrmn mgtargn sa bmlua cmratnjagta n assn astruturn a, cassn

fdrjn, pdtagemnbmza ns smgarlmns.

Enpnemta-sa gd ^UY(ebmqua gn fmlurn nemjn pnrn edghaear gdssdEursd ca Enpnemtnd a Eartmfmend aj Lastd ca _mseds - MUD 5>999)

http://www.qsp.org.br/capacitacao_gr.shtml