Contribuições da auditoria independente para a gestão de riscos relacionados à Lei Geral de Proteção de Dados

Abstract

This research aims to analyze the contributions of independent audit to risk management in LGPD. Thus, a multiple case study was conducted, descriptive in nature and qualitative approach to data. By means of three independent audit works carried out in LGPD programs, in companies that had implemented this program more than a year before, the audit planning and programs applied by the auditors were analyzed, as well as the risks identified by this application and the percentage quantifications of these events, which enabled the identification of improvement opportunities and the suggestion of action plans by the auditors. The results of the application of the proposed methodology show that independent auditing, by means of the NBC TA 500, enabled the structuring of an adequate plan of activity planning for the work performed, as well as adequately defined a set of auditing procedures applied in the work performed by the auditors. It was verified that the execution of the work carried out finds theoretical grounding in the NBC TA 300, presenting its conformity. Thus, it is possible to assess that, when quantifying the percentage of exposure risks to the LGPD, the auditors used the precepts of NBC TA 315 for their application. Regarding the cases analyzed, it was found that all organizations present some level of exposure to risks related to the LGPD. It was possible to conclude that independent auditing contributes to the structuring of an adequate risk management methodology, regarding the items recommended for data protection by the General Law of Data Protection (LGPD). The results of the research point to the fact that, through its technical standards, independent auditing contributes directly to the whole process of formalizing the audit work in risk management of the LGPD, which allows the identification and proper analysis of the events that represent risks to the audited organization. Thus, this research contributes to the advancement of the literature on risk management related to the LGPD, by providing new evidence about the roles of independent auditors in the risk management process, as well as highlighting how the existence of weaknesses in the control structure can result in violations related to this law.