Risk matrices as an information and communication technology audit planning mechanism: selection of government systems - Silva, Tiago Monteiro da (2019)
The large financial resources invested in technology in organizations should be evaluated by specific and well-planned audits using appropriate tools. This paper seeks to develop the Information Systems Risk Matrices within the State Executive Branch of Ceará, in order to meet the need for planning the specialized audits of Information and Communication Technology (ICT) of General Comptroller and Ombudsman’s Office (CGE/CE). The methodology used was a quantitative research based on a questionnaire sent by CGE/CE to forty entities of the Ceará State Government, which allowed the evaluation of 611 computerized systems. The result are tools that enables the objective classification of the most critical government systems, as well as which entities have the highest inclination to be audited by the CGE/CE. From this case study, we intend to encourage discussions related to ICT audit planning activities.