An analysis of the implementation of the Internal Audit Capability Model at DenaSUS, under the ProQuali

ABSTRACT

This is an experience report on the self-assessment of the maturity level of the National Audit Department of the Unified Health System (DenaSUS), based on the Internal Audit Capability Model (IA-CM) of the Brazilian Institute of Internal Auditors (IIA-Brazil). The study aims to share knowledge in order to promote the dissemination of an organizational culture focused on innovation and quality management in Brazilian Unified Health System (SUS) audits. It thus seeks to contribute to the joint and sustainable construction of actions that strengthen professional ethics in the public performance of the auditing function, with a view to controlling the application of public resources and the actions offered through the policies and programs carried out within the scope of the SUS. Under a qualitative-quantitative approach, processes and data resulting from the application of different methodological resources were analyzed, such as bibliographical research, focus groups, dialogues presentations, the construction of risk and maturity spreadsheets, as well as the evaluation of work plans. As a result, the study aims to promote the dissemination of knowledge by identifying and analyzing the limitations and challenges faced by DenaSUS in implementing the IA-CM, with a view to replicating the methodology by other government entities.

KEYWORDS
Self-assessment; Quality; Healthcare audit; Organizational culture; IA-CM.

RESUMO

Trata-se de um relato de experiência referente à 1ª Autoavaliação do grau de maturidade do Departamento Nacional de Auditoria do Sistema Único de Saúde (DenaSUS), do Ministério da Saúde, com base no Modelo de Capacidade de Auditoria Interna (IA-CM), do Instituto dos Auditores Internos do Brasil (IIA). O estudo tem como objetivo compartilhar conhecimentos para promover a disseminação de uma cultura organizacional voltada à inovação e à gestão da qualidade das auditorias do Sistema Único de Saúde (SUS). Busca, assim, contribuir para a construção conjunta e sustentável de ações que fortaleçam a ética profissional na atuação pública da função de auditoria, com vistas ao controle da aplicação dos recursos públicos e das ações ofertadas por meio das políticas e programas executados no âmbito do SUS. Sob uma abordagem qualiquantitativa, foram analisados processos e dados resultantes da aplica-ção de diferentes recursos metodológicos, tais como pesquisas bibliográficas, grupos focais, exposições dialogadas, construção de planilhas de risco e de maturidade, além da avaliação dos planos de trabalho. Como resultado, o estudo pretende promover a disseminação do conhecimento a partir da identificação e análise das limitações e dos desafios enfrentados pelo DenaSUS na implementação do IA-CM, visando à replicabilidade da metodologia por outros entes governamentais.

PALAVRAS-CHAVE
Autoavaliação; Qualidade; Auditoria em saúde; Cultura organizacional; IA-CM.

Introduction

The National Audit Department of the Unified Health System (DenaSUS) of the Brazilian Ministry of Health plays a fundamental role in proposing improvements in risk management processes, internal controls, integrity, and governance of policies, programs, actions, and services. These initiatives aim to improve the efficiency, effectiveness, and efficacy of SUS management, as established in Article 12 of Annex I of Decree No. 11,798, of November 28, 2023¹. In addition to these responsibilities, it acts as the central body of the National Audit System (SNA) of the SUS, being responsible for the development of regulations and standardizations that guide best practices in the performance of internal audits of the SUS at the state, Federal District, and municipal levels, according to Decree No. 1,561, of September 28, 1995².

In this context, the Ministry of Health instituted, on February 27, 2024, the Program for Management and Improvement of the Quality of Internal Audit Activities of the SUS (ProQuali), through Ordinance No. 3,130, of January 30, 2024³, as a strategic measure to promote the quality and efficiency of governmental internal audit activities. This initiative is aligned with Decree No. 9,203, of November 22, 2017⁴, which establishes the governance policy of the federal public administration, which determines, in its article 18, that government internal auditing should add value and improve the operations of organizations, contributing to the achievement of their objectives, as well as evaluate and improve the effectiveness of risk management, control and governance processes, in accordance with internationally recognized standards of auditing and professional ethics⁵.

These standards and norms guide the performance of internal auditors, establishing quality criteria and good practices to be followed, thus ensuring compliance with the standards regarding the credibility and reliability of internal audits in the Brazilian public sector⁶.

ProQuali was conceived as a strategic action of the Ministry of Health, aimed at implementing permanent activities for quality assessment, generation of management information and promotion of continuous improvement of the internal audit of the SUS.

The understanding published in the Journal of the Comptroller General of the Union (CGU) regarding the DenaSUS Quality Program points to its structure focused on internal and external evaluations that encompass different dimensions of the audit activity, with the internal ones aiming to verify the conformity of the Department’s performance with the established normative, ethical, technical, and operational standards⁷.

The assurance of the Program promotes the verification of internal audit procedures in the SUS regarding the fulfillment of its institutional purpose, whether the work processes are in accordance with the norms and procedures established by DenaSUS, and whether they meet nationally and internationally recognized audit standards. In addition, the Program evaluates whether the ethical and professional conduct of the auditors and the effectiveness of the actions aimed at the development of the SUS National Audit System are present in the work processes.

Auditing, as a component of governance, must be subject to quality assessments to ensure that its results effectively contribute to institutional strengthening in the public sector⁸.

Also within the scope of the Program, the publication of Ordinance No. 3,130/2024 made it clear that the methodology for evaluations was established to identify the level at which DenaSUS is at, in order to then develop strategies for advancement in the maturity scale of its processes and professionals.

Thus, DenaSUS carried out the 1st Self-Assessment of the maturity of the audit function in the period from February to May 2025, based on a methodology developed by the Institute of Internal Auditors Foundation (IIA)⁹, called the Internal Audit Capability Model (IA-CM), focusing on achieving Level 2 maturity (Infrastructure).

This methodology served as a framework for the assessments carried out, seeking to measure compliance with the essential activities foreseen in ten key process areas - called Key Process Areas - KPAs - especially regarding their existence and institutionalization, based on the hypothesis that the Department did not yet fully meet the requirements of this level.

In addition, the model is organized in a matrix that presents 5 maturity levels, 6 fundamental elements of the audit and 41 key process areas, distributed among these levels and elements. Each KPA has its own objective and describes the essential activities that must be performed and maintained over time. Achieving a certain level of maturity requires that all macro-processes corresponding to that level are fully implemented and incorporated into the culture of the internal audit unit.

By presenting the development and preliminary results of the DenaSUS self-assessment process, aiming to serve as a reference to be replicated by other government internal audit bodies, the study aims to share knowledge that promotes an organizational culture focused on innovation and quality management of audits in the SUS. Thus, it seeks to build, in a joint and sustainable way, best practices that strengthen the audit function, aligning with international standards with a focus on strengthening governance and generating public value in health policies and programs.

Material and methods

This article adopts a qualitative approach, related to the analysis of documents that evidenced the existence and institutionalization of KPAs. To this end, it uses bibliographic research, that is, secondary sources of information, especially the results measured by the evaluation teams of the process and contained in the Action Plan for addressing items that are still non-existent and/or not implemented.

Intertwining ProQuali and the IA-CM Methodology

The connection between ProQuali and the Internal Audit Capability Model is profound, since Ordinance No. 3,130/2024 is the driving force behind the program, which is supported by the IA-CM⁹ evaluation methodology. This strategically conceived drive forces DenaSUS/MS to seek, or rather, to reach Level 2 of maturity in governmental internal auditing, since any institution developing internal audit activities whose compliance is inconsistent with the requirements of the methodology falls into Level 1.

This intertwining, evidenced in the context of the 1st Self-Assessment, allowed us to describe the experience of the process lived by DenaSUS, articulating the methodology employed with ProQuali, starting from the formal institution of the Program and the elaboration of its manual, a guiding instrument for institutional alignment and the adoption of IA-CM as a reference for maturity in auditing.

Subsequently, the ProQuali Launch Seminar was held on August 7, 2024, at the headquarters of the Pan American Health Organization (PAHO), in Brasília/DF. The event was attended by representatives from the Office of the Minister of Health, the Executive Secretariat, the National Health Council, the CGU, as well as DenaSUS employees.

In order to strengthen the technical understanding of the methodology, benchmarking was carried out with public organizations of the Executive and Judiciary branches that already adopt IA-CM. These experiences allowed for the exchange of good practices and lessons learned to support implementation at DenaSUS.

In parallel, four in-person meetings called ‘Coffee with Quality’ were held in Fortaleza/CE, Belo Horizonte/MG, Recife/PE, and Brasília/DF in 2024, aligning concepts about IA-CM among the auditors who make up the Department’s workforce. Concurrently, the participation of DenaSUS employees in the course ‘Internal Audit from a Governmental Perspective and the IA-CM Maturity Tool’ promoted by the CGU was encouraged.

To conduct the internal self-assessment aimed at verifying the level of institutional maturity, a Quality Committee was established, in addition to the preparation of a preliminary project for the implementation of IA-CM. The proposed methodology involved the organization of working groups divided according to the six structuring elements of the model matrix, namely:

• Services and Role of Internal Audit.

• People Management.

• Professional Practices.

• Performance Management and Accountability.

• Organizational Culture and Relationships.

• Governance Structures.

In this context, the methodology adopted aimed to verify the existence and institutionalization of the essential activities of the internal audit function, as foreseen in the ProQuali Ordinance. To this end, members of the Quality Commission and other civil servants who had already completed the IA-CM course participated, totaling 26 participants. The methodological proposal included subdivision into five working groups, each responsible for one of the essential elements of each KPA of Level 2 of the IA-CM matrix. Each group was responsible for identifying, gathering, and organizing documentary evidence demonstrating compliance with the criteria of ‘existence’ and ‘institutionalization’. This organization was adapted to the IA-CM model, designed to be applied through an internal evaluation carried out by the internal audit team or by designated professionals within the organization^10,11. The collected evidence was systematized in an exclusive repository on the Ministry of Health’s internal network, with access restricted to those involved in the project. It is worth highlighting that the work was developed in a collaborative and integrated manner, without practical distinction between focal points, favoring a dynamic flow of interactions and sharing of responsibilities.

In addition, a monitoring spreadsheet was structured for each group, allowing for an integrated view of the status of each KPA’s fulfillment, through a progress map of the self-assessment, which was carried out over five weeks, in a hybrid format (online and in-person), as shown in table 1.

Table 1
Schedule of the 1st Self-Assessment of DenaSUS/MS

Schedule
Essential Axes
	Internal Audit Service and Role	People management	Professional practices	Performance management and accountability	Organizational culture and relationships	Governance structures
KPAs
Week 1 Gathering evidence (from 03/10/25 to 03/14/25)	2.1	2.2	2.4	2.6	-	2.9
Week 2 Gathering of Evidence (03/24/2025 to 03/28/25)	-	2.3	2.5	2.7	2.8	2.10
Week 3 Analysis (from 04/07/25 to 04/11/25)	2.1	2.2	2.4	2.6	-	2.9
Week 4 Analysis (from 05/19/25 to 05/23/25)	-	2.3	2.5	2.7	2.8	2.10
Week 5 Analysis (from 05/28/25 to 05/30/25)				2.5 e 2.6	2.7 e 2.8	2.9 e 2.10

In cases where the KPA requirements were not met, each group developed a specific action plan using the 5W2H methodology. This plan details the task to be performed, its justification, location of execution, schedule, responsible parties, method of execution, and cost estimate. These plans were also included in the repository, duly linked to their respective KPAs to enable monitoring of the project’s progress.

For conducting the self-assessment, the risks associated with the implementation of IA-CM were mapped, based on the concept used by the CGU, according to which risk is defined as the possibility of an event occurring that has an impact on the achievement of the organization’s objectives¹³.

In the context of the IA-CM implementation project, the identification of factors that could compromise the achievement of strategic, technical and operational objectives was considered. From the application of the aforementioned methodology, risks were identified, as shown in graph 1, from which a Mitigation Plan was established, which includes specific actions for the most relevant risks, ensuring that these are not only known, but also dealt with in a planned and preventive manner.

Graph 1
Risks of the ProQuali Implementation Project

Results and discussion

This essay discusses leadership, decision-making, and coordination of actions as central elements of health system management. The aforementioned scoping review identified governance, leadership, financing, and resources as key issues for studies on resilience in the SUS¹⁴.

In this context, ProQuali facilitated the adoption of IA-CM as a structuring tool for continuous improvement. The initiative aims to achieve Level 2 maturity, which will be reached when all KPAs are properly met and effectively institutionalized for the entire operation of the SUS audit. Effective management of the public sector has historically been a challenge, especially because it does not rely solely on financial indicators as an evaluation criterion¹⁵.

Box 1 depicts the arrangement of KPAs by maturity levels and relates them to the six work axes. The intersection of these with those results in the macro-processes corresponding to level 2, highlighted by the red line.

Box 1
IA-CM Matrix

	Services and role of Internal Audit	Process management	Professional practices	Performance management and accountability	Organizational culture and relationships	Governance structure
Level 5 Optimization	Internal Audit recognized as a key change agent KPA 34	Leadership in engagement KPA 35	Continuous improvement of professional practices KPA 37	Public report on effectivenessKPA 39	Effective and lasting relationshipsKPA 40	Independence, power and authority of Internal Audit KPA 41
		Workforce projection KPA 36	planning strategy KPA 38
Level 4 Managed	Ensuring governance, risk management and controls KPA 26	Internal Audit contributes to management development KPA 27	Audit strategy leverages organizational risk management KPA 30	Integration of qualitative and quantitative performance measures KPA 31	CAE advises and influences senior management KPA32	Independent supervision of internal audit activities KPA 33
		Internal Audit supports professional bodies KPA 28
		Workforce planning KPA 29
Level 3 Integrated	Advisory services KPA 11	Team building and skills development KPA 13	Quality Management Framework KPA 16	Performance measures KPA 18	Coordination with other review groups KPA 21	Managerial supervision of the KPA 23 Internal Audit activity KPA 23
		Professionally qualified staff KPA 14		Management reports KPA 19		Financing mechanisms KPA 24
	Performance audits KPA 12	Workforce coordination KPA 15	Risk-based audit plans KPA 17	Information on costs KPA 20	Integral component of the management team KPA 22	CAE informs the highest level authorityl KPA 25
“Level 2 Infrastructure	Compliance audit KPA 1	Professional Development KPA 2	Framework of professional practices and processes KPA 4	Operational Budget KPA 6	Management within the Internal Audit activity KPA 8	Full access to the organization’s information, assets, and people KPA 9
		Skilled individuals are identified and recruited KPA 3	Audit plan based on management and stakeholder priorities KPA 5	Business plan KPA 7		Audit report workflow prepared KPA 10
Level 1 Initial	Ad hoc, unstructured; isolated audits or review of documents and transactions for the purpose of verifying compliance; products depend on specific skills of individuals in the positions; absence of established professional practices; lack of structure; lack of capacity; absence of KPAs.

Thus, the IA-CM is internationally recognized as an essential tool for strengthening governance, risk management, and control in the public sector, as well as guiding the continuous improvement of audit practices. Its purpose is to offer the application a consistent and objective framework for assessing the maturity of internal auditing, regardless of the sector or size of the organization¹⁰, cited by Ferrer¹¹.

The IA-CM⁹ offers a path for organizations to develop their internal audits strategically, increasing their value and contribution to the efficiency, effectiveness, and integrity of public administration. This allows organizations to use it to identify structural gaps and define an action plan to improve the internal audit function¹¹. The result is a reflection of evolutions in professional practices, stakeholder expectations, and the governmental environment.

In this context, the execution of the self-assessment made it possible to observe the relevant limitations that directly impacted the schedule and conduct of the evaluation process. The main one was the effective absence of participation from the senior management of DenaSUS, whose role was foreseen as a strategic component of the project. The participation of the institutional leadership was essential for the agreement on actions and validation of results. However, recurring agenda conflicts, coupled with the prioritization of other administrative and political demands, hindered the involvement of key decision-makers. This limitation compromised the flow of planned agreements, requiring the extension of the initially defined deadlines and the replanning of stages in order to guarantee the continuity of the initiative.

Another important limitation identified during the process was the diversity of understandings surrounding the IA-CM⁹ methodology. There was some unevenness among the actors involved regarding the interpretation of concepts and the identification of the essential activities of the KPAs. This misalignment required additional discussion time, especially during the agreement with the coordinators of the evaluated areas. Although these discussions are relevant to collective development, they also required adjustments to the schedule and methodological redirections to ensure the consistency of the analysis and the legitimacy of the validation process.

Despite the challenges faced, the benefits of adopting IA-CM⁹ outweigh the difficulties. The significant engagement and dedication of the technical evaluators involved in the self-assessment process stood out. This technical mobilization was essential to mitigate the impacts of the limitations observed, ensuring the analysis of KPAs, the collection of evidence, and the construction of a consistent and technically sound institutional diagnosis. As a positive point, this experience strengthened the technical leadership of the DenaSUS teams, creating a favorable precedent for the institutionalization of the culture of evaluation and quality.

The results of the self-assessment allowed for a systematic mapping of the current maturity level of the Department required for Level 2 (Infrastructure). The results of the self-assessment are presented below according to each KPA.

KPA 2.1 - Compliance Audit

Self-assessment highlighted relevant practices, such as the formalization of audit planning, the definition of criteria, scope and methodologies, as well as the application and documentation of audit procedures. Initiatives such as the Audiética project also demonstrate the strengthening of an ethical culture in the teams’ performance. On the other hand, the following weaknesses were identified:

• Lack of distinction between compliance audit and inspection;

• Lack of formal acceptance of audit criteria by managers;

• Gap in the systematization of risk assessment and internal controls of the audit subject; and

• Lack of institutionalized monitoring of recommendations.

The evidence relating to this key process points to the need to review and update the regulations and manuals of the audit process, strengthen communication with managers (audited units), and implement practices aligned with international standards.

KPA 2.2 - Qualified personnel identified and trained

Self-assessment demonstrated that DenaSUS has descriptions in its manuals and guidelines defining the duties and responsibilities of auditors. It has internal selection procedures, based on a survey of general duties, to support the internal recruitment process for staff. However, regarding the institutionalization of essential activities, the need for updating and systematizing guidelines related to the audit function was evident. The need to update the basic competencies required for performing internal audit activities within the SUS (Unified Health System) was also identified.

With regard to the essential activity concerning the job description for positions/jobs in DenaSUS, these criteria are met under the assessment of existence, according to Decrees No. 12,489, of June 4, 2025¹⁶, and No. 6,552, of September 1, 2008¹⁷, which provide for positions, functions and bonuses corresponding to the Directorate; to the team members, coordinator and supervisor; heads of the SNA in the States and head of the DF Section; general coordinators and coordinators.

However, the self-assessment made it possible to show that this structure does not reflect, in practice, the equivalence between the relevance of the leadership function, as is the case of the DF Section, which does not have a formally defined supervisory position, in contrast to the other units in the other states. In addition, the position of trust attributed to the head of the Section is hierarchically inferior to that of the heads of the Services. This asymmetry demonstrates the need to review the organizational structure, in order to ensure consistency between the functions performed, the roles assigned, and the corresponding recognition.

Regarding the provision of professionals, the existence of an internal selection process with minimum criteria defined in public notices was verified. However, with regard specifically to the selection for management positions (such as supervisors, area coordinators, and heads of Services and Sections), there is an absence of a specific normative instrument that establishes minimum requirements and objective criteria for appointment.

KPA 2.3 - Individual professional development

This KPA establishes that internal audit activity must implement a systematic and structured process of continuous professional development, based on a periodic analysis of competency gaps and the needs of the audit unit. In the context of DenaSUS, although there is a regulatory provision for a minimum annual training workload (40 hours per auditor), the absence of formal control mechanisms, integrated planning with the People Development Plan (PDP), and evaluation of the effectiveness of the training/development actions carried out demonstrates a misalignment with the central requirements of this key process.

Despite the existence of diverse sources of training, resulting from partnerships with public academic institutions and government agencies, these initiatives occur in isolation and without effective articulation for the fulfillment of the Annual Audit Plan (PAA). The lack of a periodic control system for development actions (training, education, and capacity building) per auditor hinders the adoption of best professional practices and the advancement of institutional maturity in this aspect.

Finally, another aspect of weakness is the ineffectiveness of communication regarding the people development process and the low level of active leadership involvement in auditor training, evidenced by the lack of systematic communication about the need to fulfill training hours and the benefits of professional associations.

KPA 2.4 - Audit plan based on management priorities and stakeholders

This KPA aims to establish an audit plan that is guided by management and stakeholder priorities, based on the identification of needs and agreements within the scope of internal auditing. In DenaSUS, the PAA is the management instrument concerning annual planning and has the potential to address this KPA, insofar as it fulfills the requirements for existence and institutionalization related to policies, norms, guidelines, and manuals.

The self-assessment of the IA-CM’s maturity revealed certain weaknesses, such as the lack of coordination between the Department’s management and the agency’s senior management and other stakeholders in the internal audit process. However, it is envisioned that, following the publication of the SUS Internal Audit Manual, guidelines and orientations will be established for better development of objectives, qualification of the object and scope for each audit work, within the scope of periodic planning, including training for the teams responsible for carrying out the work.

Several tasks were included in the action plan, among which the following stand out:

• Include in the Manual, or other suitable instrument, the guidelines and orientations that advocate the identification, documentation, and review of the Audit Universe, making it included in the PAA as a preliminary step for defining the objects to be audited based on the risk assessment;

• Reaffirm by means of an official letter the legal obligation for timely approval of the PAA and the legal deadline;

• Schedule an alignment meeting with the Offices and sectors involved (SE/Office/Subsecretariats);

• Include in the IA-CM monitoring meeting an analysis of the PAA deadlines;

• Develop a (computerized) system for managing the audit activity that includes a mechanism for standardizing the process of estimating the amount of resources needed, containing fixed costs, variable costs, direct costs, and indirect costs of the activity;

• Publish the PAA with the respective resource forecasts;

• Formalize all initiatives undertaken by the Department in order to obtain external collaboration.

KPA 2.5 - Professional practice and process frameworks

This concerns the establishment of standardized structures to support the deployment and implementation of continuous improvements in government internal audit processes and professional practices, as a performance indicator of the Quality Program established in the Department. Thus, the purpose of this KPA is to seek possibilities for DenaSUS to have formal and accessible structures that favor the performance of work with independence, objectivity, competence and diligence by professionals in order to ensure that the internal regulations and rules of the audit area are observed, such as manuals and technical guidelines, the code of ethics, international standards and good practices observable through benchmarking.

In this context, it became evident during the self-assessment process that there is a need for knowledge management within the Department, thus understanding that it is necessary to establish means for the preservation of the intellectual and symbolic capital produced, and to establish mechanisms for the safekeeping and curation of organizational process assets, standards, models, guides and validated procedures, as a reliable source of research that can lead to sustainable standardization, with a view to continuously improving processes and professional practices.

Finally, to comply with the IA-CM model, DenaSUS must, among other things:

• Develop and institutionalize an annual schedule of mandatory training on ethical and normative principles related to SUS Auditing for DenaSUS employees;

• Disseminate information and broaden its reach to all DenaSUS employees;

• Launch an internal communication campaign on the mandatory nature of the regulations;

• Update internal regulations, manuals, processes, and guidelines related to auditing, explicitly mentioning the mandatory nature of international and national regulations;

• Expand the dissemination of publications of the ordinances for the preparation and approval of the PE and PAA. Include all employees in their development;

• Establish a routine for periodic verification of the implementation of recommendations;

• Publish an institutional report with results and status of compliance with recommendations.

KPA 2.6 - Internal Audit Business Plan

The business plan was developed as a technique to better structure the actions of the future activity to be implemented by an institution. However, DenaSUS, by virtue of Law No. 8,689/1993¹⁸, Law No. 8,080/1990¹⁹ and Decrees No. 1,651/1995², No. 9,795/2019²⁰ and No. 11,798/2023¹, contributed to the creation and regulation of the Department.

Corroborated by the understandings of the National Council of Internal Control (CONACI), DenaSUS fulfills practically all the requirements, needing only some adjustments in its Strategic Planning to fully comply with the aforementioned KPA.

KPA 2.7 - Internal Audit Operating Budget

The Department has a budget line item for the performance of its core objectives. However, the connection to the Health Ministry’s budget and the structure in which DenaSUS is currently embedded do not allow it to manage its own independent budget.

Another point identified is the lack of structure in the Department regarding quantitative analyses of the costs of its activities, whether in the promotion of the SNA or in the audits carried out. Issues regarding direct, indirect, fixed, and variable costs are not addressed, both due to a lack of technique and a lack of culture, reflected in the audit admissibility processes that only include three items: Competence, Relevance, and Materiality.

KPA 2.8 - Management within the internal audit activity

The association of this KPA is given by the focus on the management effort of the government internal audit activity in its own operations and relationships within the activity itself, such as organizational structure, people management, budget preparation and monitoring, annual planning, providing the necessary technology and audit tools, and conducting audits. Interactions with organizational managers are focused on conducting the business of the internal audit activity.

In this sense, the Department has a formal structure that fits the premises guided by the KPA, but which, in practice, maintains a certain distance from the level required by the IA-CM methodology, with the actions of the essential activities for the management of the internal audit activity still immature.

KPA 2.9 - Established audit reporting flow

The Department has established reporting flows in its technical guidelines; however, these require updates and adaptations to the requirements of international auditing standards.

Actions in this regard have been taken, and, due to the need to comply with the requirements for meeting this KPA, DenaSUS is directing efforts to ensure that the aforementioned updates and adaptations are made within the perspective of the methodology advocated by IA-CM this year.

KPA 2.10 - Full access to information, assets, and people

Portrayed as one of the greatest weaknesses of DenaSUS, full access to information, assets, and personnel of the Ministry of Health is difficult, fragile, and incomplete. This KPA guides the auditor’s performance in the exercise of their function to be direct, consistent, and complete.

In this sense, the Department’s managers are able to request from the highest authority of the Agency access to the ideal conditions for the full performance of governmental internal audit activities.

The result of the evaluations of each KPA is the close link between the essential activities that compose them, which demonstrates a strong interrelationship in the overall result of the degree of adherence to the practices imposed by IA-CM for achieving Level 2. This implies that the solution of an essential activity contributes significantly to the solution of others, in various KPAs, and the opposite is also true (the non-fulfillment of an essential activity contributes significantly to the non-solution of others, in various KPAs).

The result of the 1st Self-Assessment using the IA-CM model resulted in a ‘heat map’ regarding the existence and institutionalization of the KPAs, highlighting, at that time, the distance that DenaSUS was from its main objective - achieving Level 2 of maturity in the internal governmental audit processes of the SUS.

Despite this distance, interconnections were identified between the essential activities of the KPAs, so that the non-fulfillment of an activity in a given KPA can compromise the fulfillment of others in different KPAs, just as its fulfillment can favor the fulfillment of activities in other KPAs.

Table 2 visually demonstrates the result of the 1st Self-Assessment:

Table 2
Heat map referring to the result of the 1st self-assessment based on the IA-CM methodology of DenaSUS/MS

	KPA	ESSENCIAL ACTIVITIES															% of KPA		% of total
LEVEL 2	KPA 2.1 (Compliance Audit)	2	3,1	3,2	3,3	3,4	3,5	3,6		3,7	4,1	4,2	4,3	4,4	5,1	5,2	7,14%		12,22%
	KPA 2.2 (Qualified Personnel Identified and Recruited)	2,1	2,2	3,1	3,2	4,1	4,2	5		6							0,00%
	KPA 2.3 (Individual Professional Development)	2,1	2,2	3	4,1	4,2	5,1	5,2		6,1	6,2						0,00%
	KPA 2.4 (Audit Plan based on management and stakeholder priorities)	2,1	2,2	2,3	2,4	3	4	5		6	7,1	7,2	8,1	8,2	9		23,08%
	KPA 2.5 (Professional Practices and Processes Framework)	2,1	2,2	3	4	5,1	5,2	6		7,1	7,2	8	9				9,09%
	KPA 2.6 (Internal Audit Business Plan)	2,1	2,2	3,1	3,2	4	5	6,1		6,2	7,1	7,2					0,00%
	KPA 2.7 (Internal Audit Operational Budget)	2,1	2,2	3	4,1	4,2	5,1	5,2									57,14%
	KPA 2.8 (Management within the AI ​​Activity)	2	3	4	5	6	7										16,67%
	KPA 2.9 (Established audit reporting flow)	2,1	2,2	3	4	5	6,1	6,2		7							12,50%
	KPA 2.10 (Full access to the organization's information, assets, and people)	2	3	4	5												0,00%
									2 no (existence and institutionalization)
									1 yes and 1 no (existence and institutionalization)
									2 yes (existence and institutionalization)
Source: 1st Self-Assessment of the IA-CM of DenaSUS/MS, from May 19 to May 13, 2023.

Graphically, the essential activities can be represented in graph 2.

Graph 2
Percentage of essential activities being carried out

Fulfillment of essential activities is a sine qua non condition for achieving Level 2 of the maturity level of the DenaSUS governmental internal audit activity - and will serve as the basis for analysis by the external evaluator, who has the final say in validating compliance with all requirements of the IA-CM methodology.

Final considerations

The experience of implementing IA-CM at DenaSUS represents an institutional milestone in strengthening the internal capacity of SUS auditing. The intersectoral effort, spearheaded by the Audit Quality Coordination (COQUALI), the General Coordination of Evaluation, Quality and Special Audits (CGESP), and the Quality Commission, enabled not only the technical application of the methodology but, above all, the cultural mobilization necessary for the institutionalization of the model.

The review of the practices adopted by DenaSUS in light of the IA-CM methodology during the self-assessment process constitutes a valuable opportunity in proposing an action plan, which aims to resolve the outstanding service issues, both in terms of the existence and institutionalization of the essential activities of each KPA.

Thus, the 1st self-assessment allowed us to verify that the Department is at Level 1 (Initial) of the IA-CM, with a great possibility of incorporating the non-existent essential activities and promoting their institutionalization in the organizational culture, considering that this is one of the objectives foreseen in the strategic planning of DenaSUS (2024-2027) and that the path has already begun to be followed, starting from the self-assessment as a measure for implementing ProQuali.

To achieve this, the following are essential requirements: strengthening governance, visible leadership commitment as a way to influence the institutional environment²¹, continuous development of team skills, standardization and institutionalization of audit practices, and the promotion of an organizational culture oriented towards quality, integrity and continuous improvement, as actions foreseen in the action plan resulting from the self-assessment.

Meeting the requirements favors decision-making, correction of failures and continuous improvement of processes, resulting in greater efficiency in the use of public resources and greater effectiveness in the quality of services provided to the population⁶.

It is expected, therefore, that the implementation of IA-CM will strengthen the role of DenaSUS as an internal audit unit, with the potential to influence its adoption throughout the SNA. This advancement may contribute to the components of the SNA acting in a way that is more aligned with the typical functions of internal auditing, and not as instances of internal control. This is, in fact, the function that DenaSUS is responsible for performing, according to an understanding already consolidated by the Federal Court of Accounts, through Ruling No. 1246/2027.

• Financial support:
  Non-existent

Data availability:

The research data are contained in the manuscript itself

References

• ¹ Presidência da República (BR). Decreto nº 11.798, de 28 de novembro de 2023. Aprova a Estrutura Regimental e o Quadro Demonstrativo dos Cargos em Comissão e das Funções de Confiança do Ministério da Saúde e remaneja e transforma cargos em comissão e funções de confiança [Internet]. Diário Oficial da União, Brasília, DF. 2023 nov 28 [acesso em 2025 jun 11]; Seção I:1. Disponível em: https://www.planalto.gov.br/ccivil_03/_ato2023-2026/2023/decreto/d11798.htm
  » https://www.planalto.gov.br/ccivil_03/_ato2023-2026/2023/decreto/d11798.htm
• ² Presidência da República (BR). Decreto nº 1.561, de 28 de setembro de 1995. Regulamenta o Sistema Nacional de Auditoria no âmbito do Sistema Único de Saúde [Internet]. Diário Oficial da União, Brasília, DF. 1995 set 29 [acesso em 2025 jun 11]; Seção I:15196. Disponível em: https://www.planalto.gov.br/ccivil_03/decreto/1995/d1651.htm
  » https://www.planalto.gov.br/ccivil_03/decreto/1995/d1651.htm
• ³ Ministério da Saúde (BR), Gabinete da Ministra. Portaria GM/MS nº 3.130, de 30 de janeiro de 2024. Institui o Programa de Gestão e Melhoria da Qualidade da Atividade de Auditoria Interna do Departamento Nacional de Auditoria do SUS - ProQuali. Diário Oficial da União [Internet], Brasília, DF. 2024 fev 27 [acesso em 2025 jun 11]; Edição 39; Seção I:87. Disponível em: https://www.in.gov.br/en/web/dou/-/portaria-gm/ms-n-3.130-de-30-de-janeiro-de-2024-545107755
  » https://www.in.gov.br/en/web/dou/-/portaria-gm/ms-n-3.130-de-30-de-janeiro-de-2024-545107755
• ⁴ Presidência da República (BR). Decreto nº 9.203, de 30 de novembro de 2017. Dispõe sobre a política de governança da administração pública federal direta, autárquica e fundacional [Internet]. Diário Oficial da União, Brasília, DF. 2017 nov 23 [acesso em 2025 jun 11]; Seção I:3. Disponível em: https://www.planalto.gov.br/ccivil_03/_ato2015-2018/2017/decreto/d9203.htm
  » https://www.planalto.gov.br/ccivil_03/_ato2015-2018/2017/decreto/d9203.htm
• ⁵ The Institute of Internal Auditors. Normas Globais de Auditoria Interna [Internet]. Lake Mary, FL: The IIA; 2024 [acesso em 2025 jun 11]. Disponível em: https://iiabrasil.org.br/korbilload/upl/editorHTML/uploadDireto/globalinternala-editorHTML-00000008-07052024134230.pdf
  » https://iiabrasil.org.br/korbilload/upl/editorHTML/uploadDireto/globalinternala-editorHTML-00000008-07052024134230.pdf
• ⁶ Borges A. Auditoria Interna no setor público. In: Ferrer PT, organizadora. A Governança e a auditoria interna no setor público. [local desconhecido: editora desconhecida]; 2024. p. 65.
• ⁷ Medeiros ADA, Rodrigues AA, Deolindo EMO, et al. Fortalecendo a qualidade na auditoria interna para promover a integridade pública: o papel do programa de gestão e melhoria da qualidade do DenaSUS. Rev CGU. 2024;16(30):175-8. DOI: https://doi.org/10.36428/revistadacgu.v16i30.735
  » https://doi.org/10.36428/revistadacgu.v16i30.735
• ⁸ Farias GO, Van Bellen HM. Avaliação da qualidade interna da auditoria interna: uma análise do modelo de capacidade de auditoria interna para o setor público - IA-CM. Rev Adm Pública. 2020;54(6):1545-65. DOI: https://doi.org/10.1590/0034-761220180296
  » https://doi.org/10.1590/0034-761220180296
• ⁹ The Institute of Internal Auditors Foundation. Modelo de Capacidade de Auditoria Interna para o Setor Público (IA-CM) [Internet]. Tradução e adaptação por IIA Brasil. [local desconhecido]: IIA Brasil; 2009 [acesso em 2025 jun 11]. Disponível em: https://iiabrasil.org.br/korbilload/upl/editorHTML/uploadDireto/macraeptbrsumar-editorHTML-00000010-26112019121845.pdf
  » https://iiabrasil.org.br/korbilload/upl/editorHTML/uploadDireto/macraeptbrsumar-editorHTML-00000010-26112019121845.pdf
• ¹⁰ Marinho D. Auditoria Interna no Setor Público. In: Ferrer PT, organizador. A Governança e a auditoria interna no setor público. [local desconhecido: editora desconhecida]; 2024. p. 68.
• ¹¹ Ferrer PT. A Governança e a auditoria interna no setor público: uma avaliação pelo método IA-CM nas entidades governamentais federais localizadas no Estado do Pará [dissertação]. 2024. Belém: Núcleo de Altos Estudos Amazônicos, Universidade Federal do Pará, Belém, 2024. 160 f.
• ¹² Ministério da Saúde (BR). Manual do Programa de Gestão e Melhoria da Qualidade da Atividade de Auditoria Interna - ProQuali. Brasília, DF: Ministério da Saúde; 2024.
• ¹³ Ministério da Transparência (BR); Controladoria-Geral da União. Gestão de Risco da CGU: formação de multiplicadores [Internet]. Brasília, DF: CGU; 2017 [acesso em 2025 jun 11]. Disponível em:https://repositorio.cgu.gov.br/bitstream/1/74061/1/Apresentacao_Formacao_de_Multiplicadores.pdf
  » https://repositorio.cgu.gov.br/bitstream/1/74061/1/Apresentacao_Formacao_de_Multiplicadores.pdf
• ¹⁴ Paschoalotto MAC, Lazzari EA, Castro MC, et al. A resiliência de sistemas de saúde: apontamentos para uma agenda de pesquisa para o SUS. Saúde Debate. 2022;46(Esp 8):156-70. DOI: https://doi.org/10.1590/0103-11042022E812
  » https://doi.org/10.1590/0103-11042022E812
• ¹⁵ Luís IEP, Ribisse JRB, Cumbe L. Os determinantes da eficácia da auditoria Interna no sector público de Moçambique. ALBA-ISFIC Res Sci J. 2025;1(7):59-74.
• ¹⁶ Atos do Poder Executivo (BR). Decreto nº 12.489 de 4 de junho de 2025. Altera o Decreto nº 11.798, de 28 de novembro de 2023, que aprova a Estrutura Regimental e o Quadro Demonstrativo dos Cargos em Comissão e das Funções de Confiança do Ministério da Saúde e remaneja e transforma cargos em comissão e funções de confiança [Internet]. Diário Oficial da União, Brasília, DF. 2025 jun 5 [acesso em 2025 jun 11]; Edição 105; Seção I:1. Disponível em: https://www2.camara.leg.br/legin/fed/decret/2025/decreto-12489-4-junho-2025-797553-publicacaooriginal-175558-pe.html
  » https://www2.camara.leg.br/legin/fed/decret/2025/decreto-12489-4-junho-2025-797553-publicacaooriginal-175558-pe.html
• ¹⁷ Presidência da República (BR). Decreto nº 6.552, 1º de setembro de 2008. Regulamenta a Gratificação de Desempenho de Atividade de Execução e Apoio Técnico à Auditoria - GDASUS, de que trata a Lei no 11.344, de 8 de setembro de 2006 [Internet]. Diário Oficial da União, Brasília, DF. 2008 set 2 [acesso em 2025 jun 11]; Seção I:1. Disponível em: https://legislacao.presidencia.gov.br/atos/tipo=DEC№=6552&ano=2008&ato=e7dQTUE50dVpWTb5d
  » https://legislacao.presidencia.gov.br/atos/tipo=DEC№=6552&ano=2008&ato=e7dQTUE50dVpWTb5d
• ¹⁸ Presidência da República (BR). Lei nº 8.689 de 27 de julho de 1993. Dispõe sobre a extinção do Instituto Nacional de Assistência Médica da Previdência Social (Inamps) e dá outras providências [Internet]. Diário Oficial da União, Brasília, DF. 1993 jul 28 [acesso em 2025 jun 11]; Seção I. Disponível em: https://www.planalto.gov.br/ccivil_03/leis/L8689.htm
  » https://www.planalto.gov.br/ccivil_03/leis/L8689.htm
• ¹⁹ Presidência da República (BR). Lei nº 8.080, de 19 de setembro de 1990. Dispõe sobre as condições para a promoção, proteção e recuperação da saúde, a organização e o funcionamento dos serviços correspondentes e dá outras providências [Internet]. Diário Oficial [da] República Federativa do Brasil, Brasília, DF. 1990 set 20 [acesso em 2025 jun 11]; Edição 182; Seção I:18055-9. Disponível em: https://www.planalto.gov.br/ccivil_03/leis/l8080.htm
  » https://www.planalto.gov.br/ccivil_03/leis/l8080.htm
• ²⁰ Presidência da República (BR). Decreto nº 9.795, de 17 de maio de 2019. Aprova a Estrutura Regimental e o Quadro Demonstrativo dos Cargos em Comissão e das Funções de Confiança do Ministério da Saúde, remaneja cargos em comissão e funções de confiança, transforma funções de confiança e substitui cargos em comissão do Grupo-Direção e Assessoramento Superiores - DAS por Funções Comissionadas do Poder Executivo - FCPE [Internet]. Diário Oficial da União, Brasília, DF. 2019 maio 20 [acesso em 2025 jun 18]; Seção I:2. Disponível em: https://www.planalto.gov.br/ccivil_03/_ato2019-2022/2019/decreto/d9795.htm
  » https://www.planalto.gov.br/ccivil_03/_ato2019-2022/2019/decreto/d9795.htm
• ²¹ Santos RHM, Ferreira DDM, Maragno LMD, et al. Tom do topo e auditoria interna: Análises do ambiente de governança do SUS. Adv Sci Appl Account. 2023;236-47.

Edited by

• Editor in charge:
  Marcelo Moreira Rasga, Fundação Oswaldo Cruz (Fiocruz), Estratégia Fiocruz para a Agenda (EFA 2030), Rio de Janeiro (Rio de Janeiro/RJ), Brasil. Lattes: http://lattes.cnpq.br/7851702065010431, Orcid: https://orcid.org/0000-0003-3356-7153, e-mail: [e-mail]

Publication Dates

• Publication in this collection
  07 Aug 2026
• Date of issue
  2026

History

• Received
  17 Nov 2025
• Accepted
  27 Dec 2025