Gerenciamento de riscos para a área de Tecnologia da Informação de uma empresa pública de economia mista

Abstract

This paper demonstrates the design and mapping of risks to the environment of Information Technology for a company of mixed economy of São Paulo. The work was developed based on market methodologies used for identification, measurement and controls to reduce the level of risk exposure, as follows: ERM-IF (Enterprise Risk Management Integrated Framework; COBIT (Control Objectives for Information and related Technology); Normas ABNT (Associação Brasileira de Normas Técnicas); The search to identify risks, measure their exposure based on probability and impact upon the possible materialization of the risk context. Any event that prevents a goal or impact of the company should be considered a risk to be measured and treated. The results showed that the risks are partially mitigated and satisfactory level, however, among the mapped processes, we identified the need to improve controls aimed at managing critical business information, the controls must be implemented aiming at managing the process safety Information. Include the activity of risk management as a cyclical basis to ensure that technology is part of the deal, changing their status to investment spending.