The practice of internal audit should be based on the design and implementation of risk maps, based on structured processes running the organization; for which, it is required that the institution has established adequate planning, as well as a management system risks adjusted to the particularities of the same, configured similarly control by the administration, which can be structured under different models, including COSO. Under this structure is necessary to conduct the audit, the results lead to preventive actions in order to enable the organization to meet its objectives.