TCU Auditor Federal de Controle Externo - TI common mistakes
TCU Auditor Federal de Controle Externo - TI · Understand the traps and how to avoid them.
When a question asks which instrument the external control body should use at a given stage of the audit cycle, the candidate picks the instrument by name association (e.g., 'audit' whenever the word 'fiscalização' appears) instead of first identifying the phase (planning, execution, reporting, monitoring) and the object being examined.
The audit-support domain uses overlapping vocabulary - fiscalização, auditoria, levantamento, monitoramento, acompanhamento - and candidates memorize isolated definitions rather than the workflow that assigns each instrument to a phase and an object. Under time pressure the most familiar term wins.
What to do instead
Build a one-page matrix before the exam: rows = phases of the audit cycle, columns = instruments (levantamento, auditoria de conformidade, auditoria operacional, acompanhamento, monitoramento, inspeção), cells = object and expected product. Drill by covering the instrument column and reconstructing it from the phase and object alone; practice until the choice is derived from the phase, not from keyword matching.
The candidate treats the finding (achado) as a single block and, when asked to classify or structure it, omits one of the required elements - criterion, condition, cause, effect - usually dropping cause or effect because the question text emphasizes the deviation itself.
Study material often presents findings narratively ('constatou-se que...'), so candidates absorb the conclusion without the analytical structure. Questions that ask 'which element is missing' or 'what is the cause' then defeat them because they never practiced decomposing a finding.
What to do instead
Practice with a fixed four-cell template (critério, condição, causa, efeito) applied to ten short real-style scenarios; for each, write one sentence per cell. Then do reverse drills: given only the condition and effect, write a plausible cause and the criterion that was breached. This makes the structure automatic and exposes which element questions typically probe.
On governance questions the candidate applies private-sector governance logic - treating governance as equivalent to management, or assigning the board's role to the executive - and selects the alternative that describes good management practice rather than the governance function described in the public-sector framework.
Most prior exposure is to corporate governance or to administrative practice inside an organization, where the distinction between direction/supervision and execution is blurred. Public-sector governance emphasizes oversight, accountability, and the separation between the governing body and the administration, which candidates have rarely had to articulate explicitly.
What to do instead
Memorize the governance/management split as a two-column table: governance = evaluate, direct, monitor, set objectives, oversee risk and controls, account for results; management = plan, execute, control operations, deliver. For each practice listed in a question, force a one-word classification before reading the alternatives, then eliminate options that describe execution when the stem asks about governance.
The candidate confuses the roles of internal control, external control, and the institution's own internal audit unit when a question asks who is competent to do something - for example, attributing to the external control body a task that belongs to the internal control system, or vice versa.
The three layers share objectives (legality, legitimacy, economy, results) and use similar techniques, so candidates distinguish them by intuition rather than by the criterion of independence and the constitutional/legal mandate. Questions exploit exactly this overlap.
What to do instead
Anchor each layer to its source of authority and its independence status: internal control unit (subordinate to the entity's leadership, advises management), external control (independent of the entity, reports to the legislature), and internal audit as a component of internal control. For every practice in a question, ask 'who can compel this, and to whom do they report?' before choosing.
When a question involves the duty to account (dever de prestar contas), the candidate answers only about the annual accounts report and forgets that the obligation extends to any person or entity that manages, uses, or custody public resources, including those who are not formal public servants.
Candidates reduce 'prestação de contas' to the calendar ritual of the annual report and overlook the broader principle that anyone handling public money or assets is accountable. The exam frequently tests exactly the non-obvious holder of the duty.
What to do instead
Study the duty of accountability as a principle first (whoever manages, uses, or custodies public resources must account for them) and only then as a procedure (annual accounts, reports, deadlines). Drill with scenarios involving private entities under agreement, managers of funds, and individuals in custody of public assets, and for each, state whether the duty applies and on what basis.
The candidate evaluates the accounts of a manager by checking only whether the numbers reconcile, and fails to separate the judgment of the accounts from the judgment of the acts of the manager - so questions asking for the possible outcomes of an accounts judgment are answered with the wrong set of conclusions.
The two judgments share the same documentary base and are often produced together, so candidates merge them. The distinct consequences (regular, regular with reservations, irregular accounts vs. judgments on acts, sanctions, and imputation of responsibility) are easily conflated.
What to do instead
Write out two separate decision trees side by side: one for judging accounts (regular, regular with reservation, irregular, and the effect of imputing responsibility) and one for judging acts and contracts. For each, list the trigger conditions and consequences. Practice by classifying mixed scenarios into 'accounts judgment', 'acts judgment', or both, and justify the classification.
On procurement questions the candidate selects the bidding modality by the value of the contract or by habit ('it's a purchase, so it's a competition') without first checking whether the object falls into a legally defined exception or whether the legal hypothesis is one of inexigibilidade versus dispensability.
Modality choice in public procurement depends on the object, the legal hypothesis, and the value thresholds in a specific order, but candidates learn the modalities as a list and apply them by association. Inexigibilidade and dispensability look similar in wording and are the classic trap.
What to do instead
Adopt a decision sequence and rehearse it: (1) is the object ordinary or does it fall into a legal exception? (2) if an exception, is it dispensability (competition possible but law allows skipping) or inexigibilidade (competition impossible)? (3) only if there is no exception, choose the modality by object type, then by value. Build a table of legal hypotheses with a one-line example for each and drill distinguishing the two exceptions with concrete scenarios.
The candidate answers contract-execution questions by focusing on the contractor's obligations and neglects the administration's own duties during execution - formal designation of a contract supervisor, record of occurrences, and the administrative process for applying penalties - treating penalties as automatic rather than as the outcome of a due process.
Study tends to concentrate on the selection phase and on the clauses of the contract, while the supervision and penalty regime is learned as a footnote. Candidates then miss questions that test the procedural preconditions for sanctioning and the responsibility of the supervisor.
What to do instead
Memorize the execution-side checklist as a timeline: designation of supervisor, initial and periodic records, formal communication of irregularities, defense opportunity, reasoned decision, and penalty. For each step, note who is responsible and what document evidences it. Practice by identifying, in a short scenario, the procedural step that was skipped - that is usually what the question is really asking.
On IT questions the candidate answers from general technical intuition - for example, treating information security as a purely technical matter to be solved by tools, or treating data protection as identical to information security - instead of applying the legal and governance concepts the exam actually tests.
Candidates with an IT background bring product-level knowledge and answer what is technically true rather than what the norm or governance framework prescribes. The exam tests roles, responsibilities, principles, and institutional arrangements, not configuration details.
What to do instead
Separate the IT syllabus into three layers and study them distinctly: legal (data protection principles, roles of controller and operator, rights of the data subject), governance (IT as part of organizational governance, roles of the governing body, risk management, alignment with institutional objectives), and technical (controls, availability, integrity, confidentiality). For each practice in a question, identify which layer is being asked before evaluating the alternatives.
Across all domains, the candidate reads the stem once, recognizes a familiar term, and selects the first alternative that contains it, without checking quantifiers and exceptions ('always', 'only', 'except', 'provided that') that change the correct answer.
The exam deliberately uses long stems and plausible distractors built from the same vocabulary as the correct answer. Under time pressure, recognition substitutes for reading, and the qualifiers that distinguish the alternatives are exactly the part that gets skipped.
What to do instead
Adopt a mechanical reading protocol: read the stem twice (once for the object, once for the qualifiers), underline or mentally mark every quantifier and exception, then read all alternatives before deciding. Practice on blocks of ten questions with a rule of no answer selection until all alternatives are read, and review errors by classifying them as 'content gap' or 'reading failure' so the protocol is reinforced where it actually fails.