Gerenciamento de riscos e controles internos: um estudo aplicado à Hapvida participações e investimentos S.A.

Abstract

This study aims to analyze the risk management of Hapvida Participações e Investimentos S.A., identifying the main risk factors to which the organization is exposed and the mechanisms adopted for their management and mitigation. To this end, a descriptive study was conducted using the case study method, based on information disclosed by the company in its 2025 Reference Form, its Risk Management Policy, and other corporate documents made available to the market. In addition to analyzing Hapvida, a comparison was made with other companies operating in the supplementary health sector, seeking to verify the adoption of risk management practices and benchmarks. The results identified 46 risk factors distributed across different categories, with emphasis on risks related to brand reputation, litigation arising from service provision, regulatory changes, healthcare costs, and inflation, identified by the company itself as the most relevant. It was found that the company seeks to mitigate these risks through a formal corporate governance structure, risk management, internal controls, and continuous monitoring, aligned with the COSO ERM and ISO 31000 frameworks. The comparative analysis demonstrated that the risks faced by Hapvida are similar to those observed in other companies in the sector, although they present particularities related to their high degree of vertical integration. It was also found that the adoption of the COSO ERM and ISO 31000 frameworks is relatively recent in the supplementary health sector, having been implemented by most of the companies analyzed only from 2021 onwards, after the impacts caused by the Covid-19 pandemic. In this context, it is noteworthy that Hapvida had already been using both frameworks since 2018, demonstrating a risk management structure prior to the pandemic period. It is concluded that the adoption of structured risk management practices contributes to strengthening corporate governance, mitigating key corporate risks, and ensuring the sustainability of the company's operations as self-reported within an environment characterized by constant regulatory, economic, and healthcare-related uncertainties.