Assessment of internal control systems in Malaysian small medium enterprises : a system theory approach

Abstract

Small and Medium Enterprises (SMEs) play a pivotal role in the Malaysian economy, contributing significantly to employment and economic growth. However, the absense of sound internal control systems in SMEs can lead to various operational, financial, and reputational risks. Internal control encompasses a range of processes, policies, and procedures designed to safeguard assets, ensure financial accuracy, promote operational efficiency, and comply with rules and regulations. In the context of SMEs, where resources and expertise may be limited, establishing sound internal control systems can be particularly challenging. It makes apparent that SMEs frequently face challenges with financial constraints and inadequated control systems, lack of independent audit, and constraints of staff leading to poor management oversight and weak security. Besides, almost all SMEs in Malaysia have limited knowledge of and interest in internal control. The lack of robust internal control systems in SMEs can lead to increased susceptibility to fraud, affecting revenue, employment, and stakeholder trust. To increase the understanding of the complexity of internal control systems for SMEs, the study uses system theory approach in researching internal control systems in SMEs. Since SMEs have different characteristics that distinguish them from large business counterparts as well as due to resource disparity, it is difficult to recommend to SMEs that they fully implement adequate internal control identified through studies conducted primarily on large companies. Therefore, this study aimed to explore and explain internal control systems implementation and determine factors towards successfully implementing internal control systems framework in SMEs. This study adopts a qualitative research strategy, utilizing in-depth case studies as a data collection technique. Data was gathered through semi-structured interviews, fieldwork observation, and documentary reviews on SMEs’ websites. The interviews explored the perceptions of 18 SMEs on the extent of internal control systems practices in SMEs. All interviews were recorded, and participants’ consent was obtained. The data were analyzed using thematic network analysis with the help of Nvivo12 software. The findings indicate that SMEs have an inadequate internal control systems. The findings also demonstrate the extent of internal control elements used in the form of ‘hard’ control and ‘soft’ control implemented in SMEs. Finally, this study contributes to understanding internal control systems and the specific form and nature of how internal controls can be successfully implemented to achieve internal control objectives. The results of this study may serve as a guideline for SMEs to implement internal control systems in their organizations.