The model for assessing the maturity and effectiveness of the internal control system

Small and medium-sized businesses do not pay due attention to the functional resources of the internal control system (ICS), which affects the effectiveness of management decisions. Economic entities that regularly use ICS assessment are able to achieve a higher level of control environment maturity by optimizing business processes. The purpose of the study is to formulate quantitative and qualitative criteria for assessing the level of internal control maturity allowing for its systematic monitoring in medium and small business organizations. As a part of this study, using the developed tests of controls, including a recommended set of indicators characterizing the maturity of the internal control system, the authors carried out a qualitative assessment of the existing internal control system and identified risk areas. The quantitative indicators proposed by the authors and analyzed over time provide a more objective measurable assessment of the effectiveness of the organization’s internal control system according to the five basic elements of the COSO model. The authors proposed to analyze the causes of deficiencies, determine the frequency of their occurrence and identify ineffective control procedures within business processes for internal control systems of different maturity levels. A conceptual model for assessing the maturity and effectiveness of the internal control system for small and medium-sized businesses has been developed. The model is based on quantitative and qualitative indicators, which allows assessing the internal control system and enables the management of organizations to analyze the effectiveness of the applied internal control procedures and make management decisions on their adjustment, thus minimizing financial, labor and resource costs. The use of the proposed unified control procedures, as well as monitoring the effectiveness of control procedures, makes it possible to timely identify entrepreneurial risks inherent in any business entity, which is impossible in the absence of a formalized control environment.