A practical approach to designing internal control systems in SMEs

The internal control system (ICS) plays a crucial role in safeguarding firms against risks that could hinder the achievement of business objectives. However, implementing an effective ICS in small and medium-sized enterprises (SMEs) poses unique challenges, including a lack of skilled personnel in management and limited financial resources. This study introduces a procedure made up of a series of straightforward steps to assist SMEs in developing an ICS. The procedure is designed to provide a satisfactory rather than optimal solution consistently with the bounded rationality approach. It offers three key advantages: (1) judgment-based decision-making, allowing decision makers to assess risks based on their expertise rather than formalized quantitative analyses (2) a flexible decision-making framework that guides decision makers without imposing rigid cognitive processes, and (3) firm-specific decision-making, ensuring that the ICS aligns with the unique characteristics of each firm. An illustrative example demonstrates its applicability. The analysis starts with a sample of 261 small Italian firms specializing in cultural heritage restoration services, which serves as the basis for identifying hazards that could affect firm profitability. By providing an accessible and cost-effective tool, this study offers SMEs a practical alternative to traditional ICS frameworks that require greater financial and human resources.