Unicraft Group Sdn. Bhd.: Risk Management and Internal Control Policy

Ang, Jia Yang (2026) Unicraft Group Sdn. Bhd.: Risk Management and Internal Control Policy. Masters thesis, Tunku Abdul Rahman University of Management and Technology.

Text 06 Ang Jia Yang.pdf Restricted to Registered users only Download (2MB)

Abstract

Effective enterprise risk management and internal control systems are essential for enhancing operational resilience, financial stability, and regulatory compliance in SMEs. This study examines the development and implementation of a tailored Risk Management and Internal Control Policy Framework for Unicraft Group Sdn. Bhd., a Malaysian SME specialising in bespoke luxury artistic texture walls and stone finishes for premium residential and commercial properties. Guided by the ISO 31000:2018 Risk Management Framework and the COSO Internal Control Framework, the study addresses the company’s founder-centric governance model and resource constraints typical of many Malaysian SMEs in the interior design and renovation sector. A qualitative single-case study approach was adopted, drawing on semi-structured interviews with the founder, Mr. Jason Lim, and focus group discussions with key employees, supplemented by document analysis and methodological triangulation. The analysis identified ten critical risks included but not limited to operational, financial, safety, and human resource risks, with high-priority issues including excessive dependency on the founder for decision-making, seasonal cash flow shortages, project delays due to slow client responses, manpower imbalance, occupational safety non-compliance on construction sites, and gaps in skill inheritance from senior artisans to new employees. Furthermore, five major internal control weaknesses were also highlighted, encompassing lack of formal risk reporting and documentation, employee time pressure and resistance to change, ineffective client communication mechanisms, absence of formal delegation of authority, and low compliance culture towards SOPs and safety protocols. In response, a practical governance framework was developed emphasising the Treat strategy for most risks. Key recommendations include the implementation of a formal DOA Matrix, clear response deadlines and risk transfer clauses in client contracts, milestone-based billing to improve cash flow predictability, mandatory PPE usage supported by photographic verification and safety checklists, a KPI-linked mentorship programme for artisanal knowledge transfer, and centralised documentation through Notion AI for risk registers, SOP accessibility, and project scheduling. These measures aim to reduce operational bottlenecks, strengthen financial resilience during seasonal downturns, minimise safety incidents, and institutionalise knowledge within the organisation. The findings indicate that the proposed framework will enhance decision-making speed, improve project delivery reliability, reinforce safety compliance with the OSHA 1994, and support Unicraft’s strategic ambition to get into larger B2B contracts and expand its interior design services. While the single-case qualitative design limits generalisability, this study offers a realistic and scalable model for other resource-constrained Malaysian SMEs transitioning from informal or trust-based systems to structured corporate governance. Future research should adopt longitudinal and comparative approaches to evaluate long-term policy effectiveness, explore the integration of ESG factors, and examine behavioural and cultural influences on governance adoption in the Malaysian SME context.