Enterprise Risk Management Framework and Policy Development for Kyai Advisory Sdn. Bhd.: Advancing Corporate Governance in Professional Services SMEs

Muhammad Sufian Ting, Muhammad Yasin Ting (2026) Enterprise Risk Management Framework and Policy Development for Kyai Advisory Sdn. Bhd.: Advancing Corporate Governance in Professional Services SMEs. Masters thesis, Tunku Abdul Rahman University of Management and Technology.

Text 16 Muhammad Yasin Ting Bin Muhammad Sufian Ting.pdf Restricted to Registered users only Download (2MB)

Abstract

This project addresses a critical governance deficiency at KYAI Advisory Sdn Bhd, a Malaysian professional services firm specialising in accounting and compliance advisory for SMEs and NPOs. Despite operating in a highly regulated environment with substantial professional liability and information security risks, the firm lacks a formalised enterprise risk management framework. Employing a qualitative case study methodology, this research identifies and assesses key risks across seven domains, benchmarks current practices against ISO 31000:2018 and COSO ERM (2017), and designs a structured, proportionate Enterprise Risk Management (ERM) framework tailored to the firm's SME context. Findings reveal that risk management deficiencies arise not from lack of professional competence but from the absence of systematic organisational frameworks, with critical weaknesses identified in governance structures, risk assessment methodologies, monitoring systems, and risk culture. The proposed framework comprises three interconnected layers: a Governance Layer establishing accountability through a streamlined three-tier structure; a Process Layer operationalising the ISO 31000 risk management cycle; and an Integration Layer embedding risk considerations into strategic planning and operations. Guided by principles of standards alignment, proportionality, practicality, integration, and scalability, the framework is supported by a phased 12-month implementation roadmap. This research contributes to the limited literature on proportionate risk management for professional services SMEs in Malaysia, demonstrating how international standards can be pragmatically adapted within resource- constrained contexts.