INH Design & Build Sdn. Bhd.: Formulating Risk Management and Internal Control Policy

Chong, Yee Seng (2026) INH Design & Build Sdn. Bhd.: Formulating Risk Management and Internal Control Policy. Masters thesis, Tunku Abdul Rahman University of Management and Technology.

Text 08 Chong Yee Seng.pdf Restricted to Registered users only Download (3MB)

Abstract

This research develops a comprehensive risk management and internal control policy for INH Design and Build Sdn Bhd, a family-owned Malaysian SME specializing in renovation and interior design services. Small and medium enterprises in the Malaysian construction sector often operate under informal governance structures where operational speed takes precedence over systematic oversight. INH currently faces significant structural vulnerabilities due to its reliance on a centralized decision-making model and the absence of formalized control mechanisms. The primary objective of this study is to formulate a tailored policy framework that transitions the organization from reactive, trust-based management toward a proactive, system-based governance model to ensure long term business sustainability. The study employs a qualitative case study methodology, utilizing structured interviews and focus group discussions with the director and management team of INH. To protect the confidentiality of the organization and its members, the names of all individual participants disclosed in this study are referred to using pseudonyms. The research is theoretically grounded in the ISO 31000 risk management standard and the COSO internal control integrated framework. The diagnostic phase reveals that the company is exposed to critical external and internal risks, including persistent customer payment delays, raw material price volatility, and significant occupational health and safety hazards at renovation sites. Furthermore, internal vulnerabilities are exacerbated by a lack of clear segregation of duties, the absence of a formal code of conduct, and underdeveloped monitoring channels for reporting site misconduct. To address these deficiencies, the research proposes a tailored policy framework that introduces standardized operating procedures and a formal delegation of authority matrix. Key interventions include the institutionalization of an ethical code of conduct, the implementation of a risk register for continuous monitoring, and the establishment of structured site safety protocols. By operationalizing the five components of the COSO framework, the proposed policy seeks to enhance operational discipline, improve financial transparency, and foster a risk aware culture across all organizational levels. These measures are designed to reduce the administrative burden while providing the necessary oversight required for professional growth in a competitive market. Ultimately, this study contributes to the academic discourse on SME governance by demonstrating how global frameworks can be successfully adapted to the resource constrained environment of small private enterprises. For INH, the adoption of this risk management and internal control policy represents a strategic shift toward organizational maturity and resilience. The findings suggest that formalizing governance structures is essential for family-owned firms transitioning from informal legacy systems to professional corporate entities. This research provides a practical blueprint for similar Malaysian enterprises seeking to strengthen their internal controls and support sustainable business expansion.