Evaluating the Governance Execution Gap in the Customer Onboarding Process at PT XYZ: An Integrated Coso and three Lines Model Approach

Abstract

This study aimed to evaluate the implementation of internal control based on the COSO Internal Control–Integrated Framework (IC-IF) 2013 and the Three Lines Model (TLM) at PT XYZ, a BAPPEBTI-licensed futures brokerage company. The research was motivated by recurring procedural violations during 2022–2024, including non-WPB marketing personnel performing WPB functions, fund transfers prior to verification, unauthorized trading activities, and cash deposits. Using a qualitative case study approach, data were collected through in-depth interviews with nine cross-line informants (marketing, WPB, compliance, SPI, and the compliance director), document analysis, and limited observations. A gap analysis was conducted by comparing ideal conditions based on BAPPEBTI regulations, standard operating procedures (SOPs), COSO principles, and TLM principles with actual implementation conditions.The results showed that PT XYZ’s internal control system remained inadequate. Of the 11 main SOP procedures evaluated, five were consistently and repeatedly violated. All five COSO components demonstrated significant weaknesses. The implementation of the Three Lines Model was also ineffective: Line One was weakened by business target pressures, Line Two functioned primarily in an administrative capacity, and Line Three lacked consistency, with no routine coordination among the lines. The study identified 12 Design Gaps (including the absence of compliance KPIs, written sanction policies, a risk register, a whistleblowing system, and IMS alert features) and five Implementation Gaps (including non-WPB marketing personnel performing WPB functions, transfers before verification, unauthorized trading, cash deposits, and WPB accompaniment control gaps).The recommendations include redesigning KPIs with compliance-based weighting, implementing tiered sanctions, establishing a risk register, providing a whistleblowing system, developing IMS alert features, and strengthening top management commitment and cross-line accountability.