Evaluating Internal Control over Financial Reporting in State-Owned Enterprises A COSO-Based Case Study of Indonesia's Infrastructure Sector

Abstract

The integrity of financial reporting constitutes a fundamental pillar of corporate governance, particularly for state-owned enterprises operating under heightened public scrutiny. PT Hutama Karya (Persero), a major Indonesian state-owned infrastructure enterprise, faces significant challenges in its financial consolidation process due to heavy reliance on manual procedures despite SAP implementation at the entity level. This dependency exposes the organization to human error, inconsistent accounting policies, and potential fraud risks. This study evaluates the design effectiveness of Internal Control over Financial Reporting within the Financial Statement Closing Process at PT Hutama Karya using a qualitative case study methodology grounded in the COSO 2013 framework. Data from semi-structured interviews with eight key stakeholders, questionnaire responses from financial and risk management personnel, and comprehensive document analysis were thematically assessed across the five COSO components. The findings reveal that the current ICFR design is not fully effective, with critical deficiencies identified in manual process dependency, system integration gaps, competency limitations, inadequate IT general controls, and restricted monitoring scope. Four interrelated root causes underpin these deficiencies: technology-process mismatch between entity-level SAP and group-level Excel consolidation; competency and awareness gaps across all three lines of defense; inadequate IT general controls including absence of digital approval workflows; and monitoring scope limitations driven by resource constraints. The study proposes an enhanced, technology-integrated ICFR framework anchored on automation, integration, standardization, real-time monitoring, and competency development. A phased implementation roadmap is developed to transform the consolidation process, aiming to significantly reduce consolidation cycle times, improve data timeliness, minimize control deficiencies, and strengthen external audit readiness. This study contributes to the internal control literature by extending the COSO framework to complex state-owned enterprise contexts, identifying "technology-process mismatch" as a distinct theoretical construct, developing a competency framework for ICFR implementation, and refining the Three Lines of Defense model through identification of the "testing gap." The enhanced framework provides reasonable assurance over financial reporting, ultimately strengthening corporate governance and stakeholder confidence in the organization's financial disclosures.