Strong Control Environment the Main Pillar of Internal Audit in State-Owned Enterprises

Abstract

The control environment is a fundamental component of a company’s internal control system, comprising standards, processes, and organizational structures that guide the implementation of internal controls. This study aims to examine the factors influencing the implementation of the control environment and evaluate its stability in state-owned enterprises (SOEs) within the industrial and service sectors. An exploratory research design with multiple case studies was employed to gain in-depth insights. The findings indicate that SOE management has established a control environment; however, inconsistencies persist across business segments. In particular, the risk management dimension in some cases requires further development, as no dedicated Chief Risk Officer (CRO) exists, and internal audit and risk management functions are not yet optimal, reducing overall effectiveness. Nevertheless, positive practices are evident, including well-structured control organizations, strong commitment to competence, enforcement of accountability, productive roles of top management, and adherence to integrity and ethical standards. The study concludes that while the control environment is implemented, strengthening risk management and internal audit functions is essential to enhance the effectiveness and sustainability of internal controls in SOEs.