Evaluating Internal Control Effectiveness at PT Ultimo Clinic: A COSO-Based Case Study

Abstract

This study assesses the implementation and effectiveness of internal control systems within PT Ultimo Clinic’s operational processes, using the COSO Internal Control Framework as an analytical lens. Employing a qualitative case study design, data were collected between January and March 2025 through semi-structured interviews with eight key personnel, direct observation of routine procedures, and document analysis. Thematic analysis revealed four principal weaknesses: reliance on manual and spreadsheet-based records; inadequate segregation of duties and authorisation procedures; limited data security and backup practices; and inconsistent receivables management. These deficiencies compromise information reliability, weaken monitoring capacity, and elevate exposure to fraud risks by creating opportunities and pressures conducive to misconduct. The paper proposes targeted improvements, including system integration, formalised authorisation workflows, standardised credit policies, periodic internal audits, and automated backup protocols. By combining process mapping with control evaluation, the study contributes to AIS and internal control literature in developing-country contexts. It offers actionable recommendations for managerial practice in medium-scale healthcare providers.