An Integrated COSO–BPM–RPA Framework for Risk-Oriented Sales Governance in Microenterprises: Development and Empirical Application of COVA

Abstract

This study develops and applies the integrated COVA framework for risk-oriented sales governance in microenterprises. Although internal control systems (COSO), business process management (BPM), and robotic process automation (RPA) have been widely examined independently, limited empirical evidence addresses their structured integration within unified methodologies tailored to commercial cycles in emerging economy microenterprises. The COVA framework combines risk prioritization, AS-IS and TO-BE process redesign, and the identification of automation opportunities to enhance traceability, operational efficiency, and decision-making. The empirical application in a microenterprise within the electrical and occupational safety services sector identified structural weaknesses in control activities, role definition, and information flow. The resulting design established formal control points and a scalable automation roadmap. Findings indicate that integrating control, process architecture, and technology within a single framework strengthens commercial governance and provides a replicable model for microenterprises operating in regulation-intensive environments.