Prácticas de seguridad de la información en mipymes de Villavicencio: un estudio de caso múltiple para la identificación de oportunidades de mejora desde los marcos coso-erm y cobit

Abstract

The increasing digitalization of accounting and administrative processes has led Colombian SMEs to rely increasingly on technological tools to manage financial information. However, in many cases, this technological adoption has not been accompanied by formal internal control and information security mechanisms, increasing exposure to cyber risks that may affect operational performance and the reliability of accounting records. In this context, practices implemented in two SMEs located in Villavicencio were evaluated through the COSO-ERM and COBIT 2019 frameworks. This research was developed under a qualitative and descriptive-analytical approach, using a multiple case study as the methodological strategy. Data was collected through semi-structured interviews and surveys conducted with personnel involved in accounting and technological processes within the participating organizations. The results showed that both companies have digitalized accounting processes, individual user access, and automatic information backup mechanisms. However, weaknesses were identified regarding the absence of formal security policies, poorly structured controls, the use of messaging applications to share financial information, and limited preventive management of technological risks. Likewise, dependence on employees empirical knowledge and limited supervision of certain technological processes were observed. From the COSO-ERM perspective, deficiencies were identified in risk assessment, monitoring, and the formalization of internal controls. In turn, COBIT 2019 revealed basic and intermediate levels of technological capability, especially in aspects related to information security and operational continuity. In conclusion, the identified vulnerabilities are not only technological in nature but are also supported by intrinsic organizational weaknesses. Informality in operational processes, insufficient documentation, and a low-level risk management culture pose significant threats to the integrity and reliability of accounting information.