<![CDATA[Operational risk remains a persistent challenge for commercial banks due to complex processes, high transaction volumes, and stringent regulatory requirements. Internal control functions are expected to strengthen prevention, detection, and response capabilities, yet performance evaluation frequently relies on outcome indicators that are partially outside the span of control of the evaluated unit. This study develops and tests an integrated evaluation model that combines Balanced Scorecard measurement, gap analysis, risk based prioritisation, and Root Cause Analysis to identify improvement priorities for an internal control unit in a commercial bank. An explanatory sequential mixed methods design was applied. Quantitative analysis used 14 Balanced Scorecard indicators for fiscal year 2024, standardised to a 1 to 5 scale, and combined with perception survey results from 50 respondents. A composite score was computed as Z_i=0.7X_i+0.3Y_i, and a gap score as G_i=5-Z_i. Priority ranking used PRI_i=G_i×w_i×R_i, where w_idenotes indicator weight and R_idenotes operational risk impact. Qualitative data were collected through semi structured interviews, limited observation, and document review to explain quantitative patterns and classify gap typologies. Results indicate high overall performance with a total index of approximately 4.56 out of 5.00, while gaps concentrate in a small subset of outcome oriented indicators. The highest priorities for Root Cause Analysis correspond to a financial outcome indicator, a stakeholder satisfaction indicator, and an efficiency indicator, reflecting misalignment between outcome metrics and controllable activities, as well as service and documentation constraints. The integrated model produces a structured improvement roadmap consisting of 22 actions grouped into quick wins for 2025 and strategic initiatives for 2026, and is validated through member checking and triangulation. The study contributes a practical and auditable approach to performance evaluation for internal control units in commercial banking by embedding span of control reasoning, risk based prioritisation, and actionable Root Cause Analysis outputs.]]>
