A Practical Digital-Transformation Maturity and Delivery-Readiness Framework for U.S. SMEs and Small Government Vendors: Development, Pre-Pilot Psychometric Validation and Operational Benchmark Calibration

References

[1] Aloini, D., Dulmin, R. and Mininno, V. (2007) 'Risk management in ERP project introduction: Review of the literature', Information & Management, 44(6), pp. 547-567. doi:10.1016/j.im.2007.05.004.

[2] Barney, J. (1991) 'Firm resources and sustained competitive advantage', Journal of Management, 17(1), pp. 99-120. doi:10.1177/014920639101700108.

[3] Becker, J., Knackstedt, R. and Poppelbuss, J. (2009) 'Developing maturity models for IT management: A procedure model and its application', Business & Information Systems Engineering, 1(3), pp. 213-222. doi:10.1007/s12599-009-0044-5.

[4] Bianchini, M. and Lasheras Sancho, M. (2025) SME digitalisation for competitiveness: The 2025 OECD D4SME Survey. OECD SME and Entrepreneurship Papers No. 68. Paris: OECD Publishing. doi:10.1787/197e3077-en.

[5] Bouwman, H., Nikou, S. and de Reuver, M. (2019) 'Digitalization, business models, and SMEs: How do business model innovation practices improve performance of digitalizing SMEs?', Telecommunications Policy, 43(1), pp. 35-54. doi:10.1016/j.telpol.2017.09.007.

[6] Chingezi, E., Chingezi, L., Ganyani, L., Yelduora, P.G. and Mupa, M.N. (2026b) 'Accounting analytics for inventory integrity and working capital control: Continuous auditing approaches for ERP-enabled supply chains', Iconic Research and Engineering Journals, 10(1). doi:10.64388/IREV10I1-1719387.

[7] Churchill, G.A. (1979) 'A paradigm for developing better measures of marketing constructs', Journal of Marketing Research, 16(1), pp. 64-73. doi:10.1177/002224377901600110.

[8] Committee of Sponsoring Organizations of the Treadway Commission (COSO) (2013) Internal Control - Integrated Framework. Durham, NC: COSO.

[9] Constante, F., Silva, F. and Pereira, A. (2019) DataCo SMART SUPPLY CHAIN FOR BIG DATA ANALYSIS. Mendeley Data, Version 5. doi:10.17632/8gx2fvg2k6.5.

[10] Cronbach, L.J. (1951) 'Coefficient alpha and the internal structure of tests', Psychometrika, 16, pp. 297-334. doi:10.1007/BF02310555.

[11] Davenport, T.H. (1998) 'Putting the enterprise into the enterprise system', Harvard Business Review, 76(4), pp. 121-131.

[12] DeLone, W.H. and McLean, E.R. (2003) 'The DeLone and McLean model of information systems success: A ten-year update', Journal of Management Information Systems, 19(4), pp. 9-30. doi:10.1080/07421222.2003.11045748.

[13] Eliot, D. (2024) NIST Cybersecurity Framework 2.0: Small Business Quick-Start Guide. NIST SP 1300. Gaithersburg, MD: National Institute of Standards and Technology. doi:10.6028/NIST.SP.1300.

[14] Eliot, D., Marron, J. and Thorn, S. (2026) Small Business Cybersecurity: Non-Employer Firms. NIST CSWP 50, Initial Public Draft. Gaithersburg, MD: National Institute of Standards and Technology. doi:10.6028/NIST.CSWP.50.ipd.

[15] Eller, R., Alford, P., Kallmunzer, A. and Peters, M. (2020) 'Antecedents, consequences, and challenges of small and medium-sized enterprise digitalization', Journal of Business Research, 112, pp. 119-127. doi:10.1016/j.jbusres.2020.03.004.

[16] Fornell, C. and Larcker, D.F. (1981) 'Evaluating structural equation models with unobservable variables and measurement error', Journal of Marketing Research, 18(1), pp. 39-50. doi:10.1177/002224378101800104.

[17] Garzoni, A., De Turi, I., Secundo, G. and Del Vecchio, P. (2020) 'Fostering digital transformation of SMEs: A four levels approach', Management Decision, 58(8), pp. 1543-1562. doi:10.1108/MD-07-2019-0939.

[18] Gattiker, T.F. and Goodhue, D.L. (2005) 'What happens after ERP implementation: Understanding the impact of interdependence and differentiation on plant-level outcomes', MIS Quarterly, 29(3), pp. 559-585. doi:10.2307/25148695.

[19] Hair, J.F., Risher, J.J., Sarstedt, M. and Ringle, C.M. (2019) 'When to use and how to report the results of PLS-SEM', European Business Review, 31(1), pp. 2-24. doi:10.1108/EBR-11-2018-0203.

[20] Henseler, J., Ringle, C.M. and Sarstedt, M. (2015) 'A new criterion for assessing discriminant validity in variance-based structural equation modeling', Journal of the Academy of Marketing Science, 43, pp. 115-135. doi:10.1007/s11747-014-0403-8.

[21] Hinkin, T.R. (1998) 'A brief tutorial on the development of measures for use in survey questionnaires', Organizational Research Methods, 1(1), pp. 104-121. doi:10.1177/109442819800100106.

[22] Ifinedo, P. (2011) 'Internet/e-business technologies acceptance in Canada's SMEs: An exploratory investigation', Internet Research, 21(3), pp. 255-281. doi:10.1108/10662241111139309.

[23] Kaiser, H.F. (1974) 'An index of factorial simplicity', Psychometrika, 39, pp. 31-36. doi:10.1007/BF02291575.

[24] Li, L., Su, F., Zhang, W. and Mao, J.Y. (2018) 'Digital transformation by SME entrepreneurs: A capability perspective', Information Systems Journal, 28(6), pp. 1129-1157. doi:10.1111/isj.12153.

[25] MacKenzie, S.B., Podsakoff, P.M. and Podsakoff, N.P. (2011) 'Construct measurement and validation procedures in MIS and behavioral research: Integrating new and existing techniques', MIS Quarterly, 35(2), pp. 293-334. doi:10.2307/23044045.

[26] Matarazzo, M., Penco, L., Profumo, G. and Quaglia, R. (2021) 'Digital transformation and customer value creation in Made in Italy SMEs: A dynamic capabilities perspective', Journal of Business Research, 123, pp. 642-656. doi:10.1016/j.jbusres.2020.10.033.

[27] Mettler, T. (2011) 'Maturity assessment models: A design science research approach', International Journal of Society Systems Science, 3(1/2), pp. 81-98. doi:10.1504/IJSSS.2011.038934.

[28] Oliveira, T. and Martins, M.F. (2011) 'Literature review of information technology adoption models at firm level', Electronic Commerce Research and Applications, 10(3), pp. 110-121. doi:10.1016/j.elerap.2010.12.001.

[29] Parasuraman, A. (2000) 'Technology Readiness Index (TRI): A multiple-item scale to measure readiness to embrace new technologies', Journal of Service Research, 2(4), pp. 307-320. doi:10.1177/109467050024001.

[30] Pascoe, C., Quinn, S. and Scarfone, K. (2024) The NIST Cybersecurity Framework (CSF) 2.0. NIST CSWP 29. Gaithersburg, MD: National Institute of Standards and Technology. doi:10.6028/NIST.CSWP.29.

[31] Poppelbuss, J. and Roglinger, M. (2011) 'What makes a useful maturity model? A framework of general design principles for maturity models and its demonstration in business process management', Proceedings of the 19th European Conference on Information Systems, Helsinki.

[32] Priyono, A., Moin, A. and Putri, V.N.A.O. (2020) 'Identifying digital transformation paths in the business model of SMEs during the COVID-19 pandemic', Journal of Open Innovation: Technology, Market, and Complexity, 6(4), article 104. doi:10.3390/joitmc6040104.

[33] Ruivo, P., Oliveira, T. and Neto, M. (2014) 'Examine ERP post-implementation stages of use and value: Empirical evidence from Portuguese SMEs', International Journal of Accounting Information Systems, 15(2), pp. 166-184. doi:10.1016/j.accinf.2014.01.002.

[34] Sambamurthy, V., Bharadwaj, A. and Grover, V. (2003) 'Shaping agility through digital options: Reconceptualizing the role of information technology in contemporary firms', MIS Quarterly, 27(2), pp. 237-263. doi:10.2307/30036530.

[35] Taanisa, T., Mukwata, N.A., Sydney, J., Ganyani, L., Maturure, R.N., Chingezi, E., Yelduora, P.G. and Mupa, M.N. (2026a) 'AI-enabled audit analytics for SME financial reporting and anomaly detection: A risk-based framework for early irregularity identification and control strengthening', World Journal of Advanced Research and Reviews, 30(3), pp. 1113-1126. doi:10.30574/wjarr.2026.30.3.1596.

[36] Teece, D.J. (2007) 'Explicating dynamic capabilities: The nature and microfoundations of (sustainable) enterprise performance', Strategic Management Journal, 28(13), pp. 1319-1350. doi:10.1002/smj.640.

[37] Trkman, P. (2010) 'The critical success factors of business process management', International Journal of Information Management, 30(2), pp. 125-134. doi:10.1016/j.ijinfomgt.2009.07.003.

[38] Umble, E.J., Haft, R.R. and Umble, M.M. (2003) 'Enterprise resource planning: Implementation procedures and critical success factors', European Journal of Operational Research, 146(2), pp. 241-257. doi:10.1016/S0377-2217(02)00547-7.

[39] Venkatesh, V., Morris, M.G., Davis, G.B. and Davis, F.D. (2003) 'User acceptance of information technology: Toward a unified view', MIS Quarterly, 27(3), pp. 425-478. doi:10.2307/30036540.

[40] Verhoef, P.C., Broekhuizen, T., Bart, Y., Bhattacharya, A., Dong, J.Q., Fabian, N. and Haenlein, M. (2021) 'Digital transformation: A multidisciplinary reflection and research agenda', Journal of Business Research, 122, pp. 889-901. doi:10.1016/j.jbusres.2019.09.022.

[41] Vial, G. (2019) 'Understanding digital transformation: A review and a research agenda', Journal of Strategic Information Systems, 28(2), pp. 118-144. doi:10.1016/j.jsis.2019.01.003.

[42] Wang, R.Y. and Strong, D.M. (1996) 'Beyond accuracy: What data quality means to data consumers', Journal of Management Information Systems, 12(4), pp. 5-33. doi:10.1080/07421222.1996.11518099.

[43] Warner, K.S.R. and Wager, M. (2019) 'Building dynamic capabilities for digital transformation: An ongoing process of strategic renewal', Long Range Planning, 52(3), pp. 326-349. doi:10.1016/j.lrp.2018.12.001.

[44] Xu, H., Nord, J.H., Brown, N. and Nord, G.D. (2002) 'Data quality issues in implementing an ERP', Industrial Management & Data Systems, 102(1), pp. 47-58. doi:10.1108/02635570210414668.

[45] Yelduora, P.G., Nhemachena, T.L., Chingezi, E. and Mupa, M.N. (2026) 'Data-driven internal controls and budget governance for small businesses and nonprofit institutions: A practical model for audit readiness and financial resilience', Iconic Research and Engineering Journals, 10(1). doi:10.64388/IREV10I1-1719493.

[46] Appendix A. Full instrument and evidence guide

[47] Table 20. Item-level scoring and evidence guide

[48] Item

[49] Statement

[50] Minimum evidence example

[51] Anchor

[52] PI1

[53] End-to-end workflows are documented and owned across functions.

[54] Approved process map/process owner

[55] 1=absent; 3=defined/inconsistent; 5=embedded/measured

[56] PI2

[57] Handoffs and exception routes are standardised.

[58] SOP/handoff matrix

[59] 1=absent; 3=defined/inconsistent; 5=embedded/measured

[60] PI3

[61] Core systems exchange data without repeated manual re-entry.

[62] Interface or integration log

[63] 1=absent; 3=defined/inconsistent; 5=embedded/measured

[64] PI4

[65] Rework, queue time and process exceptions are measured and reviewed.

[66] Rework/exception dashboard

[67] 1=absent; 3=defined/inconsistent; 5=embedded/measured

[68] ER1

[69] A quantified business case, scope and process ownership are approved.

[70] Business case/charter

[71] 1=absent; 3=defined/inconsistent; 5=embedded/measured

[72] ER2

[73] Fit-gap requirements and vendor-neutral acceptance criteria are documented.

[74] Requirements and acceptance criteria

[75] 1=absent; 3=defined/inconsistent; 5=embedded/measured

[76] ER3

[77] Resources, change impacts, risks and decision rights are established.

[78] Resource/risk/change plan

[79] 1=absent; 3=defined/inconsistent; 5=embedded/measured

[80] ER4

[81] Data migration, testing, cutover and stabilisation plans are ready and rehearsed.

[82] Migration, test and cutover pack

[83] 1=absent; 3=defined/inconsistent; 5=embedded/measured

[84] DQ1

[85] Master-data domains have named owners and definitions.

[86] Data-owner register/dictionary

[87] 1=absent; 3=defined/inconsistent; 5=embedded/measured

[88] DQ2

[89] Validation rules address duplicates, invalid values and missing critical fields.

[90] Validation and duplicate rules

[91] 1=absent; 3=defined/inconsistent; 5=embedded/measured

[92] DQ3

[93] Completeness, accuracy, consistency and timeliness are monitored.

[94] Quality scorecard

[95] 1=absent; 3=defined/inconsistent; 5=embedded/measured

[96] DQ4

[97] Source-to-report lineage and reconciliations are documented.

[98] Lineage/reconciliation evidence

[99] 1=absent; 3=defined/inconsistent; 5=embedded/measured

[100] IC1

[101] Role-based access and segregation-of-duties risks are reviewed.

[102] Access and SoD review

[103] 1=absent; 3=defined/inconsistent; 5=embedded/measured

[104] IC2

[105] Approvals, thresholds and supporting evidence are enforced.

[106] Approval matrix/audit trail

[107] 1=absent; 3=defined/inconsistent; 5=embedded/measured

[108] IC3

[109] Reconciliations and exception monitoring occur at defined frequencies.

[110] Reconciliation/exception log

[111] 1=absent; 3=defined/inconsistent; 5=embedded/measured

[112] IC4

[113] Control failures have owners, due dates, root causes and verified closure.

[114] Root-cause and closure evidence

[115] 1=absent; 3=defined/inconsistent; 5=embedded/measured

[116] CH1

[117] Critical assets, accounts and data are inventoried; strong authentication is used.

[118] Asset/account inventory and MFA report

[119] 1=absent; 3=defined/inconsistent; 5=embedded/measured

[120] CH2

[121] Backups are protected and recovery is tested.

[122] Backup/recovery test

[123] 1=absent; 3=defined/inconsistent; 5=embedded/measured

[124] CH3

[125] Patching, vulnerability handling and incident escalation are defined.

[126] Patch/vulnerability/incident procedure

[127] 1=absent; 3=defined/inconsistent; 5=embedded/measured

[128] CH4

[129] Third-party risk and workforce security awareness are reviewed.

[130] Vendor-risk review and awareness record

[131] 1=absent; 3=defined/inconsistent; 5=embedded/measured

[132] UA1

[133] Training is role-based and verifies practical proficiency.

[134] Role curriculum/proficiency result

[135] 1=absent; 3=defined/inconsistent; 5=embedded/measured

[136] UA2

[137] Super users and support routes are available after go-live.

[138] Super-user/support roster

[139] 1=absent; 3=defined/inconsistent; 5=embedded/measured

[140] UA3

[141] Actual system use, workarounds and process compliance are measured.

[142] Usage/workaround/compliance metric

[143] 1=absent; 3=defined/inconsistent; 5=embedded/measured

[144] UA4

[145] User feedback, support trends and lessons learned drive improvement.

[146] Feedback and improvement log

[147] 1=absent; 3=defined/inconsistent; 5=embedded/measured

[148] DC1

[149] Schedule, cost, milestones and delivery commitments are actively controlled.

[150] Schedule/cost/milestone baseline

[151] 1=absent; 3=defined/inconsistent; 5=embedded/measured

[152] DC2

[153] Order-to-cash and invoice documentation are complete and timely.

[154] Order-to-cash/invoice checklist

[155] 1=absent; 3=defined/inconsistent; 5=embedded/measured

[156] DC3

[157] Quality, delivery and corrective-action performance are monitored.

[158] Quality/delivery/corrective-action dashboard

[159] 1=absent; 3=defined/inconsistent; 5=embedded/measured

[160] DC4

[161] Subcontractor, contract and evidence obligations are traceable and current.

[162] Subcontract/contract evidence register

[163] 1=absent; 3=defined/inconsistent; 5=embedded/measured

[164] Note: Assessors should record evidence date, owner and confidence. A rating of 4 or 5 should not be assigned without corroborating evidence.

[165] Appendix B. Scoring formulas and dashboard rules

[166] Table 21. Core formulas

[167] Metric

[168] Formula

[169] Output

[170] Domain score

[171] ((mean of four item ratings - 1) / 4) x 100

[172] 0-100

[173] Composite index

[174] Sum(domain score x domain weight)

[175] 0-100

[176] Evidence coverage

[177] Supported items / applicable items x 100

[178] 0-100%

[179] Bottleneck gap

[180] 100 - lowest domain score

[181] 0-100

[182] Contradiction flag

[183] Absolute inter-rater difference >1 on a critical item

[184] Yes/No

[185] Reliable delivery

[186] Delivery KPI meets pre-defined, evidence-backed threshold

[187] Yes/No

[188] Change score

[189] Current index - baseline index

[190] Points with confidence interval

[191] Benefits realisation

[192] Verified monetary/non-monetary benefit / approved target

[193] Percent

[194] Recommended provisional risk-balanced weights are PI 18%, ER 16%, DQ 16%, IC 14%, CH 12%, UA 12% and DC 12%. Report the unweighted domain scores beside the composite. Apply the maturity-stage thresholds only after bottleneck, evidence-coverage and confidence rules are checked.

[195] Appendix C. Government-vendor extension

[196] Table 22. Optional small-government-vendor extension

[197] Item

[198] Assessment statement

[199] GV1

[200] Contract, task-order and modification obligations are maintained in a current register.

[201] GV2

[202] Milestone, schedule and cost baselines are approved and variance is reviewed.

[203] GV3

[204] Deliverable acceptance criteria and evidence are traceable to each commitment.

[205] GV4

[206] Invoice packs are complete, timely and linked to accepted work and authorised costs.

[207] GV5

[208] Subcontractor obligations, performance and required flow-downs are monitored.

[209] GV6

[210] Security, privacy and data-handling responsibilities are assigned and evidenced.

[211] GV7

[212] Corrective actions have owners, root causes, due dates and verified closure.

[213] GV8

[214] Management reviews contract risks, customer communication and forecast-at-completion.

[215] Note: These items may form a separate vendor-readiness module. They should not be used as a legal or contractual compliance certification.

[216] Appendix D. Reproducibility and analysis specification

[217] Obtain the public DataCo source or document the exact analytical extract and checksum.

[218] Parse order dates; derive severe delay, hard workflow exceptions, negative-profit exposure and critical-field completeness.

[219] Aggregate market x department x segment x year-quarter units and retain at least 60 transaction lines per unit.

[220] Compute the six-component operational delivery score using the weights in Table 7.

[221] Generate or import item-level assessment records; retain raw item values and respondent identifiers separate from organisational aggregates.

[222] Compute domain scores, evidence coverage, confidence and alternative composite indices.

[223] Estimate alpha, composite reliability, AVE, KMO, Bartlett test, factor structure and HTMT.

[224] Use split-sample or cross-validated predictive models and report calibration alongside discrimination.

[225] Conduct sensitivity analysis for weights, thresholds, missing-data rules and subgroup definitions.

[226] Archive code, data dictionary, instrument version, random seed, analytic decisions and limitations.

[227] Submission note

[228] Before journal submission, the synthetic pre-pilot results should be accompanied by the analysis code and clearly labelled in the title, abstract, methods, tables and data statement. After field data are collected, the synthetic section should be retained as instrument-development evidence or moved to supplementary materials rather than blended with observed results.

[229] Data-source links

[230] Mendeley Data: DataCo SMART Supply Chain dataset Link

[231] Kaggle mirror: DataCo SMART Supply Chain for Big Data Analysis Link

[232] NIST CSF 2.0: Cybersecurity Framework 2.0 Link

@article{1722514,
      author = {Nkosana Mkandla, Marlon Munjoma, Melody Sydney, Flora Phiri, Munashe Naphtali Mupa},
      title = {A Practical Digital-Transformation Maturity and Delivery-Readiness Framework for U.S. SMEs and Small Government Vendors: Development, Pre-Pilot Psychometric Validation and Operational Benchmark Calibration},
      journal = {Iconic Research And Engineering Journals},
      year = {2026},
      volume = {10},
      number = {2},
      pages = {3097-3126},
      issn = {2456-8880},
      url = {https://www.irejournals.com/formatedpaper/1722514.pdf},
      abstract = {Digital transformation in small and medium-sized enterprises (SMEs) is frequently measured by technology adoption rather than by the operating capability created after adoption. This study develops a practical Digital-Transformation Maturity and Delivery-Readiness Framework for U.S. SMEs and small government vendors. The framework integrates seven domains: process integration, ERP readiness, data quality, internal controls, cyber hygiene, user adoption and delivery capability. A 28-item instrument was constructed through design-science synthesis of digital transformation, information-systems success, ERP, data-governance, control, cybersecurity and maturity-model research. Pre-pilot validation used a fully disclosed synthetic panel of 720 hypothetical firms and an external operational benchmark derived from 70,000 DataCo supply-chain records covering 44,026 unique orders and 229 market-department-segment-period units. The synthetic panel was designed to test factor recovery, reliability, discriminant validity, scoring sensitivity and predictive behavior before human-subject deployment. Kaiser-Meyer-Olkin adequacy was 0.936; Bartlett's test was significant (chi-square=9398.6, df=378, p<0.001); and the intended seven-factor structure explained 67.4% of item variance. Construct alpha coefficients ranged from 0.817 to 0.852, composite reliability from 0.880 to 0.901, and average variance extracted from 0.647 to 0.694. The maximum heterotrait-monotrait ratio was 0.639. Five-fold cross-validated logistic regression predicted implementation readiness with AUC=0.799, while linear regression predicted delivery performance with R-squared=0.784. Index rankings remained highly stable across equal, outcome-derived and risk-balanced weights (Spearman rho at least 0.995). Maturity stages showed monotonic increases in readiness and reliable delivery. The contribution is an instrument, scoring architecture, risk heat-map method, benchmark dashboard and staged roadmap that can be tested prospectively. The paper explicitly limits inference: the findings establish pre-pilot measurement plausibility, not population prevalence or causal impact. A multi-site U.S. validation protocol is specified for the next phase.},
      keywords = {digital transformation; maturity model; ERP readiness; SME; government vendor; data quality; internal controls; cyber hygiene; user adoption; delivery readiness; psychometric validation},
      month = {August},
      doi = {https://doi.org/10.64388/IREV10I2-1722514}
  }