CORAA

Order-to-Cash (O2C) Risk & Control Matrix Template

A ready risk-and-control matrix for the Order-to-Cash / revenue cycle — credit approval through dispatch, invoicing and receivables recovery — with risks, controls and control objectives mapped, and space for your own test results.

Free · CORAA original — SA-aligned
Updated 28 Jul 2026
Standard
SIA 220 / SIA 330
Cycle
Order-to-Cash (O2C)
Overlaps
SA 240 revenue fraud-risk considerations
Format
Microsoft Word (.docx)
Share this template
Your firm — letterhead
Appears at the top of the document as the audit firm letterhead.
Used as the letterhead block.
Engagement details
The client and period this document is for.
What’s inside

An excerpt from the template.

ORDER-TO-CASH (O2C) RISK & CONTROL MATRIX

Entity: ___ · Period: ___

Scope: the Order-to-Cash cycle from credit approval through dispatch, invoicing and receivables recovery. Prepared per SIA 220 and SIA 330; revenue cut-off and fictitious-invoice risks in this matrix overlap with the fraud-risk considerations under SA 240 on the statutory side.

Risk & Control Matrix

↑ Excerpt only — the full template is what you download as Word
About this template

What you’re downloading, and when to use it.

This template follows the format published by the Institute of Chartered Accountants of India (ICAI) in the AASB Audit Working Paper Templates (June 2023), the authoritative reference for Indian statutory-audit documentation. Fill in your firm’s letterhead and the engagement details on the form above, click Download Word file, and you’ll get a fully formatted .docx ready to use.

Everything is generated in your browser and on a stateless API endpoint — no account, nothing stored on our servers. We’ll ask for a work email once before your first download so we can send you the file and the occasional relevant update; after that, downloads on this device are instant. Edit freely in Word, Google Docs or Pages before sending to your client.

Common questions

FAQs.

Why does the O2C matrix treat revenue cut-off as a control risk rather than just an audit procedure?
Cut-off manipulation around period-end (pulling forward next period's dispatches, or delaying a return) is a common way revenue gets misstated, and it is exactly the kind of risk a control — a routine dispatch-to-invoice reconciliation performed every period, not just at year-end — is meant to catch before it becomes a reporting problem.
How does the credit-limit control here relate to bad-debt risk?
Enforcing the sanctioned credit limit at the point of order booking (not after dispatch) is the preventive control that keeps exposure to any one customer bounded — it is the first line of defence against bad debts building up, which is why it is tested before the receivables-recovery control further down the cycle.
What does "ageing-driven recovery ownership" mean in practice?
It means a named individual is accountable for collection on each ageing bucket (e.g. 0-30, 31-60, 61-90, 90+ days) rather than collections being nobody's specific job — assigning ownership by bucket is what turns an ageing report into an actual control instead of just a report nobody acts on.
Related templates

You might also need.

Procure-to-Pay (P2P) Risk & Control Matrix Template
Free Procure-to-Pay (P2P) internal audit RCM template. Risks, controls and control objectives for vendor onboa
Trade Receivables Audit Working Paper — ICAI Audit Working Paper
Free trade receivables audit working paper audit working paper template (ICAI, Chapter 3). Generate with your
Revenue from Operations Audit Working Paper (Ind AS 115) — ICAI Audit Working Paper
Free revenue from operations audit working paper (ind as 115) audit working paper template (ICAI, Chapter 3).