A risk and control matrix (RCM) is a table that links what could go wrong in a business process to the controls that address it, and to the assertions and tests that go with them. It is the working document for ICFR assessments, SOX 404 programs, internal audit scoping and the control portion of a financial statement audit. A good RCM answers four questions on one page: what is the risk, which control addresses it, who performs the control, and how do we know it worked.
This guide covers the columns, the process for building one, sample rows for three processes, how the matrix connects to COSO and to tests of controls, and the mistakes that make an RCM unusable.
What goes in an RCM
| Column | What it holds |
|---|---|
| Process and sub-process | Revenue to cash, procure to pay, payroll, financial close, treasury, IT |
| Risk ID and description | What could go wrong, stated as an event, not a topic |
| Assertion(s) | Existence, completeness, accuracy, cutoff, classification, valuation, presentation |
| Control ID and description | Who does what, how often, using what information, and what evidence remains |
| Control owner | A named role, not a department |
| Frequency | Annual, quarterly, monthly, weekly, daily, multiple times a day, event-driven |
| Nature | Preventive or detective; manual, automated or IT-dependent manual |
| Key or non-key | Whether the control is relied on to address the risk |
| COSO component or principle | Control activities, monitoring, entity-level and so on |
| Information used | Reports or data the control depends on, which raises information-produced-by-the-entity questions |
| Test procedure and result | How design and operating effectiveness are tested, and the outcome |
See audit assertions for the assertion vocabulary and information produced by the entity for the reliability of reports used in controls.
How to build one
- Scope the entity. Identify significant accounts and disclosures from the trial balance and materiality, then link them to processes and locations. See materiality.
- Walk through each process from initiation to the general ledger. See walkthrough.
- Write risks as events. "Revenue is recorded for goods not shipped" is a risk. "Revenue" is not.
- Map controls to risks. Each risk should have at least one control, and each control should address a named risk. A control with no risk is overhead. A risk with no control is a gap.
- Select key controls. Choose those that address the risk most directly and that, if they failed, could let a material misstatement through. Redundant controls can stay in the process narrative but not in the key list.
- Define the evidence. For each key control, state what documentation is retained, so a tester can reperform it.
- Add the entity-level layer. Tone, code of conduct, board oversight and monitoring. See entity-level controls and the COSO framework guide.
- Plan testing. Set the test of design, test of operation, sample size by frequency and the period. See tests of controls and the attribute sampling worksheet.
- Evaluate deficiencies. Link exceptions to a deficiency evaluation. See control deficiency.
Sample rows
| Item | Revenue to cash | Procure to pay | Financial close |
|---|---|---|---|
| Risk | Revenue is recorded for shipments that did not occur | A payment is made to a fictitious or duplicate vendor | Unsupported manual journal entries change results |
| Assertion | Occurrence, cutoff | Occurrence, accuracy | Occurrence, accuracy, classification |
| Control | Billing clerk matches each invoice to a signed shipping document before posting; the system blocks invoices without a shipment record | Controller reviews the weekly vendor master change report against approved change forms and reviews payments over $10,000 for support | Controller reviews every manual journal entry over $5,000 before posting, with preparer and approver recorded in the system |
| Owner | Billing supervisor | Controller | Controller |
| Frequency | Each invoice | Weekly | Each entry |
| Nature | Preventive, automated and manual | Detective, manual (uses a system report) | Preventive, manual |
| Key | Yes | Yes | Yes |
| Test | Reperform the match for a sample of invoices; test the system block by attempting a posting without shipment in a test environment | Inspect signed review evidence for a sample of weeks; agree the report to system data | Select entries from the journal entry listing and inspect for review evidence and support |
The thresholds in the example are illustrative. A threshold in a control description should be tied to a risk-based amount, such as performance materiality.
Control attributes that affect testing
- Precision. A control that investigates differences at a small threshold is more precise than one at a large threshold. The tester needs to know what the control was designed to catch.
- Information used. If the control uses a report, test the completeness and accuracy of that report or rely on tested IT controls. See IT general controls.
- Frequency. The number of occurrences drives sample size. Firms set minimum samples by frequency.
- Segregation. The person performing a control should not be the same person who prepared the item. See segregation of duties and the conflict matrix template.
- Management review controls. These need evidence of what the reviewer looked at, the expectation, the threshold and the follow-up on differences. A signature alone is thin evidence.
RCM vs related documents
| Document | Purpose |
|---|---|
| Risk register | Entity-level risks with likelihood and impact, usually not linked to specific controls |
| Process narrative or flowchart | Describes how the process works |
| RCM | Links risks to controls and tests |
| Test workpaper | Records testing and results for each control |
See the risk register template, the SOX risk and control matrix template and the control test workpaper.
Using the RCM in an audit
In a financial statement audit under AU-C 315, the auditor identifies risks of material misstatement at the assertion level and controls that address them. The RCM is a convenient format for recording those risks and controls. Controls are tested for operating effectiveness when the auditor plans to rely on them or when substantive procedures alone cannot provide sufficient appropriate evidence; for the rest, the auditor performs substantive procedures. The matrix is also useful for the communication of significant deficiencies and material weaknesses under AU-C 265. See SAS 145 risk assessment and substantive testing vs tests of controls.
Common mistakes
- Listing every control instead of the key ones, which inflates testing.
- Control descriptions that read "management reviews" with no who, how often, what or evidence.
- Risks stated as account names.
- No link from controls to the information they depend on.
- A matrix built once and never updated after a system or process change.
- Mapping controls to assertions without checking that the control addresses the assertion.
FAQ
What is a risk and control matrix?
A table linking process risks to the controls that address them, the assertions affected and the tests performed.
What is the difference between a risk register and an RCM?
A risk register ranks entity risks by likelihood and impact. An RCM ties specific process risks to specific controls and tests.
How many controls should an RCM have?
As many key controls as are needed to address each significant risk and no more. Adding controls that do not address a distinct risk adds cost and no assurance.
Who owns the RCM?
Management owns the controls and the matrix. Auditors use and test it but should not take over ownership if they need to remain independent.
Does a private company need an RCM?
None is required for a typical private company. It is useful for lender requirements, readiness for a sale or an IPO, and for structuring the auditor's control understanding.
Sources
- COSO, Internal Control, Integrated Framework (2013)
- AICPA, AU-C section 315 (as amended by SAS No. 145), AU-C section 330 and AU-C section 265
- PCAOB, AS 2201, An Audit of Internal Control Over Financial Reporting That Is Integrated with An Audit of Financial Statements
Part of CORAA University · Internal controls and SOX: related guides, calculators and templates.
AU-C references are to AICPA Professional Standards, paraphrased here; read the standard itself before relying on a requirement. This page is guidance, not professional advice. Report an error