What it is
This matrix covers the controls that sit above the processes and shape the control environment, the risk assessment, communication and monitoring. Some operate with precision, such as a monitoring control that investigates variances over a threshold, and can be key. Broad ones such as a code of conduct support the environment but do not alone prevent or detect a misstatement.
Each row links a risk to a control, with assertions, owner, frequency, preventive or detective type, nature, key control flag, COSO component, evidence and test approach. A Summary tab counts controls by frequency, type, nature and component and checks that every key control is complete.
When to use it
- When documenting controls for management’s evaluation of internal control over financial reporting.
- When internal audit or the external auditor plans testing and needs to see risks and controls side by side.
- When a process changes and the control set needs updating.
What’s inside
- RCM tab with 40 rows and sample rows for the process
- Drop-downs for frequency, type, nature, key control and COSO component
- Check column for risks without controls and key controls with gaps
- Ten sample rows across the five COSO components
Standard cited
This template follows COSO 2013 / ICFR. It is written in our own words, except for phrases the standard requires the document to contain, with [bracketed placeholders] for client details, amounts in USD and dates as MM/DD/YYYY. Check it against the current standard and your firm’s methodology before use.
Questions
What makes a control a key control?
A key control is one that, alone or with others, adequately addresses a risk of material misstatement. If it fails, no other control would catch the misstatement on a timely basis. Mark a control key only on that test, and keep the list consistent with your scoping.
Are the sample rows a complete set of entity-level controls?
No. They show the level of detail to aim for. Replace them with the controls your entity actually runs, and add a row for every risk you identify.
Related templates
Last updated 11/05/2026. All free templates.