What it is
This matrix covers the period-end financial reporting process. The close is where management override can happen, so journal entries and the review of estimates carry fraud risk, and the review controls need to say who reviews, what they look at and what triggers investigation.
Each row links a risk to a control, with assertions, owner, frequency, preventive or detective type, nature, key control flag, COSO component, evidence and test approach. A Summary tab counts controls by frequency, type, nature and component and checks that every key control is complete.
When to use it
- When documenting controls for management’s evaluation of internal control over financial reporting.
- When internal audit or the external auditor plans testing and needs to see risks and controls side by side.
- When a process changes and the control set needs updating.
What’s inside
- RCM tab with 40 rows and sample rows for the process
- Drop-downs for frequency, type, nature, key control and COSO component
- Check column for risks without controls and key controls with gaps
- Nine sample rows from journal entries to the close calendar
Standard cited
This template follows COSO 2013 / ICFR. It is written in our own words, except for phrases the standard requires the document to contain, with [bracketed placeholders] for client details, amounts in USD and dates as MM/DD/YYYY. Check it against the current standard and your firm’s methodology before use.
Questions
What makes a control a key control?
A key control is one that, alone or with others, adequately addresses a risk of material misstatement. If it fails, no other control would catch the misstatement on a timely basis. Mark a control key only on that test, and keep the list consistent with your scoping.
Are the sample rows a complete set of financial close controls?
No. They show the level of detail to aim for. Replace them with the controls your entity actually runs, and add a row for every risk you identify.
Related templates
- Journal Entry Risk Criteria Worksheet
- Control Test Script: Manual Journal Entry Approval
- SOX Risk and Control Matrix (RCM)
- SOX Control Test Workpaper (TOD / TOE)
- SOX Control Narrative (ICFR)
Last updated 11/05/2026. All free templates.