What it is
This matrix covers property and equipment and the lease accounting that sits beside it. The risks are capitalizing what should be expensed, depreciation inputs, unrecorded disposals and impairment.
Each row links a risk to a control, with assertions, owner, frequency, preventive or detective type, nature, key control flag, COSO component, evidence and test approach. A Summary tab counts controls by frequency, type, nature and component and checks that every key control is complete.
When to use it
- When documenting controls for management’s evaluation of internal control over financial reporting.
- When internal audit or the external auditor plans testing and needs to see risks and controls side by side.
- When a process changes and the control set needs updating.
What’s inside
- RCM tab with 40 rows and sample rows for the process
- Drop-downs for frequency, type, nature, key control and COSO component
- Check column for risks without controls and key controls with gaps
- Eight sample rows from capital approval to lease schedules
Standard cited
This template follows COSO 2013 / ICFR. It is written in our own words, except for phrases the standard requires the document to contain, with [bracketed placeholders] for client details, amounts in USD and dates as MM/DD/YYYY. Check it against the current standard and your firm’s methodology before use.
Questions
What makes a control a key control?
A key control is one that, alone or with others, adequately addresses a risk of material misstatement. If it fails, no other control would catch the misstatement on a timely basis. Mark a control key only on that test, and keep the list consistent with your scoping.
Are the sample rows a complete set of fixed assets controls?
No. They show the level of detail to aim for. Replace them with the controls your entity actually runs, and add a row for every risk you identify.
Related templates
Last updated 11/05/2026. All free templates.