What it is
This matrix covers the personnel and payroll cycle. Payroll is usually a large expense with low individual risk and a real risk of insider fraud, so the matrix pairs the master data controls with a review of the payroll register.
Each row links a risk to a control, with assertions, owner, frequency, preventive or detective type, nature, key control flag, COSO component, evidence and test approach. A Summary tab counts controls by frequency, type, nature and component and checks that every key control is complete.
When to use it
- When documenting controls for management’s evaluation of internal control over financial reporting.
- When internal audit or the external auditor plans testing and needs to see risks and controls side by side.
- When a process changes and the control set needs updating.
What’s inside
- RCM tab with 40 rows and sample rows for the process
- Drop-downs for frequency, type, nature, key control and COSO component
- Check column for risks without controls and key controls with gaps
- Nine sample rows from hiring to payroll reconciliation, with no pay figures
Standard cited
This template follows COSO 2013 / ICFR. It is written in our own words, except for phrases the standard requires the document to contain, with [bracketed placeholders] for client details, amounts in USD and dates as MM/DD/YYYY. Check it against the current standard and your firm’s methodology before use.
Questions
What makes a control a key control?
A key control is one that, alone or with others, adequately addresses a risk of material misstatement. If it fails, no other control would catch the misstatement on a timely basis. Mark a control key only on that test, and keep the list consistent with your scoping.
Are the sample rows a complete set of payroll controls?
No. They show the level of detail to aim for. Replace them with the controls your entity actually runs, and add a row for every risk you identify.
Related templates
- Control Test Script: Payroll Master Data Changes
- SOX Risk and Control Matrix (RCM)
- SOX Control Test Workpaper (TOD / TOE)
- SOX Control Narrative (ICFR)
Last updated 11/05/2026. All free templates.