What it is
This matrix covers the IT general controls over the systems that support financial reporting: access to programs and data, program change, computer operations and backup. These controls matter because automated controls and system reports are only reliable if the systems are.
Each row links a risk to a control, with assertions, owner, frequency, preventive or detective type, nature, key control flag, COSO component, evidence and test approach. A Summary tab counts controls by frequency, type, nature and component and checks that every key control is complete.
When to use it
- When documenting controls for management’s evaluation of internal control over financial reporting.
- When internal audit or the external auditor plans testing and needs to see risks and controls side by side.
- When a process changes and the control set needs updating.
What’s inside
- RCM tab with 40 rows and sample rows for the process
- Drop-downs for frequency, type, nature, key control and COSO component
- Check column for risks without controls and key controls with gaps
- Ten sample rows across access, change, operations and segregation of duties
Standard cited
This template follows COSO 2013 / ICFR. It is written in our own words, except for phrases the standard requires the document to contain, with [bracketed placeholders] for client details, amounts in USD and dates as MM/DD/YYYY. Check it against the current standard and your firm’s methodology before use.
Questions
What makes a control a key control?
A key control is one that, alone or with others, adequately addresses a risk of material misstatement. If it fails, no other control would catch the misstatement on a timely basis. Mark a control key only on that test, and keep the list consistent with your scoping.
Are the sample rows a complete set of IT general controls controls?
No. They show the level of detail to aim for. Replace them with the controls your entity actually runs, and add a row for every risk you identify.
Related templates
Last updated 11/05/2026. All free templates.