What it is
Scores risks by likelihood and impact before and after controls, with owners and actions.
A blank working form with [bracketed placeholders] for client, period and sign-off. Adapt it to your firm’s methodology; sample sizes and thresholds are your own decisions.
When to use it
- SOX 404 or ICFR engagements, internal audit and control reviews.
- Financial statement audits where you test or rely on controls.
What’s inside
- Risk listing with category and owner
- Inherent and residual scoring
- Scale guide to replace with your own
Standard cited
This template follows COSO ERM. It is written in our own words, except for phrases the standard requires the document to contain, with [bracketed placeholders] for client details, amounts in USD and dates as MM/DD/YYYY. Check it against the current standard and your firm’s methodology before use.
Questions
Is this template tied to a specific methodology?
No. It is a neutral working form. Replace the headings and columns with your firm’s methodology where they differ, and set sample sizes and thresholds under that methodology.
Related templates
- Audit Risk Assessment Worksheet (SAS 145)
- Root Cause Analysis (5 Whys and Fishbone)
- SOX Risk and Control Matrix (RCM)
Last updated 11/04/2026. All free templates.