1. Introduction to the Technique
A Risk Control Matrix (RCM) is a practical internal audit tool used to link key risks, controls, control objectives, and testing procedures. It provides a structured view of the risk environment within a process, ensuring nothing important is overlooked. Internal auditors use RCMs to plan fieldwork, identify control gaps, and document assurance coverage. It promotes clarity, traceability, and efficiency in audit execution.

2. Template for Applying the RCM
An effective RCM typically includes the following columns:

• Process/Activity

• Risk Description

• Control Objective

• Existing Controls

• Control Owner

• Control Frequency

• Control Type (Preventive/Detective)

• Testing Procedures

• Audit Findings (if any)

3. Practical Example: ACME’s Procurement Process
At ACME Corp, Internal Auditor Auren is assigned to audit the procurement process. Working with Project Manager Aven and the Finance Team, Auren builds an RCM:

• Process/Activity: Vendor selection and purchase order approval

• Risk: Unauthorized or duplicate purchases

• Control Objective: Ensure purchases are valid, authorized, and recorded once

• Controls: Dual approval workflow; vendor master file controls

• Control Owner: Procurement Supervisor

• Frequency: Per transaction

• Type: Preventive

• Testing Procedure: Sample test 15 purchase orders for approvals and duplicates

During fieldwork, Auren identifies that some urgent purchases bypassed approvals through manual workarounds. This becomes a key audit finding. The RCM helped Auren maintain clarity, align testing with actual risks, and facilitate meaningful discussions with CEO Liora on strengthening process discipline. Using RCMs ensures the audit is focused, evidence-based, and value-driven.