{"id":864,"date":"2020-01-04T12:26:58","date_gmt":"2020-01-04T12:26:58","guid":{"rendered":"https:\/\/alminawi.com\/?p=864"},"modified":"2025-12-07T18:21:35","modified_gmt":"2025-12-07T18:21:35","slug":"tts-series-d-internal-audit-risk-assessment-planning-episode-03-risk-control-matrix-rcm","status":"publish","type":"post","link":"https:\/\/e.americanpro.org\/?p=864","title":{"rendered":"T&Ts Series D, Internal Audit, Risk Assessment & Planning, Episode 03: Risk Control Matrix (RCM)"},"content":{"rendered":"
\n
\n
\n
\n
\n
\n
\n
\n
\n

1. Introduction to the Technique<\/strong>
A Risk Control Matrix (RCM)<\/strong> is a practical internal audit tool used to link key risks, controls, control objectives, and testing procedures. It provides a structured view of the risk environment within a process, ensuring nothing important is overlooked. Internal auditors use RCMs to plan fieldwork, identify control gaps, and document assurance coverage. It promotes clarity, traceability, and efficiency in audit execution.<\/p>\n

2. Template for Applying the RCM<\/strong>
An effective RCM typically includes the following columns:<\/p>\n

    \n
  • \n

    Process\/Activity<\/strong><\/p>\n<\/li>\n

  • \n

    Risk Description<\/strong><\/p>\n<\/li>\n

  • \n

    Control Objective<\/strong><\/p>\n<\/li>\n

  • \n

    Existing Controls<\/strong><\/p>\n<\/li>\n

  • \n

    Control Owner<\/strong><\/p>\n<\/li>\n

  • \n

    Control Frequency<\/strong><\/p>\n<\/li>\n

  • \n

    Control Type (Preventive\/Detective)<\/strong><\/p>\n<\/li>\n

  • \n

    Testing Procedures<\/strong><\/p>\n<\/li>\n

  • \n

    Audit Findings (if any)<\/strong><\/p>\n<\/li>\n<\/ul>\n

    3. Practical Example: ACME\u2019s Procurement Process<\/strong>
    At ACME Corp, Internal Auditor Auren<\/strong> is assigned to audit the procurement process. Working with Project Manager Aven<\/strong> and the Finance Team, Auren builds an RCM:<\/p>\n

      \n
    • \n

      Process\/Activity:<\/strong> Vendor selection and purchase order approval<\/p>\n<\/li>\n

    • \n

      Risk:<\/strong> Unauthorized or duplicate purchases<\/p>\n<\/li>\n

    • \n

      Control Objective:<\/strong> Ensure purchases are valid, authorized, and recorded once<\/p>\n<\/li>\n

    • \n

      Controls:<\/strong> Dual approval workflow; vendor master file controls<\/p>\n<\/li>\n

    • \n

      Control Owner:<\/strong> Procurement Supervisor<\/p>\n<\/li>\n

    • \n

      Frequency:<\/strong> Per transaction<\/p>\n<\/li>\n

    • \n

      Type:<\/strong> Preventive<\/p>\n<\/li>\n

    • \n

      Testing Procedure:<\/strong> Sample test 15 purchase orders for approvals and duplicates<\/p>\n<\/li>\n<\/ul>\n

      During fieldwork, Auren identifies that some urgent purchases bypassed approvals through manual workarounds. This becomes a key audit finding. The RCM helped Auren maintain clarity, align testing with actual risks, and facilitate meaningful discussions with CEO Liora<\/strong> on strengthening process discipline. Using RCMs ensures the audit is focused, evidence-based, and value-driven.<\/p>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n

      \n
      \n

       <\/p>\n

      <\/div>\n<\/div>\n<\/div>\n
      \n
      <\/div>\n<\/div>\n<\/div>\n
      \n
      <\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/article>\n
      <\/div>\n","protected":false},"excerpt":{"rendered":"

      1. Introduction to the TechniqueA Risk Control Matrix (RCM) is a practical internal audit tool used to link key risks, controls, control objectives, and testing procedures. It provides a structured view of the risk environment within a process, ensuring nothing important is overlooked. Internal auditors use RCMs to plan fieldwork, identify control gaps, and document […]<\/p>\n","protected":false},"author":2,"featured_media":808,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[22],"tags":[],"class_list":["post-864","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-tt-internal-audit"],"jetpack_sharing_enabled":true,"jetpack_featured_media_url":"https:\/\/e.americanpro.org\/wp-content\/uploads\/2025\/06\/16.png","_links":{"self":[{"href":"https:\/\/e.americanpro.org\/index.php?rest_route=\/wp\/v2\/posts\/864","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/e.americanpro.org\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/e.americanpro.org\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/e.americanpro.org\/index.php?rest_route=\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/e.americanpro.org\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=864"}],"version-history":[{"count":1,"href":"https:\/\/e.americanpro.org\/index.php?rest_route=\/wp\/v2\/posts\/864\/revisions"}],"predecessor-version":[{"id":1316,"href":"https:\/\/e.americanpro.org\/index.php?rest_route=\/wp\/v2\/posts\/864\/revisions\/1316"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/e.americanpro.org\/index.php?rest_route=\/wp\/v2\/media\/808"}],"wp:attachment":[{"href":"https:\/\/e.americanpro.org\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=864"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/e.americanpro.org\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=864"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/e.americanpro.org\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=864"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}