Glossary term
Risk Control Matrix (RCM)
Subject: Risk Management, Controls and Risk Treatment
Also known as: RCM, Risk and control matrix
A risk control matrix is a table that lists the risks in a process, the controls meant to address each one, who owns them, and how often they run. It is a working record of control coverage.
Explanation
The matrix links each identified risk to one or more controls in a single table. Typical columns are the process step, the risk, the control description, control type (preventive or detective, manual or automated), frequency, owner, and the evidence kept. Some also hold the inherent and residual risk rating and the testing result. Teams build it when they document a process, and then use it to find gaps, where a risk has no control, and overlaps, where several controls cover the same risk. Internal audit uses it to plan tests and the second line uses it to review coverage. In financial reporting it is the base for assessing internal control over financial reporting. Auditors open it first when scoping tests, and spot quickly when it describes a process that no longer exists.
Example
A university documents its supplier payment process. The matrix lists eight risks, including duplicate payment and payment to a fictitious supplier, with one to three controls against each. While reviewing it, the team sees that fictitious supplier risk depends on a single manual check by one clerk. They add a system rule and an independent review of new supplier set-ups.
Not to be confused with
- Risk Register
- A register records risks across the organisation with ratings and actions. A control matrix maps risks in a process to the specific controls that address them.