Building a Risk and Control Matrix: A Practical Guide for Growing Companies

A risk and control matrix — often called an RCM — is the backbone of internal financial controls. It lists, process by process, what could go wrong and what stops it from happening. This guide explains how to build one for a growing company.

Step 1: Pick the Processes

Start with the processes that drive significant balances in your financial statements. For most companies, these are:

• Order to cash: sales, billing and collections.
• Procure to pay: purchasing, receiving and payments.
• Inventory: movement, costing and counts.
• Payroll: hiring, attendance, salary and deductions.
• Fixed assets: acquisition, depreciation and disposal.
• Financial close and reporting.
• IT general controls: access, changes and backups.

Step 2: Walk Through Each Process

Follow one transaction from start to finish with the people who handle it. Document what actually happens, not what the policy says should happen.

Step 3: Identify the Risks

For each step, ask what could go wrong that would affect the accounts. For example, in procure to pay: paying for goods not received, paying the wrong vendor, paying twice, or recording purchases in the wrong period.

Step 4: Describe the Controls

For each risk, record the control that addresses it: what it is, who performs it, how often, and whether it's manual or automated. For example: 'Payments are released only after the accounts team matches the invoice to a purchase order and goods receipt note; the finance manager approves each payment run.'

Step 5: Assess Design

Ask whether each control, if performed, would actually address the risk. A control that doesn't cover the risk is a design gap.

Step 6: Test Operating Effectiveness

Pick a sample of transactions and check whether the control was actually performed each time, with evidence. A well-designed control that isn't consistently performed is an operating gap.

Step 7: Fix and Retest

Address gaps with new or strengthened controls, then retest after they've had time to operate.

Tips

• Keep control descriptions specific: who, what, when, and what evidence is left.
• Prefer preventive controls, like approvals, over detective ones where possible.
• Use system controls, like approval workflows, to reduce reliance on people.
• Update the RCM whenever processes or systems change.

Getting Help

Think Filing builds risk and control matrices for growing companies and tests them ahead of the auditor's IFC reporting.