Stops errorsPreventive
Approval before payment, system validation.
TimingBefore
Chartered Accountants in India, working with clients across Europe
Chartered Accountants in India, working with clients across Europe
A risk control matrix lists what could go wrong in each process, the control that stops it, who runs the control and how it is tested. It is the backbone of internal financial controls in India and of group control frameworks in Europe. Pick a process to see an example.
Control: new vendors are approved by someone outside purchasing, with bank details verified. Duplicate invoice checks run before each payment.
Control: month-end review of goods dispatched against invoices raised, signed off by finance.
Control: journals above a set amount need a second approver, with a monthly review of all manual entries.
Control: HR leaver lists reconciled to payroll before each run.
Control: periodic counts by people independent of the stores, with differences investigated.
Control: quarterly review of system access by process owners, with leavers removed at once.
Illustrative examples. Your RCM is built around your own processes and systems.
Indian company law expects directors to make sure adequate internal financial controls are in place, and auditors of many companies report on whether those controls over financial reporting work.
An RCM turns “we have good controls” into a document that names each risk, control, owner and test.
For subsidiaries of European groups, the same matrix usually feeds the group’s own control framework, so it must speak both languages.
| Column | What it records |
|---|---|
| Process and sub-process | Where in the business the risk sits |
| Risk | What could go wrong and its effect on the accounts |
| Control | The activity that prevents or detects it |
| Owner and frequency | Who performs it and how often |
| Type | Preventive or detective, manual or automated |
| Test steps | How the control is checked, and the sample size |
Approval before payment, system validation.
Reconciliations and exception reports.
Reviews and sign-offs by staff.
Built-in system rules and limits.
Based on materiality and the auditor’s needs.
Meet process owners and follow transactions end to end.
Risks, controls, owners and test steps, with process notes.
New or improved controls agreed with management.
Testing and a report management and auditors can rely on.
An RCM supports internal audit, statutory audit and forensic work.
We document controls for Indian companies of groups from every EU country, Switzerland and Norway.
Tell us about your processes, systems and auditor’s needs. We’ll propose a scope and timeline.
General guidance on internal controls under the Companies Act, 2013 and common control frameworks. Your auditor’s requirements should be confirmed for your company.