Risk & Control Matrix Template

Without a clear risk and control matrix, testing tends to follow whatever documents are easiest to obtain rather than the risks that matter. This template gives you a structured working paper that links objectives, risks, controls, owners, evidence and audit tests.

Use it after walkthroughs, once you understand how the process operates. The header records process, owner, period, preparer, reviewer and version. Part 1 captures the business objective and desired outcome, the risk event and its cause or driver, followed by control design: control description, control owner, and frequency and evidence. Part 2 records the audit response: whether the control is key or non-key, the planned test method and the result or conclusion. A working table lets you list each risk with its control, owner and frequency, evidence and audit test.

The worked example shows the expected level of detail: the risk of an unauthorized vendor bank change, controlled by an independent callback to a verified supplier contact before activation, and tested by inspecting the change log and callback evidence. The completion page includes a final quality check, prepared-by and reviewed-by sign-off, the final conclusion and outstanding follow-up, so the matrix links planning, fieldwork and conclusions in one document.