Course Overview

Course Objective: The Risk & Control Matrix is where auditing actually happens. This module is purely practical and hands-on – to enable participants to move from theoretical risks to a documented, testable RCM, identify what really matters [key risks & key controls], and directly link it to audit procedures that generate quality findings.  

1. Preparing Risk & Control Matrix [RCM]

• What is an RCM and why it is the single most important working paper in any audit
• Structure of a best-practice RCM: Process – Sub-process – Risk – Risk Type – Impact – Control Objective – Control ID – Control Description – Control Type – Frequency – Owner – Design Assessment
• Step-by-step approach to building RCM: From process understanding to documentation
• Inherent Risk vs. Residual Risk linkage within RCM
• Common mistakes: Writing controls as processes, vague control descriptions, and duplicating risks
• Practical Exercise: Drafting an RCM for P2P / O2C / Payroll process[SOPs][walkthroughs][interviews]

1. Identifying Key Risks & Controls*

• How to identify risks: What can go wrong [WCGW] approach, risk library, past findings, and fraud scenarios
• Categorization of risks: Financial, Operational, Compliance, IT, and Fraud risk
• What makes a control a KEY control: Materiality, ability to prevent/detect material risk, and management judgment
• Types of controls: Preventive vs. Detective vs. Corrective; Manual vs. Automated vs. IT Dependent Manual; Entity Level vs. Process Level vs. Transaction Level
• Understanding Control Design: Is the control alone or in combination capable of mitigating the risk? – Control adequacy assessment
• Linkage with COSO 2013 framework: Mapping controls to COSO principles

1. Testing Techniques [Design & Operating Effectiveness]*

• Difference between Design Effectiveness Testing [DET] and Operating Effectiveness Testing [OET] – and why both are mandatory
• Design Effectiveness: Inquiry, observation, inspection, walkthrough, and re-performance – How to conclude if control is well-designed
• Operating Effectiveness: Sampling methodologies [Statistical vs. Judgmental], sample sizes as per IIA and audit practice, and period of testing
• Testing for different control types:
• Manual controls – Evidence inspection and maker-checker logic
• Automated controls – IT application controls, configuration review
• IT Dependent Manual Controls [IDMC] – Testing both the report logic and the manual review
• Evaluating exceptions: Is it a design gap, operating failure, or isolated incident? Impact analysis

1. Linking RCM with Audit Procedures*

• How RCM drives the entire audit program: No RCM, No Audit Program
• From RCM to Audit Procedures: Writing precise audit steps to test each key control – What to do, how to do, and what evidence to obtain
• Traceability: How to cross-reference RCM – Audit Program – Working Papers – Audit Finding for complete audit trail
• Using RCM to conclude: If controls fail, what is the residual risk exposure? If controls pass, can we conclude the process is controlled?
• RCM as a living document: Updating it based on testing results and management feedback
• Using RCM for reporting: Converting control gaps into impactful audit issues with root cause and risk exposure

  Learning Outcome By the end of this module, participants will be able to independently prepare a detailed, audit-ready RCM, distinguish key controls from non-key controls, apply appropriate testing techniques for design and operating effectiveness, and seamlessly link the RCM with audit procedures and findings.