Managing Information Technology: Risk and Control Matrix (Excel)
32 controls (21 key) for 10 objectives and 16 risks, each with walkthrough questions, evidence to ask for and test steps.
Risk Control Matrix · editable Excel · 3 sheets · ₹149 / $1.49 · lifetime access, up to 5 downloads
This matrix covers IT governance and strategy, systems acquisition and development, change management, IT operations, logical access (provisioning, removal, privileged access and periodic review), cyber security (vulnerability and patch management, endpoint and network protection, monitoring and incident response), backup and recovery, IT vendors and cloud services, and IT assets. For detailed IT general controls testing, use it alongside COBIT 2019 or your ITGC framework. For every control you see what good looks like, whether it is preventive or detective, manual or automated, how often it runs and whether it is a key control, plus the walkthrough questions, evidence to request and steps to test it. Record what you find, the control owner and any gap in the same sheet: the Summary sheet counts effective, partly effective and ineffective controls by objective as you go. Written so that an auditor new to the process can use it, and detailed enough for experienced reviewers. Editable Excel.
What's inside
- Read Me: how the matrix is laid out and how to use it in an audit
- Risk-Control Matrix: 10 objectives, 16 risks and 32 controls (21 key)
- Each control: type, nature, frequency, key or supporting, and how to evaluate it
- Columns for your response, evidence seen, control owner and gap / action
- Summary sheet: results by objective, updated automatically
Topics: Information Technology
Learn it on video
- COSO Principles 10-12 Explained: Control Activities, IT General Controls and Policies (13 min)
- General vs Application and Manual vs Automated Controls: Know the Difference (13 min)
- How to Link Risks to Controls: The Risk and Control Matrix (RCM) (12 min)
- How to Describe Controls in the RCM: Method, Type, Frequency and Test Procedure (8 min)
- How to Test Controls (2): Test of Operating Effectiveness (7 min)
More risk control matrix
- Accounting and Finance Operations: Risk and Control Matrix (Excel) (editable Excel, ₹249 / $2.49): 58 controls (46 key) for 16 objectives and 32 risks, each with walkthrough questions, evidence to ask for and test steps.
- Administrative Expenses and Office Services: Risk and Control Matrix (Excel) (editable Excel, ₹149 / $1.49): 75 controls (50 key) for 13 objectives and 20 risks, each with walkthrough questions, evidence to ask for and test steps.
- Capital Projects and Capital Expenditure: Risk and Control Matrix (Excel) (editable Excel, ₹149 / $1.49): 68 controls (46 key) for 12 objectives and 19 risks, each with walkthrough questions, evidence to ask for and test steps.
- Cash and Treasury: Risk and Control Matrix (Excel) (editable Excel, ₹149 / $1.49): 39 controls (26 key) for 13 objectives and 19 risks, each with walkthrough questions, evidence to ask for and test steps.
Short internal audit videos · Free articles and guides · YouTube
Learn Internal Audit is run by SKYBOT Technology LLP. The founders, Amit Salla and Zehra Maccawala, are partners at ZMAS and Associates, a Chartered Accountancy firm specialising in internal audit.