Risk Control Matrix (RCM) Library
A risk control matrix connects a business objective to the risks that could prevent it, the controls designed to address those risks, and the audit procedures used to evaluate those controls. Use this guide to understand the structure, review a worked example and create a reusable RCM library in Abilite.
See the worked example · Review the quality checklist · Open the Abilite instructions · Read common questions
What should a risk control matrix contain?
Start with a specific process and objective. Write the risk as an event and consequence, describe what the control owner actually does, and define the evidence an auditor will examine. A control such as “management reviews transactions” is too vague to test consistently. State who performs the review, what they review, when it happens and how exceptions are resolved.
A useful working structure records the process, objective, risk, control, control owner, frequency, evidence, audit procedure and conclusion. These are practical planning fields; your organization should adapt them to its methodology. The fields below are an illustrative audit example, not a representation that every column is a separate Abilite software field.
Risk control matrix example for procurement
Consider a Saudi organization reviewing supplier payments. The objective is to pay only approved suppliers for goods or services actually received. This example is illustrative and should be adjusted to your approval limits, systems and audit scope.
| RCM field | Illustrative entry |
|---|---|
| Process and objective | Accounts payable — release accurate, authorized supplier payments. |
| Risk | An unauthorized change to supplier bank details directs a legitimate payment to the wrong account. |
| Control | Before a bank-detail change is activated, an independent approver verifies it using an established supplier contact and records approval in the supplier record. |
| Owner and frequency | Designated finance approver — each supplier bank-detail change. |
| Evidence | Change request, verification record, approval and supplier-master change log. |
| Audit procedure | Obtain the change population for the audit period, assess its completeness, select a justified sample and inspect whether independent verification and approval occurred before activation. |
| Conclusion and follow-up | Record the evidence examined and exceptions found. Evaluate their significance, agree action ownership and track resolution where needed. |
For a broader worked engagement, see our eight procurement RCM examples, covering supplier onboarding, approvals, receipts, payment checks and supporting evidence.
Five checks before you reuse an RCM
- Confirm the objective. Keep the matrix tied to the engagement scope rather than copying an unrelated department’s controls.
- Match each control to a risk. One risk may need several controls. A control should explain how it addresses the identified exposure.
- Separate design from operation. A documented control may be well designed yet fail to operate during the period under review.
- Make the test reproducible. Specify the population, period, evidence and assessment criteria so another auditor can understand the work.
- Review the library before each engagement. Update owners, systems and control descriptions when the underlying process changes.
For Saudi teams, add relevant regulatory references only after confirming applicability and the specific control requirement. An RCM is a working audit document; creating one does not by itself establish regulatory compliance.
IIA-Australia’s work-program and risk-and-control-matrix factsheet explains that an engagement work program must be documented, while the format can vary. Use an RCM to support the engagement objectives rather than treating one template as universally mandatory.
How to use the RCM library in Abilite
The product instructions and screenshots below show how to create an RCM, associate objectives, risks and controls, and add the audit program. Use your team’s approved risk-rating methodology when selecting ratings.
- Open RCM Library from the left menu to view or create a risk control matrix.
- To create a matrix, select Add.
- The new-matrix form opens.
- Choose the Process the matrix will cover.
- Choose the relevant Sub Process.
- Enter a clear matrix name in the description field.
- Select Add to save the matrix.
- To find an existing matrix, choose its Process from the dropdown.
- Choose the matching Sub Process.
- Select Get RCM to load the saved matrices, then expand the matrix you want to review.
- Select Add Objective to open the objective form.
- Choose a Rating and the Risk Control Matrix that will contain the objective.
- Describe the objective, then select Add to save it. State what the process should achieve.
- Select Add Risk to define a risk associated with an objective.
- Choose the risk Rating and select the relevant Objective from the available entries.
- Describe what could prevent the objective from being achieved, then select Add to save the risk.
- Select Add Control to define a control for an identified risk.
- Choose a Rating and select the Risk the control addresses.
- Describe the control in the description field, then select Add. Explain the action performed rather than repeating the risk.
- The control appears against the selected risk. You can associate multiple controls with a risk where needed.
- Select Add Program to define an audit procedure for a control.
- Choose a Rating and select the Control the audit procedure will evaluate.
- Describe the audit procedure, including the evidence to examine, then select Add to save the program entry.
- Review the matrix to check that its objectives, risks, controls and audit programs are connected as intended.
- Use Update RCM when a saved matrix needs revision. Use Delete RCM only when the matrix should be removed, following your organization’s approval and retention procedures.
Risk control matrix questions
What is the difference between a risk register and a risk control matrix?
A risk register typically summarizes risks, ownership and responses across an organization or process. A risk control matrix links specific objectives and risks to controls and audit procedures, making it useful for planning and documenting control testing.
Can one risk have multiple controls in Abilite?
Yes. The RCM library instructions show that multiple controls can be added for each identified risk. Review whether the combined controls address the risk and document the audit work needed to evaluate them.
Does an RCM replace the auditor’s work program?
An RCM can organize part or all of the work program if it includes the procedures and documentation your engagement needs. A list of risks and controls without clear audit procedures is not a complete testing plan.