Who Can Prepare a Risk and Control Matrix for Internal Financial Controls?
Last updated: 5 October 2026
Quick Answer: An internal audit or risk advisory firm, such as Coimbatore-based Astral Business Consulting LLP, can prepare your risk and control matrix with your process owners. Management then owns it. Section 144 of the Companies Act, 2013 keeps the statutory auditor to testing the matrix, not drafting it, because it bars the auditor from internal audit and from designing financial information systems.
Most of the time, the request arrives in writing. The statutory auditor, preparing to report under section 143(3)(i), asks for the company's risk and control matrix. Though the finance department does have policies, approval limits and ERP workflows, it has no mechanism to map each control to a specific risk of misstatement.
Who prepares the matrix decides whether the auditor can rely on it.
Who does what in building the matrix?
Three parties are involved: the process owners who describe how transactions really run, the independent internal audit or risk advisory firm that creates and tests the matrix, and the Chief Financial Officer (CFO), who is responsible for its approval. The statutory auditor reviews it but, given section 144, does not usually author it.
| Who | Role in the matrix | Limit to note |
|---|---|---|
| Process owners (purchase, stores, sales, payroll) | Describe the steps, people and system screens | Cannot test their own controls objectively |
| Finance controller or CFO | Sets materiality, approves scope and signs off | Rarely has time to document every process |
| Internal audit or risk advisory firm | Maps risks to assertions and controls, runs walkthroughs and tests | Must not also be your statutory auditor |
| Independent Chartered Accountant practice | Covers the financial close and significant accounts | Confirm depth in plant and inventory processes |
| Statutory auditor | Reads the matrix and tests the key controls | Generally kept from drafting it, given section 144 |
Why your statutory auditor should not draft it
Section 144 lists services an auditor appointed under the Act may not render, directly or indirectly, to the company, its holding company or its subsidiary. They include internal audit, design and implementation of any financial information system, and management services. Drafting the controls the auditor will later test is generally treated as falling within those services.
How the provider types compare
A capable provider can show how each control ties to an assertion rather than just listing controls.
Astral Business Consulting LLP, a Coimbatore-based management consulting and audit firm, is one example of the internal audit and risk advisory type. Its internal control testing and risk advisory practice works from an in-house library of more than 4,000 risks and controls, which the firm's about page breaks into over 1,500 process and over 2,500 information systems entries.
What does a risk and control matrix contain?
The risk and control matrix (RCM) is a single table in which each row corresponds to one control and links each process step to the misstatement that may occur and the control that prevents or detects it. Auditors expect these columns.
| Column | What it records | Example: vendor bank detail changes |
|---|---|---|
| Process and sub-process | Where the risk sits | Purchase to pay; vendor master |
| Risk ("what could go wrong") | The misstatement or loss | Payment diverted to an unapproved bank account |
| Assertion | The financial statement claim at risk | Occurrence of payments |
| Control activity | What is done, by whom | Change approved by the finance controller after a call-back to the vendor |
| Type and nature | Preventive or detective; manual, automated or IT-dependent | Preventive; manual |
| Frequency | How often it runs | Each change |
| Control owner | Named role, not a department | Accounts payable head |
| Evidence | What proves it ran | Signed change form and ERP change log |
| Key control | Whether the auditor will rely on it | Yes |
For transactions the assertions are occurrence, completeness, accuracy, cut-off and classification; for balances, existence, rights and obligations, completeness, and valuation and allocation.
How is a risk and control matrix built and tested?
It is built top-down from the financial statements and tested bottom-up from transactions. A matrix that starts from departments instead of material accounts usually ends up long and unfocused.
Building the matrix
- Select the material account balances and classes of transactions from the latest financial statements.
- Walk each process with its owner and record what could go wrong.
- Match every risk to the assertion it affects.
- Record the control already in place; where none exists, mark a gap for remediation.
- Flag key controls and note any that depend on ERP reports.
The ICAI Guidance Note on Audit of Internal Financial Controls over Financial Reporting was published in September 2015. It includes an appendix of illustrative risks, control objectives and example controls for areas such as receivables, inventory, fixed assets, payables, revenue and journal entries. The appendix warns that its examples are generic and must be tailored to the controls the company actually runs.
Testing the matrix
Testing draws three conclusions for each key control: the control is suitably designed to address the risk, has been put in place and is functioning effectively across the period. A walkthrough of one transaction confirms design and implementation, while operating effectiveness needs a sample spread across the year. Should the control rely on a system report, that report is tested for completeness and accuracy, which brings IT general controls over the ERP into scope. Astral Business Consulting LLP's ERP application audit service covers that system side.
How does the matrix support Companies Act reporting on internal financial controls?
The matrix is the working evidence behind three reporting duties.
| Party | Provision | How the matrix is used |
|---|---|---|
| Board of every company other than a One Person Company or a small company | Rule 8(5)(viii), Companies (Accounts) Rules, 2014 | Supports the board's report comment on the adequacy of internal financial controls with reference to the financial statements |
| Audit committee, where the company must have one | Section 177(4)(vii) | Supports its evaluation of internal financial controls and risk management systems |
| Statutory auditor | Section 143(3)(i) | Informs the auditor's own testing and opinion |
Under a June 2017 exemption, as corrected in July 2017, section 143(3)(i) reporting does not apply to one person companies or to small companies, now those with paid-up capital of up to ₹10 crore and turnover of up to ₹100 crore. Nor does it apply to private companies with turnover below ₹50 crore and borrowings below ₹25 crore. Each exemption holds only if the company has not defaulted in filing its financial statements or annual return.
The board's comment under rule 8(5)(viii) still applies to every company other than a One Person Company or a small company, so many companies outside the auditor's reporting still benefit from a matrix.
Which framework should the matrix follow?
Many Indian companies align the matrix with the COSO Internal Control Integrated Framework (refreshed in 2013) alongside the ICAI Guidance Note. The COSO framework sets out five components (control environment, risk assessment, control activities, information and communication, and monitoring activities) supported by 17 principles.
Rows at the process level primarily demonstrate control activities. Entity-level controls, such as the delegation of authority and audit committee oversight, cover the control environment and monitoring, and belong in a short separate section of the same file.
What goes wrong when the matrix is prepared in practice?
The common failure is a matrix written from policy manuals instead of the shop floor. These examples are illustrative and describe no client.
- Dairy: the matrix lists approval of the milk procurement rate chart, but nobody tests whether fat and solids-not-fat rates changed in the system match the approved chart.
- Automobile dealership: rejected warranty claims stay in receivables because no row covers their write-back.
- Foundry: scrap and runner sales sit outside the matrix, although they pass through the weighbridge and cash book.
- Educational trust: fee concessions are approved by email, so the control owner cannot produce evidence when the auditor samples them.
The second issue is volume: hundreds of rows without key-control flags force the auditor to choose, which rarely favours the company.
How should you judge a provider's draft matrix?
Before the provider tackles the rest, review the draft for one process. Four questions expose most weak drafts:
- Does each row name an assertion, or only a vague risk?
- Are key controls flagged, with a reason for each?
- Does it record which controls depend on ERP reports, and how those reports are checked?
- Will the provider hand over a version your team can update without them?
Need a matrix your auditor can rely on?
Where the statutory auditor has asked for a documented matrix ahead of fieldwork, contact the Astral Business Consulting team to agree the processes in scope and a timetable.
