A risk and control matrix (RACM) is the document that maps each risk in a business process to the controls that mitigate it, with the attributes needed to operate and test each control: owner, frequency, type, evidence and test procedure.
A risk and control matrix is the working core of an internal controls framework. The framework states principles, and the RACM turns them into rows that someone can execute and someone else can test. It is the first document an auditor requests in a SOX 404 review.
A RACM row typically contains:
- the process and sub-process, for example procure-to-pay and supplier invoice approval
- the risk statement, for example invoices paid at a price above the contract
- the financial statement assertion affected: existence, completeness, accuracy or cut-off
- the control description and its owner
- the frequency: per transaction, daily, monthly or quarterly
- the nature: preventive or detective, manual or automated
- the key control flag and the test procedure
Two design errors recur. The first is a risk with no control, or a control with no risk, which leaves either a gap or wasted effort. The second is a key control that depends on one person without backup, so that an absence or a departure breaks it. Where segregation of duties is not possible, the RACM documents a compensating control instead.
Phacet agents map directly onto RACM rows. The agent that can control supplier billing covers the pricing risk, 3-way matching covers existence and accuracy, and each run fills the evidence column automatically.
