Creating A Risk Control Matrix – Internal Audit MK

Who is this article for?
Users who want to learn about Creating A Risk Control Matrix

Elevated permissions are not required.

This article outlines and overview of Creating A Risk Control Matrix within Adding Recommendations, Availability conditions, Informed Items

1. Creating A Risk Control Matrix

If the user selects either of the risk matrix options, they will see a new layout compared to the previous layout earlier in this section

As with the standard layout the user has the option of adding Work Programme Objectives on the panel at the top of the screen. Below, in the main panel, there are options to Add Risk and Add Control.
Selecting the Add Risk icon will provide the user with the option of creating a new risk or importing a risk from elsewhere within the system like the Risk Register, other templates or Audits

To add a control the user will select the Add Control option. Again, controls may be created as they are normally for the Standard Layout Work Programme Templates or they can be imported from the elsewhere within the system

When added, Risks are displayed as on the left with Controls listed along the top of the matrix

When Risks and Controls are added they are not automatically linked as per a standard layout template. Instead the user needs to manually identify where the relationships exist in order to then add Tests
To create a link between a Risk and Control, select the box within the grid where the risk and control intersect. Right-click on this box or click the option at the top of the panel to Create Risk/Control link for selection

Creating the link will turn the box yellow and display the text Tests: 0
To add details to the test or tests select the Edit Tests for selected Control option

This will refresh the screen and the matrix will be displayed in the left-hand column and the right-hand column will provide options to add and edit tests as well as editing the controls or test matrix

To add a test, select the New Test option. A dropdown menu will be displayed

Findings, text fields and linked files can be added in the same way that they are added in Standard Work Programme Template layouts. The difference is that by creating tests using the risk/control matrix the relationship is established between the tests and controls
For example if a Control is attached to Risk A and Risk B both Risks will also inherit all Tests that area associated to the said Control
When the auditor comes to perform their fieldwork and select answer/scores and document their fieldwork, the layout of the Work Programme will be set out as a standard Work Programme whether the template was created in standard layout or the matrix layout