Risk control matrices in India: what they are and how to build one that works
A risk control matrix (RCM) is a structured document that links each business process to the risks that could cause errors in the financial statements, and to the controls that address those risks. It is the backbone of internal financial controls (IFC) reporting under Indian company law and of Sarbanes-Oxley (SOX) compliance for US-listed groups.
What a risk control matrix contains
Each row of an RCM describes one risk and the control that addresses it. A typical RCM records:
- Process and sub-process, such as procure to pay, invoice processing
- Risk, what could go wrong, for example a payment to a vendor that does not exist
- Financial statement assertions affected, such as existence, completeness, accuracy or cut-off
- Control description, what is done, by whom, how often and with what evidence
- Control attributes: preventive or detective, manual or automated, key or non-key
- Control owner and frequency
- Test procedure, how the control will be tested and what evidence is needed
| Process | Risk | Control | Type |
|---|---|---|---|
| Procure to pay | Payments to fictitious or unapproved vendors | New vendors and bank detail changes approved by the finance manager after checking PAN, GST registration and a bank letter | Preventive, manual |
| Order to cash | Revenue recorded in the wrong period | Month-end review of deliveries and service completion against invoices, signed off by the controller | Detective, manual |
| Record to report | Unauthorised or incorrect journal entries | Journals above a set amount require approval in the system before posting | Preventive, automated |
| Payroll | Payments to employees who have left | Monthly reconciliation of payroll to HR joiners and leavers, reviewed by HR and finance | Detective, manual |
| IT general controls | Unauthorised access to the ERP | Quarterly user access review by process owners, with changes made by IT | Detective, manual |
Internal financial controls under Indian law
Three provisions of the Companies Act, 2013 drive IFC documentation in India:
- Section 134(5)(e): in a listed company, the directors' responsibility statement must confirm that the directors have laid down internal financial controls, and that they are adequate and operating effectively.
- Section 143(3)(i): the statutory auditor reports on whether the company has adequate internal financial controls over financial reporting and whether they operate effectively. Small companies, one person companies, and private companies with turnover below ₹50 crore and borrowings below ₹25 crore are exempt.
- Section 177(4)(vii): the audit committee evaluates internal financial controls and risk management systems.
The ICAI Guidance Note on Audit of Internal Financial Controls over Financial Reporting sets out how auditors test IFC, and most companies document their controls in an RCM so the auditor can follow and test them. Since April 1, 2023, auditors also report on whether the company's accounting software keeps an audit trail that cannot be disabled, which links closely to IT general controls.
SOX 404 for Indian entities of US groups
Section 404 of the US Sarbanes-Oxley Act requires management of a US-listed company to assess its internal control over financial reporting each year, and for larger filers, the external auditor attests to it. If an Indian subsidiary or capability centre is material to the group, or processes transactions for other entities, its controls are in scope.
Indian IFC reporting
- Companies Act sections 134, 143 and 177
- ICAI Guidance Note on IFC
- Report by the Indian statutory auditor
- Financial year to March 31
US SOX 404
- Management assessment and, for larger filers, auditor attestation
- PCAOB auditing standards for the attestation
- Testing to the group's year end, often December 31
- Deficiencies rated up to material weakness
Capability centres that provide services to many group entities, or to outside clients, may also be asked for a service organisation controls report. In India these reports are issued under ICAI's SAE 3402. We can help you get ready for such a report; the report itself is issued by the assurance provider your group or customers choose.
How we build and test an RCM
1. Scoping
We use materiality and risk to identify the significant accounts, the processes that feed them and the locations in scope, in line with your group's scoping if you are part of a US group.
2. Walkthroughs and documentation
We walk through each process with the people who run it, follow a transaction from start to finish, and document it in a narrative or flowchart. Where written procedures are missing, our SOP implementation team can help.
3. Risk and control mapping
We identify what could go wrong at each step and the controls that address it, and record them in the RCM. We also document entity-level controls, IT general controls and a segregation of duties analysis.
4. Design and operating effectiveness testing
We first check whether each control is designed to address the risk, then test samples to see whether it operated throughout the period. Sample sizes follow the control's frequency.
5. Deficiencies and remediation
We evaluate any failures, rate them as deficiencies, significant deficiencies or material weaknesses, and help process owners fix them before year end. Where processes themselves need redesign, business process re-engineering may help.
Entity-level controls and IT general controls
Entity-level controls
Entity-level controls work across the whole organisation. They include the tone set by the board and management, the code of conduct and anti-bribery policies, the vigil mechanism, delegation of authority, the risk assessment process, the financial close and the oversight provided by the audit committee and internal audit. Weak entity-level controls make process controls harder to rely on.
IT general controls
- Access: joiners, movers and leavers, privileged users and periodic access reviews
- Change management: how changes to the ERP, interfaces and reports are approved, tested and moved to production
- Operations: batch jobs, interfaces, backups (including the daily backup on servers in India) and incident handling
- Audit trail: whether the accounting software keeps an edit log that cannot be disabled, which the statutory auditor reports on
Segregation of duties
Segregation of duties means no single person can both carry out and conceal an error or fraud. In smaller Indian entities with lean finance teams, full segregation is not always possible, so compensating controls such as independent reviews become important.
| Conflict | Why it matters | Possible compensating control |
|---|---|---|
| Create vendor and approve payment | A user could set up a fake vendor and pay it | Monthly review of new vendors by someone outside accounts payable |
| Post journals and approve them | Errors or manipulation could go unreviewed | System-enforced approval above a threshold, plus a review of all manual journals |
| Maintain payroll data and release salaries | Ghost employees or unauthorised increases | HR-to-payroll reconciliation reviewed by finance |
| Record receipts and reconcile bank | Cash could be diverted and hidden | Bank reconciliations reviewed by the controller |
Where testing finds that a conflict has been exploited, the matter may need a forensic audit. For high-volume payments, a monthly concurrent review adds another layer of checking.
Why a good RCM pays off
- Smoother statutory audits, because the auditor can rely on documented controls
- A clear basis for the internal audit plan and testing
- Fewer errors and losses, and quicker detection of fraud
- Directors and audit committees can support their statements with evidence
- Easier integration of Indian entities into a US group's SOX programme
- Better handovers when finance staff change
Common RCM mistakes
- Copying a generic template that does not match how the business actually works
- Describing controls vaguely, such as "management reviews payments", without saying who, how often and what evidence is kept
- Listing too many key controls, which makes testing expensive without reducing risk
- Ignoring IT general controls, even though automated controls depend on them
- Not updating the RCM when systems, people or processes change
- Treating the RCM as a one-off document instead of a living part of the governance framework
Tax and compliance controls in the RCM
Many Indian control failures are about tax and compliance rather than accounting. Including them in the RCM helps the tax audit as much as the statutory audit:
- TDS deduction and deposit by the due dates, reconciled monthly with the books
- GST input credit claimed only when it appears in supplier filings, and returns reconciled with the ledger, supported by GST reviews
- Payments to MSME suppliers within the time the law allows
- Intercompany charges in line with the transfer pricing policy
- Inventory counts and reconciliation with bank stock statements, supporting any stock audit
- Filings with the Registrar of Companies and the RBI tracked against a compliance calendar