Scribd
Upload
10 views7 pages

Simple Risk Control Matrix Template

This document provides a template for a simple risk control matrix. It allows mapping of many risks to many controls. The template includes sections for controls currently in place, agreed but not yet implemented, and proposed. It provides space for two different risk analyses and metrics to assess risk size. The template is customizable and limitations include needing separate documents for detailed risk analyses.

Uploaded by

Arifin
Copyright
© All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as XLS, PDF, TXT or read online on Scribd
10 views7 pages

Simple Risk Control Matrix Template

This document provides a template for a simple risk control matrix. It allows mapping of many risks to many controls. The template includes sections for controls currently in place, agreed but not yet implemented, and proposed. It provides space for two different risk analyses and metrics to assess risk size. The template is customizable and limitations include needing separate documents for detailed risk analyses.

Uploaded by

Arifin
Copyright
© All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as XLS, PDF, TXT or read online on Scribd

Simple risk control matrix

For a good introduction tof this kind of risk-control matrix refer to the web page
"Matrix Mapping: the easiest and best way to map internal controls" at
[Link]/matrices.

The main advantage of this style is that it allows you to cope, easily, with the
common situation of having a many:many relation between risks and controls.

This template has two features not described in that article.

First, in this template there are three distinct groups of controls: those already in
place, those agreed but not yet operating (i.e. in development), and those proposed
but not yet agreed on.

After each set of controls there are revised summaries of the level of control
provided.

Second, there is space for two risk analyses. There's no need to do two, but if
alternative perspectives could be useful there's no reason for not using both together
and mapping controls to both of them.

Furthermore, if you want to migrate from one risk analyis to another, having the
ability to show two during a changeover period might be very useful.

Several columns are provided for capturing information about controls and you can
use, ignore, or add to them as you wish.

One limitation of this style is that your risk analyses have to be documented in the
column headings and comments of the controls sheet. If you want to say more than
this then you might be interested in the 'general rc [Link]' design, which includes
separate sheets for risk analyses and macro buttons to bring the control and risk
analysis sheets into alignment automatically.

You need to decide what metric(s) of risk 'size' you will use and update the headings
to make clear what your choice is. I've just used the word 'size' as a place holder.

Please feel free to contact me with any queries or suggestions at


matthew@[Link]
Sort Control group Control Control ID Ref to detail

CONTROLS CURRENTLY IN PLACE


1 Monitoring Business monitoring report: debtors m1
2 Monitoring Process monitoring report: process stats m2
etc etc etc

CONTROLS IN DEVELOPMENT
1 Monitoring Business monitoring report: debtors m1
2 Monitoring Process monitoring report: process stats m2
etc etc etc

CONTROLS PROPOSED
1 Monitoring Business monitoring report: debtors m1
2 Monitoring Process monitoring report: process stats m2
etc etc etc
xxxx
Perform-
Owner - Owner - To do Performance ance
operational development Frequency Sampling date evidence rating
Risk ref r1.1 r1.2 r1.3 r1.4
Short
name r1 r2 r3 r4

Development risk
Operation cost cost analysis 1 Size

Size after existing controls 10 20 30 40

Size after all agreed controls 10 20 30 40

Size after proposed controls 10 20 30 40


r1.5 Risk ref r2.1 r2.2 r2.3
Short
r5 name r1 r2 r3

risk
analysis 2 Size

50 Estimate of remaining risk 10 20 30

50 Estimate of remaining risk 10 20 30

50 Estimate of remaining risk 10 20 30


r2.4 r2.5

r4 r5

40 50

40 50

40 50

You might also like