SBC | Audit & Assurance | Risk Advisory

Modernizing the Risk and Control Matrix (RCM): A 90-Day Roadmap to Turn an Audit Burden into a Strategic Advantage

Written by: Sanjeeb Dey | Director – Audits & Assurance | SBC

Most finance and audit teams I speak to describe their RCM the same way: it is a large spreadsheet that gets updated when the auditors ask for it. It is accurate on the day it is signed off and out of date soon afterwards. Controls pile up, owners are listed by department, and nobody can say with confidence which risks are covered twice and which are not covered at all.

That is a missed opportunity. A well-built RCM answers a question that management, the audit committee and the auditors all share: what can materially go wrong, what stops or detects it, who owns the response, and what evidence shows the control is operating? This guide explains how to rebuild the RCM around those questions, how Indian law frames the requirement, and how to do it in 90 days. It sits within SBC’s wider work on risk advisory services in India.

What Is a Risk and Control Matrix (RCM)?

An RCM documents, in one structure, the relationship between what the business is trying to achieve, what could prevent it, and how the organisation manages that exposure. The COSO Internal Control – Integrated Framework treats internal control as relevant to operations, reporting and compliance, which is a useful reminder that the RCM is a management tool first and an audit document second.

A modern RCM links five things in sequence: business objective, risk, control, evidence and assurance. The sequence matters because it forces every control to justify itself against a risk, and every assurance conclusion to rest on evidence.

Not every organisation needs every field at the same depth. The principle is to include enough structure to support management decisions without turning the RCM into an encyclopedia.

Why Indian Companies Need a Modern RCM

There is no statutory form called an RCM in India. The legal requirement is about internal financial controls, and the RCM is the usual way companies document and evidence them. The anchors below show why the quality of that document matters.

The statutory text of the Companies Act is available on India Code, and ICSI publishes section-wise references such as section 138 and Rule 13. Listed entities should also read the SEBI LODR Regulations on audit committees and risk management, and the NFRA circular on auditor and audit committee communication. SBC’s note on NFRA’s auditor and audit committee communication series explains how this plays out in practice.

Section 138 applies to every listed company, and to unlisted public and private companies that cross thresholds on paid-up capital, turnover, borrowings or deposits measured against the preceding financial year. Rule 13(2) leaves scope, periodicity and methodology to the Audit Committee or Board. That discretion is what makes a risk-based and data-supported approach possible.

The Anatomy of a Broken RCM

Four patterns turn up in almost every RCM that has outgrown its usefulness.

1. Compliance becomes the architecture

Most RCMs start for good reasons: a new reporting requirement, a regulator’s request, an auditor’s observation. The trouble starts when every requirement becomes another row, another approval and another evidence request, and nobody steps back to ask what risk the whole structure manages.

Procurement is the usual example. A traditional matrix lists vendor onboarding approval, purchase-order approval, invoice verification, payment authorisation and periodic reconciliation. Each is valid. But the matrix may say little about the risks management actually worries about: vendor concentration, conflicts of interest, unauthorised commitments, duplicate vendors, or a change of supplier bank details just before payment. The matrix is full, but the risk view is thin.

The first principle of modernization is therefore to start with the risk, not the control. A control exists because a defined risk exists, and evidence exists because management needs to know the control operated.

2. Control bloat accumulates quietly

Control environments rarely get bloated in a single event. One year a reconciliation is added after an exception. The next year a second-level review is added after a missed approval. A system issue produces a manual spreadsheet check. Each decision looks reasonable. Five years later the company may be paying for several controls that detect the same failure after it has already happened.

A rationalization exercise asks four questions of every control:

1. What risk does it mitigate?
2. Is that risk still material?
3. Does another control already give equivalent coverage?
4. Can technology reduce the manual effort without weakening the control objective?

The answer may be to retain, redesign, consolidate, automate or remove the control, and the decision should rest on evidence. Rationalization is not a headcount exercise, and it should never be sold to management as a guaranteed saving.

3. Diffused ownership creates invisible gaps

“Finance owns it” is not a control owner, and neither is “IT owns it”. A department can be accountable for a process, but the RCM must say who performs the control, who reviews it, what evidence is retained and who fixes an exception. This also reflects the IIA Three Lines Model, which separates management’s responsibilities from independent internal audit assurance. The RCM should make those distinctions visible instead of folding ownership, oversight and assurance into one generic “owner” field.

4. Static maintenance produces a moving target

Systems, vendors, structures and regulations change between audit plans. A company can move to a new ERP, outsource payroll, acquire a business or add an AI-enabled workflow between two risk assessments. If the RCM is updated only when internal audit prepares its next annual plan, it describes a process that may no longer exist. The IIA Global Internal Audit Standards, effective from 9 January 2025, are principle-based for this reason: they expect the function to respond to organisational context and changing risk.

What a Modern Risk and Control Matrix Looks Like

Anchor every risk statement to a business objective

A weak risk statement is a label. A strong one explains the consequence for the business, which in turn makes the right preventive and detective controls easier to identify.

The same logic applies to strategic objectives. A manufacturer improving production reliability should link equipment failure, maintenance gaps, inventory inaccuracy and supply interruption to that objective. A technology company growing through cloud products will probably find identity access, data integrity, third-party risk and change management among its core risks. ISO 31000 describes a common approach to identifying, analysing, evaluating, treating, monitoring and communicating risk, and the COSO Enterprise Risk Management framework connects risk with strategy and performance. Both support designing the RCM around the business as it runs today.

Distinguish preventive, detective and corrective controls

These three types serve different purposes and need different evidence and testing.

All three may be necessary, but a matrix that lists only detective controls in a high-risk process is telling you something. The ICAI Standards on Internal Audit include standards on internal controls, risk management, governance and compliance, and an RCM that makes the link between risk, control design and assurance explicit supports that professional conversation.

Make evidence part of the control design

The most common design weakness is describing what people should do without describing what proves they did it. “Finance reviews the vendor master monthly” is incomplete. A stronger version says what triggers the review, who performs it, which report is reviewed, which exceptions are investigated, where the evidence is kept and how the review is evidenced. The ICAI Technical Guide on Risk-Based Internal Audit discusses the relationship between risk and internal controls, including control activities such as review, approval, physical counts and segregation of duties. The control statement should describe the actual risk-mitigating activity, not just the intended policy outcome.

Control Rationalization: Reduce Complexity Without Reducing Coverage

Rationalization is often misread as control reduction. The sounder framing is coverage optimization. A control can be removed only when the risk is still adequately addressed by something else, when no legal or contractual requirement is compromised, and when the process owner and assurance team understand the change.

A practical review sorts every control into one of five buckets.

Worked example: procure-to-pay

Suppose a company has seven controls in procure-to-pay. The first task is not to cut seven to four. It is to map each control to the risk it covers and ask what coverage would be lost without it. The decisions below are illustrative.

If there were no preventive control over conflicted vendor creation, removing a detective control in that area would open a gap. The rationale for each change matters as much as the revised matrix, because it lets internal audit, management and the audit committee understand why the control environment differs from last year.

Guardrails for rationalization

1. Never remove a control that a law, regulation or contract requires.
2. Retire a control only after confirming the risk is covered elsewhere or no longer exists.
3. Record the reason for every removal, consolidation or redesign.
4. Agree the change with the process owner before assurance teams are told.
5. Do not present rationalization as a cost-saving promise.

Ownership and Accountability: From Department Names to Named Roles

A modern RCM identifies the operational owner, the reviewer where one is needed and the remediation owner for exceptions. Frequency should follow the risk, not habit: a high-risk control may need to operate continuously, while another may be monthly or event-triggered.

A control assigned to someone who cannot access the report, approve the exception or escalate a failure is not well designed. In automated environments, ownership may be shared across process owners, application owners, data teams and information security, but the accountability chain should still be explicit.

Continuous Monitoring: Moving Beyond the Annual Snapshot

Sampling remains appropriate where judgement, interviews or complex documentation are needed. High-volume, rules-based transactions are increasingly suited to automated testing, and that is where continuous monitoring becomes practical.

Four controls are natural starting points:

1. Duplicate payments.
2. Vendor master data changes.
3. Transactions above delegated authority.
4. System access that remains active after an employee exits.

These can often be written as rules and run against the full population. The result is not 100% assurance. It is broader detection coverage, faster exception identification and better use of human review time. SBC’s article on population testing versus audit sampling covers the difference in detail. The NIST Cybersecurity Framework 2.0 shows the same trend towards outcome-based risk management in security, and the same thinking applies to access, incident response, change management and third-party security controls in an RCM.

Continuous monitoring versus continuous auditing

The distinction protects independence. Internal audit should not become the owner of controls it later needs to assure. A mature model uses both: management monitoring helps run the business, and internal audit tests independently whether governance, risk management and controls work as intended. For a deeper view of how internal audit makes that shift, read Is Internal Audit Ready for Continuous Risk Intelligence?

GRC Technology and Data: Fix the Taxonomy Before the Tool

A GRC platform can centralise risk registers, control libraries, ownership, testing, exceptions and remediation. But software does not create a mature control environment. If risk statements are unclear, moving them from Excel into a platform creates a more expensive spreadsheet. A sensible order of work is:

1. Define what counts as a key control.
2. Set evidence standards.
3. Name control owners.
4. Agree how exceptions are categorised and escalated.
5. Only then decide which workflows benefit from technology.

Data quality matters as much as the interface. A dashboard showing zero exceptions is not reassuring if the data feed is incomplete, a business unit is excluded or a rule is misconfigured. Continuous monitoring therefore needs periodic validation of data completeness, rule logic, interfaces and exception handling. For asset-heavy businesses, SBC’s 360° Fixed Asset Management approach shows how capitalisation, tagging, reconciliation and physical verification create the transaction-level data that control monitoring depends on.

Connecting RCM Modernization to IFC, ICFR and SOX

For organisations working under internal financial controls, ICFR or SOX expectations, modernization must keep the controls that support financial reporting while improving how evidence and exceptions are managed. The goal is not a separate RCM for each framework. It is one coherent control architecture with clear mappings to each obligation.

In India this means treating the RCM as the supporting structure for the internal financial controls that directors, auditors and the audit committee must form a view on. For listed entities, it also helps leadership move from reviewing dozens of control descriptions to discussing the exceptions, residual risks and remediation priorities that matter. Evidence should also be usable by someone who was not involved in creating the control: source reports, approvals, exception logs, access records and remediation evidence should be kept in a consistent structure so a reviewer can follow the trail from transaction to conclusion.

The 90-Day RCM Modernization Roadmap

Treat this as a practical starting framework, not a universal timetable. Size, control maturity, data quality, technology architecture and regulatory complexity will decide how quickly each phase can be completed.

Days 1–30: Rationalization and pruning

The first month is about understanding what exists. Do not begin by buying software. Collect the control inventory across critical cycles and identify which controls are actually key to material risks.

1. Inventory existing RCMs across finance, procurement, sales, HR, IT, operations and other critical processes.
2. Map each material control to a clearly worded business risk and objective.
3. Identify duplicate, overlapping, obsolete and low-value controls.
4. Identify material risks that have no meaningful control coverage.
5. Check whether process or system changes have made documented controls outdated.
6. Classify controls as preventive, detective or corrective, and as manual, automated or hybrid.

Day 30 output: a rationalized control inventory and a prioritized gap list. Management should see where the control environment is overly complex and where the organisation is exposed.

Days 31–60: Calibration and accountability

In the second phase the surviving control set becomes operationally stronger. Recalibrate risk ratings, clarify ownership and standardise evidence. This is also the stage to test whether controls prevent the most important risks or merely document compliance after the fact.

1. Define the control owner and reviewer for each key control.
2. Confirm the frequency and any triggering events for each control.
3. Specify the evidence expected and where it is retained.
4. Review the balance of preventive and detective controls in high-risk processes.
5. Identify controls suitable for automation or continuous testing.
6. Define exception severity, escalation and remediation rules.

Day 60 output: a revised RCM that a process owner can operate, an auditor can test and management can understand.

Days 61–90: Continuous monitoring integration

Begin with a small number of high-volume, rules-based controls where reliable data exists and where exception detection will make a visible difference. Good pilots include duplicate payments, purchase-order compliance, vendor master changes and access removal after exit.

1. Create read-only, governed data connections where appropriate.
2. Build monitoring rules and validate them against known historical exceptions.
3. Set thresholds so alerts are meaningful rather than excessive.
4. Assign named owners to investigate and remediate exceptions.
5. Build a dashboard showing open exceptions, ageing, repeat failures and remediation status.
6. Revalidate data completeness, rule logic and workflow performance periodically.

Day 90 output: a working pilot. A pilot usually teaches more than a large programme launched without learning, because it exposes false positives, data limits, ownership gaps and workflow friction before the model is extended.

How to Measure Whether the Modernized RCM Is Working

The RCM itself should be measured, or modernization becomes another project that produces documents but not better risk management. A small scorecard works better than a long list of activity metrics.

Set the baseline in the first 30 days and review the scorecard each quarter. A high number of controls or tests is not evidence of maturity. Quality of risk coverage, clarity of ownership, reliability of evidence and speed of exception response are closer to the real management outcome.

Common Mistakes to Avoid During RCM Modernization

1. Buying a GRC platform before fixing the risk and control taxonomy.
2. Equating fewer controls with a better control environment.
3. Assigning ownership to departments instead of accountable roles.
4. Automating a poorly designed manual control without first validating the risk logic.
5. Using dashboards that show activity but not risk significance or root cause.
6. Assuming 100% population testing means 100% assurance.
7. Letting internal audit become the operational owner of controls it later needs to assure.
8. Ignoring legal, contractual or regulatory controls during rationalization.
9. Failing to document why controls were removed, consolidated or redesigned.
10. Updating the RCM once a year while the underlying process changes every month.

Practical Questions for Leadership

The Boardroom Value of a Modern RCM

A well-designed RCM gives the audit committee and senior management a more useful view of risk. Instead of pages of control descriptions, leadership can focus on four questions:

1. Which material risks are increasing?
2. Which key controls are failing?
3. Which exceptions keep recurring?
4. Where is remediation getting stuck?

That is a better conversation than whether the matrix has 400 or 600 rows. The long-term opportunity is risk intelligence: a regularly refreshed picture of where exposure is rising, where controls are failing and where management attention is needed. The accountability model stays the same. The RCM lets management manage, risk functions challenge and internal audit provide independent assurance.

How SBC Approaches RCM Modernization

SBC starts from the organisation’s risk profile and operating model, not from a technology product. The practical sequence is to understand the existing risk and control framework, find where coverage is duplicated or incomplete, define accountable owners, strengthen evidence and then introduce analytics where the data supports it.

This sits within SBC’s Financial and Risk Advisory Services, which cover enterprise risk management, internal audit transformation, outsourcing or co-sourcing, control testing, SOP development, business process improvement and internal financial controls compliance under the Companies Act, 2013. The aim is not to turn every process into an automated dashboard. It is to build an RCM that is proportionate to risk and useful to the business.

Independence deserves a word. Under section 144 of the Companies Act, 2013 a statutory auditor cannot provide internal audit services to the company it audits, and internal audit should not operate the controls it assures. Check these points before any engagement.

Frequently Asked Questions About the Risk and Control Matrix

1. What is a Risk and Control Matrix (RCM)?

An RCM is a structured record that links business objectives and risks to the controls designed to mitigate them, together with ownership, frequency, evidence and testing information.

2. What is the difference between an RCM and a risk register?

A risk register lists risks, their ratings and treatment plans. An RCM goes further by mapping each risk to specific controls, owners, evidence and tests. Many organisations keep both and link them.

3. Is an RCM mandatory in India?

No statute names a form called an RCM. However, the Companies Act, 2013 requires the board’s report to address the adequacy of internal financial controls, requires directors of listed companies to state that such controls are adequate and operating effectively, and requires the statutory auditor to report on internal financial controls over financial reporting. Companies commonly use an RCM to document and evidence those controls.

4. Why should companies modernize their RCM?

Processes, systems, regulations and risk profiles change. A static RCM becomes overly complex, outdated or disconnected from material risks, which weakens both management decisions and assurance.

5. Does modernizing the RCM mean removing controls?

Not necessarily. Modernization means improving risk coverage and reducing unnecessary complexity. Some controls are removed or consolidated, while others are redesigned or strengthened.

6. What should a modern RCM include?

At minimum: the risk statement, control objective, control activity, owner, reviewer where applicable, frequency, evidence, exception criteria and remediation responsibility. Organisations may add risk ratings, systems, testing method and residual risk.

7. What is the difference between continuous monitoring and continuous auditing?

Continuous monitoring is a management activity embedded in operations. Continuous auditing is performed by internal audit using frequent or automated analysis to evaluate controls and transactions and provide independent assurance.

8. Can every control be automated?

No. Controls involving professional judgement, complex investigations, qualitative assessment or nuanced walkthroughs may still need human testing and review.

9. Does 100% population testing give 100% assurance?

No. Automated testing still depends on complete and reliable data, correct rule configuration, functioning interfaces and effective exception handling.

10. How long does RCM modernization take?

A 90-day roadmap is a reasonable starting framework, but the actual duration depends on the organisation’s scale, control maturity, systems, data quality and regulatory requirements.

11. Who owns the RCM?

Management owns the risks, the controls and the RCM that documents them. Internal audit uses the RCM to plan and perform independent assurance, and should not own the controls it assures.

12. How often should an RCM be updated?

Review it at least once a year and after any major system, process, vendor, structure or regulatory change. Event-driven updates matter more than the calendar.

Conclusion: The Future Is a Smarter RCM

A Risk and Control Matrix should help the business understand and manage risk. It should not exist because an auditor once asked for a spreadsheet. The strongest RCMs make the relationship between objectives, risks, controls, evidence and accountability visible and usable.

Modernization is less about digitizing the document and more about redesigning the control environment around risk. Rationalize what is redundant. Strengthen what is material. Clarify who owns what. Automate where data and logic are reliable. Keep deep-dive audit work where human judgement is essential. The organisations that do this well will not be the ones with the largest RCM. They will be the ones whose RCM tells management, clearly and quickly, what matters, what is changing and where action is needed.

A question for leadership: is your RCM mainly an audit requirement, or is it an operating tool that management uses to understand risk and protect the business? If you would like to review yours, you can contact the SBC team.