The working paper most internal audit and SOX engagements start from. One row per risk and control pair.
What it does
- Scores each risk from likelihood and impact, and rates it High, Medium or Low automatically.
- Drop down lists for assertion, control type, nature, frequency, key control and test result, so the sheet stays consistent and easy to filter.
- Suggests a sample size from the control frequency. The table is on the Lists sheet, so you can change it to match your own methodology.
- Counts rows, high risks, exceptions and untested controls at the top.
- Turns any row with an exception red.
How to use it
Start on the "How to use" sheet. Row 6 of the RCM sheet is a filled in example for a vendor master control. Overwrite it with your own.