Risk Control Matrix (RCM) Services
Process-level Risk Control Matrices that map every key risk to the control that mitigates it — built for Internal Financial Controls (IFC) reporting under Section 143(3)(i), internal audit scoping, and IPO or investor due-diligence readiness.
A Risk Control Matrix (RCM) is a structured document that lists, for each key financial or operational process, the risks that could lead to a material error or fraud, the controls in place to mitigate each risk, who owns the control, how often it operates, and whether it is preventive or detective. It is the working paper on which Internal Financial Controls (IFC) testing under Section 143(3)(i) of the Companies Act, SOX-style control assessments, and internal audit control testing are all built. The Classic Partners LLP builds and tests RCMs across your key processes — procurement-to-pay, order-to-cash, record-to-report, payroll and treasury — and documents the design and operating effectiveness of each control.
The control documentation your auditor, board and investors ask for
When your statutory auditor reports on Internal Financial Controls, when an internal audit function scopes its annual plan, or when an investor's due-diligence team asks "what controls do you actually have," the answer has to exist on paper — process by process, risk by risk. A Risk Control Matrix is that answer.
We build RCMs from scratch for companies that don't yet have documented controls, and we refresh existing RCMs where processes, systems or ownership have changed since the last update — followed by walk-throughs and sample-based testing of operating effectiveness.
- Process-level risk identification (P2P, O2C, R2R, payroll, treasury)
- Control objective, activity, type and frequency mapped per risk
- Design effectiveness walk-throughs
- Operating effectiveness sample testing
- Gap register with remediation owner and target date
- Ready-to-use input for IFC reporting and internal audit scoping
Who needs a documented Risk Control Matrix
An RCM is not a standalone statutory filing — it's the evidence base behind several compliance and assurance requirements.
| Use case | Why an RCM is needed | Typical requester |
|---|---|---|
| IFC reporting | Statutory auditor must report on design and operating effectiveness of internal financial controls under Sec. 143(3)(i) | Listed and certain unlisted companies |
| Internal audit scoping | Risk-based internal audit plans are built on the highest-risk, weakest-control processes identified in the RCM | Companies with an internal audit function under Sec. 138 |
| IPO / fundraise readiness | Investors and merchant bankers expect documented process controls as part of due diligence | Companies preparing to raise capital or list |
| ERP / system implementation | New systems need controls re-mapped and tested before go-live | Companies migrating to a new ERP or CBS |
| Group reporting standards | MNC subsidiaries reporting into a parent's global control framework | Indian subsidiaries of foreign groups |
What our RCM engagement covers
Each process is documented, walked through and tested — not just described.
Risk Identification
Process-level risk workshops to identify financial reporting, fraud and operational risks specific to your business.
Control Mapping
Every risk mapped to its control activity, control owner, frequency and type — preventive or detective, manual or system.
Design Walk-throughs
Process walk-throughs to confirm controls are designed to actually address the risk they're meant to mitigate.
Operating Effectiveness Testing
Sample-based testing across the period under review to confirm controls operated consistently, not just on paper.
Gap Register
Design and operating gaps logged with severity, root cause, remediation owner and target closure date.
Handover to Auditors
RCM and testing evidence formatted for direct use by your statutory auditor or internal audit function.
Our four-stage RCM process
Built to be reused every year, not redone from scratch.
Process mapping
Understand your key processes, systems and existing documentation to scope which processes need an RCM.
Risk & control documentation
Workshops with process owners to document risks and the controls that currently exist to mitigate them.
Testing
Walk-throughs for design effectiveness, then sample-based testing for operating effectiveness.
Reporting & handover
Gap register, remediation plan and a reusable RCM template handed over to your finance and audit teams.
RCMs your statutory auditor will actually accept
Built by the same team that signs IFC opinions — not a generic template exercise.
Auditor-ready output
RCMs formatted to directly support your statutory auditor's IFC testing and reporting.
Practical, not theoretical
Controls tested through real walk-throughs and samples, not a checklist filled from a template.
Fixed fee, written upfront
Scoping call, then a written quote covering all in-scope processes.
Reusable framework
The RCM is built to be refreshed annually, not rebuilt from zero each cycle.
Remediation follow-through
Gaps come with an owner and a target date, and we track closure at the next cycle.
One firm, all compliance
Works alongside our internal audit and statutory audit practices.
Risk Control Matrix questions CFOs ask us
Straight answers before you commission an RCM.
Ready to build your Risk Control Matrix?
Tell us which processes you want covered and why — IFC, internal audit or investor readiness. You'll get a fixed quote within one working day.
