Risk Control Matrix Template

a) Purchasing Process Controls

Note: The below control references (e.g, C1,

C2, C3) should correspond to the green circles
shown within your drafted process flow.
(Remember, green circles in this process flow
exercise show that a control exists over the
process shown.)

The below template is set up for 10 controls

simply as an example, so you are free to use Note: Create a concise and unique control name for each
more or fewer controls. control identified.
Control # Control Name
C1
C2
C3
C4
C5
C6
C7
C8
C9
C10

Note: Based on the walkthrough, the client contact directed some of our questions to the Internal Audit and IT teams. Based on those follow-ups, any add
should be added to the above listing.

b) Purchasing Process Control Weaknesses

Note: The weaknesses outlined below are per procedures performed during Task 1 (test of control details) and
Task 3 (purchasing process walkthrough).

Control Weakness # Finding #

Incorrect Reviewer Assignment by Purchase
Control Weakness 1
Request Portal
Control Weakness 2 Purchase Made Prior to Required Pre-Approval
Control Weakness 3 No Vendor Vetting Process
 Note: Provide a detailed narrative of how the control is designed and
functions (e.g., when and how control is performed).
Control Description

Audit and IT teams. Based on those follow-ups, any additional controls identified

Note: Provide a detailed narrative of how the current control designed

allowed for an exception to the designed purchase process to exist.

Control Description