Risk workshop
With management.
All internal audit & controls services
Internal Audit & Controls
Risk Assessment and Control Matrix
FinAura works with your management to list the risks that matter to your business, financial, operational and compliance, ranks them by likelihood and impact, defines the control for each, and records it all in a risk and control matrix. Gaps are prioritised, owners named, and the matrix becomes the plan for internal audit.
- Chartered Accountant-led
- Bangalore and across India
- Reply within one business day
What is covered
What Risk Assessment and Control Matrix Covers
The risks that matter, and what controls them.
Ranking
Likelihood and impact.
Controls
One for each key risk.
Gaps
Prioritised for fixing.
Owners
Named for each risk.
Audit plan
Built from the matrix.
How the month runs
How It Works
Identify, rank, map, plan.
Step 1
Identify
- Interviews
- Workshop
- Past incidents
Step 2
Rank
- Likelihood
- Impact
- Heat map
Step 3
Map
- Controls
- Owners
- Gaps
Step 4
Plan
- Fixes
- Audit plan
- Review cycle
Your part
What We Need From You
- 01Management's time for interviews
- 02Past audit reports and incidents
- 03Business plan
- 04Organisation chart
Our part
What You Get
- A ranked risk register
- A risk and control matrix
- A prioritised fix list
- A risk-based audit plan
A common question
What is a risk control matrix?
A table linking each significant risk to the control that addresses it, the control's owner, how often it operates and how it is evidenced.
It turns a general worry about 'controls' into a specific list of what is covered and what is not.
See internal financial controls documentationPlanGaps and audits
ControlsMapped to each
RisksListed and ranked
Who it is for
Who It Is For
Boards and audit committees
Oversight of risk.
Companies starting internal audit
Where to look first.
Growing companies
New risks with scale.
Companies preparing for investors
Risk framework expected.
The rules, in plain English
What the Law Says
Companies Act, 2013
Section 134(3)(n)
The board's report includes a statement on the development and implementation of a risk management policy for the company.
Official source: mca.gov.inCompanies Act, 2013
Sections 134(5) and 143(3)
Directors report on internal financial controls, and the statutory auditor reports on whether the company has adequate controls that operate effectively, with exemptions for some smaller companies.
Official source: mca.gov.inThis is general information, not advice for your situation; we confirm what applies to you before any work starts.
Questions we get asked
Risk Assessment and Control Matrix: Questions, Answered
What is the difference between a risk register and a control matrix?
A risk register lists and ranks risks. A control matrix adds, for each risk, the control that addresses it and how it operates.
How often should the risk assessment be updated?
At least once a year, and when the business changes significantly.
Does the board need to be involved?
Boards should review the key risks and how they are managed; we prepare the material for that discussion.
Is this only about financial risks?
No. Operational and compliance risks are included where they affect the business materially.
Often Taken Together
All 12 Internal Audit & Controls services01Internal Audit & ControlsInternal AuditRisk-based reviews of purchasing, sales, inventory, payroll, cash and compliance, with findings ranked by what matters and a plan to fix them.02Internal Audit & ControlsInternal Financial Controls DocumentationRisk and control matrices and process narratives for companies that need to show their controls framework.03Internal Audit & ControlsInternal Controls DesignApproval limits, segregation of duties, reconciliations and reviews designed for your size, not copied from a textbook.04Systems & ControlsPolicies & DocumentationFinance and HR policies, employee handbooks, SOPs and business documentation.05Startups, Setup & GrowthAdvisory & Special ProjectsDue diligence, restructuring, CMA data and family business advisory, scoped as projects.