Stop and check!
The most common format for documenting internal controls (i.e. format
for "control matrices") takes far too long to write and produces huge
documents of little practical use. It's so inefficient that people
naturally cut corners, giving a distorted view of controls and risk. I
should know; I made the wrong choice myself once. Never again!
If your company has documented its internal controls using some kind
of matrices or has to do so in future it is well worth getting the right
format in place. This is one of those details that makes a huge
difference. If you already have matrices check them and, if they are
the wrong style, plan to reformat them as soon as possible. If you have
still to start them or have just started a project to write control
matrices, stop, check, and restart your project using the right style of
matrix. If you don't you will regret it later.
Wrong and right formats
The format most people think of first when asked to map internal
controls to risks is the obvious one: a list of risks, with controls
written against each risk to show the risk is covered. The layout is
some variation on the one below, with other columns added for extra
information and cross referencing:
| Risk/control objective | Controls |
| Risk A | Controls addressing risk A |
| Risk B | Controls addressing risk B |
| Risk C | Controls addressing risk C |
| Risk D | Controls addressing risk D |
| etc | etc |
At first glance this seems sensible and there is no obvious objection
in principle. However, this is a disastrous choice. If the format
your company uses, or plans to use, is like this then read on.
A vastly superior format is to list controls down the left hand
column, and risks across the column headings, then mark off where
controls address risks within a matrix of small cells, like this:
| Control | Risk A | Risk B | Risk C | Risk D | etc |
| Control 1 | 1 | 1 | |||
| Control 2 | 1 | 1 | |||
| Control 3 | 1 | 1 | |||
| Control 4 | 1 | 1 | 1 | ||
| etc |
In this example, Risk A is covered by Control 3 only. Risk B is
covered by Control 1 only. Risk C is covered by Controls 1, 2, and 4.
And so on.
At first glance this seems unpromising. Surely there will be lots of
wasted space? Won't the column headings be difficult to read? What if
there are too many risks to fit across the page?
All these are minor issues whose impact can be minimised, and they
are insignificant next to the hidden drawbacks of the more obvious
approach. The next section looks in more detail at the advantages and
disadvantages of each type.
