What goes into a risk control matrix.
| Column | What it records |
|---|---|
| Process and sub-process | For example, procure to pay: vendor creation |
| Risk | What could go wrong, such as a fake vendor being created |
| Control | What prevents or detects it, such as independent approval of new vendors |
| Type and frequency | Preventive or detective, manual or automated, and how often |
| Owner | The person responsible for performing the control |
| Evidence | What proves the control operated, and where it is kept |
Why it matters in India and the UK.
The Companies Act requires directors to confirm adequate internal financial controls, and for many companies the statutory auditor reports on them.
Provision 29 of the UK Corporate Governance Code 2024 requires a board declaration on the effectiveness of material internal controls, for financial years from 1 January 2026.
A clear RCM reduces fraud and error, and makes audits faster. See Internal Audit.
Processes we usually cover.
- Procure to payVendors, purchase orders, receipts, invoices and payments.
- Order to cashContracts, billing, collections and credit notes.
- PayrollHiring, changes, leavers and payroll approval.
- Record to reportJournals, reconciliations and month-end close.
- TreasuryBank accounts, signatories, payments and forex.
- IT general controlsAccess, changes and backups for finance systems.
How we build it.
Choose the processes
Based on materiality and risk for the group.
Understand how things work
Interviews and walkthroughs with process owners.
Document risks and controls
The RCM, with flowcharts and narratives where helpful.
Close the gaps
Practical fixes for missing or weak controls. See SOP Implementation.
Test design and operation
Sample testing with evidence, and a report for management and the UK.
Why clients choose us for audits.
Every audit is led and signed by Chartered Accountants in India.
Findings written for UK boards, audit committees and group auditors.
A written engagement letter with scope, timetable and fee.
Independence checks and a second-partner review on every report.
Encrypted document sharing, with site visits where the work needs them.
Clear, prioritised recommendations your team can act on.
RCM projects for UK groups with Indian entities.
We carry out audits in India for UK groups, investors and lenders headquartered anywhere in the UK, reporting in a form their UK boards and auditors can use.
London
South East
Midlands
North of England
East and South West
Scotland, Wales, NI
Risk control matrix FAQs.
Need controls your board can rely on?
Tell us which processes matter most. We will propose an RCM scope and fee.
This page is general guidance based on the Companies Act, 2013, Indian tax law and regulator guidelines as they stand. It is not legal or financial advice for your situation. Thresholds and requirements can change, so please speak to us before acting on it.