Blog · Audits · Problem 17 of 93
The auditor asked for a control matrix. Here’s what it is and how to build one.
· 2 min read · By Case Jones
You’re preparing for a SOC 2 or a customer audit, and the request list mentions a “control matrix”. You have policies and some procedures, but nobody has seen one of these before.
What it costs to leave it
Without a control matrix, the auditor has to work out for themselves which of your documents and records answer each requirement. That takes longer, costs more, and gaps show up late, when they’re hardest to fix.
How to build a control matrix from what you have
A control matrix is a table. Each row is a requirement; the columns say how you meet it and where the proof is. You can build a useful first version in an afternoon.
- 1
Start with the requirements
List the requirements you’re being measured against: the SOC 2 criteria, a customer’s questionnaire, or HIPAA safeguards. One row per requirement.
- 2
Name the control for each row
A control is what you do to meet the requirement, in one sentence: “Access to production is reviewed every quarter by the system owner.” If you can’t write the sentence, that row is a gap.
- 3
Point to the policy
Add the policy and section that says you do it. The auditor checks that what’s written matches the control.
- 4
Point to the procedure and its records
Add the procedure that carries the control out and where its records are: the access review from last quarter, the ticket, the log. This is the column auditors test.
- 5
Add an owner and how often it runs
Each control needs one owner and a frequency (on every hire, monthly, quarterly). It makes clear who to ask, and when the next record should appear.
Example
One row of a control matrix
Requirement: logical access is reviewed periodically. Control: production access is reviewed quarterly by each system owner. Policy: Access Control Policy, section 4. Procedure: quarterly access review. Evidence: Q3 review export and sign-off. Owner: Head of Engineering.
Or get the control matrix from 93 Compliance
The audit package includes a control matrix built from your workspace: each requirement linked to the policy that covers it, the procedures that carry it out, and the runs that prove it, with every policy version in effect and each run’s evidence (photos and files with SHA-256 fingerprints).
Invite your auditor by email for an audit period: read-only access that ends by itself (120 days at most), with every visit recorded.
The policy builder, procedures, auditor access and audit package are free, with no card.
- A control matrix from requirement to policy, procedure and run
- Every policy version in effect for the period
- Each procedure run with its evidence
- Read-only auditor access for the audit period
Build my control matrix
The policies, the questionnaire check, procedures and audits are free. Training records are $10 per employee per year.
Start freeWritten by Case Jones, who built 93 Compliance. Former VP of Information Security who took doxy.me from zero to SOC 2 Type 2, through a SOC 2 Type 1 audit, two Type 2 audits and a positive HIPAA assessment. doxy.me is not affiliated with 93 Compliance and has not endorsed it.
Questions
Is a control matrix the same as a risk register?
No. A risk register lists what could go wrong and how likely it is. A control matrix lists what you do to meet each requirement and where the proof is. They link: controls reduce risks.
Does the auditor write the control matrix?
Often the auditor brings a list of criteria, but you describe your own controls. A clear matrix from you makes the audit faster.
How many controls does a small company need?
Enough to cover each requirement once, honestly. Small companies often have fewer, broader controls; what matters is that each one really runs and leaves a record.