Controls and the control matrix

For each requirement: the policy that covers it, the procedures that carry it out, and their runs in the period.

Concept

Control

A step in a procedure that checks something, shown as Check on a checklist. A control can require evidence, and can be kept apart from other steps so the same person can’t both do and check the work.

Requirement or risk

Policy that covers it

Procedures that carry it out

Runs in the period

with evidence

The control matrix is that chain for every item, with gaps flagged: a requirement with no policy, or a policy that no procedure carries out. Auditors see it in their portal under Controls, and it’s in the audit package. You can see the same view from Audits → Auditor’s view.

The control matrix in the auditor portal — 1How many requirements have a policy, a procedure and runs behind them
2Sections: controls, policies, training, procedure runs, risks, vendors and systems
3A **gap**: the requirement has a policy but no procedure carries it out
4The same package the company downloads
Screens show Fernhollow Health, a made-up company we use for demos.

See a full example: an example control matrix.

Procedures, runs, steps and evidence

A procedure starts on an event, hands steps to roles, checks them, and keeps the proof.

The audit portal

What an auditor sees: controls, policies, training, procedure runs, risks, vendors and systems, read-only.

Risk tests

Check every risk and requirement against your documents, the way an auditor would, and fix what’s missing.

← Risk tests Procedures, runs, steps and evidence →

Controls and the control matrix

Related