IA-06

Process Understanding and Control Assessment Kit (RCM)

Understand and document the process, then build the risk and control matrix and the audit program.

7 templates
Arabic + English
Excel 2016 or later
Assurance

Inside the kit

403 Risk and Control Matrix (RCM) — Real images of the files, with a fictional worked example. Select any image to view it at full size.

401 Process Narrative — Real images of the files, with a fictional worked example. Select any image to view it at full size.

What this kit solves

A control cannot be tested before the process around it is understood. It starts with a narrative of the process as it actually runs (401), a flowchart with its control points (40101), a walkthrough (402) to confirm it, and interview minutes (405). From there the risk and control matrix (403) records each control's type, frequency and owner, the test of design (40301) asks whether each control addresses its risk, and the audit program (404) sets the test steps for each control, cross-referenced to the testing papers. The Excel and Word templates include filled examples for Al Rawasi Trading Company; the flowchart (40101) is a PowerPoint template without an example.

What your file holds afterwards

A documented process narrative (401) and a flowchart showing control points (40101)
A walkthrough (402) and interview minutes (405) that confirm the understanding
A risk and control matrix (403) with each control's type, frequency and owner
A test of design (40301) showing whether each control addresses its risk
An audit program (404) with test steps for each control, cross-referenced to the testing papers

How to use it

Document the process in 401 and 40101, and minute interviews in 405.
Confirm the understanding with a walkthrough in 402.
Build the RCM in 403 and assess control design in 40301.
Prepare the audit program in 404 for the controls to be tested.

Who it is for

Audit firm teams and in-house internal audit departments on assurance engagements, after engagement planning (IA-05) and before testing (IA-07).

What is in the kit

Code	Paper	Format	What you get	Reference
401	Process NarrativeReference: 14.1	Word	Template + worked exampleTemplate + example	14.1
40101	Process FlowchartReference: 14.1	PPT	TemplateTemplate	14.1
402	WalkthroughReference: 14.1	Word	Template + worked exampleTemplate + example	14.1
403	Risk and Control Matrix (RCM)Reference: 13.2, 13.4	Excel	Template + worked exampleTemplate + example	13.2, 13.4
40301	Test of Design (TOD)Reference: 14.2	Excel	Template + worked exampleTemplate + example	14.2
404	Audit ProgramReference: 13.6	Excel	Template + worked exampleTemplate + example	13.6
405	Interview MinutesReference: 14.1	Word	Template + worked exampleTemplate + example	14.1

Every kit also includes a user guide (PDF and PowerPoint) and the licence terms, in Arabic and English.

IIA Global Internal Audit Standards (2024) references, with ISQM 1 and SAMA principles where they apply, as given in the guide. References are for cross-referencing and do not imply IIA endorsement.