Why RACM matters to internal audit and controllers
The RACM is the backbone of internal audit and SOX testing. It lists the process, risk, control, owner and frequency. It records whether each control is manual or automated, preventive or detective, and key or non-key.
Auditors plan testing from it. An out-of-date RACM tests controls that no longer exist and misses the ones that do.
Many RACMs live in spreadsheets and drift as processes change. Some teams call it an RCM, or risk control matrix.
An example
In procure to pay, one risk is payment to a fictitious vendor. The control is that a second person approves every new vendor and every change to bank details. The test checks each change in the year for a second approver.
How IRAME handles it
IRAME builds each client's control library from its own risk register, SOPs and RACM, starting from a set proposed from past deployments, then tunes it on the client's data. RACM generation inside an engagement is live in IRAME's audit management.