Control Matrix

August 2007 from CAmagazine and written by Michael Burns – “In the June/July issue of CAmagazine, we looked at swimlane flowcharting as a tool to document business process. But even though swimlanes bring clarity and consensus to a process, they don’t show controls or control weaknesses. So if business process improvement is the objective, you need a control matrix.

A control matrix can be used to document controls and control weaknesses, which are all referenced on the swimlane. The matrix should include controls over validity, accuracy and completeness of transaction data entry. As well, there should be controls over accuracy and completeness when master files are updated through transactions. These controls need to be considered for every transaction in the scope of the review. Security of resources (cash, inventory, etc.) should also be evaluated.

If improvement is your goal, you must also consider efficiency and effectiveness. These are often ignored by the auditors, which is unfortunate. Auditors could add value in those areas. Efficiency means maximizing the work that gets done using the fewest resources. Any duplication of work or rekeying of information should be easy to catch.

Effectiveness means the business process delivers value according to the organization’s critical success factors. CSFs are defined as activities that must be done well for the organization to be successful. A single department may be efficient and effective on its own, but this may be at the expense of the organization as a whole.