A risk and control matrix connects a specific reporting risk to the control intended to address it. It should tell a reviewer what happens, who performs it, when it happens and what evidence remains.
The free Excel template includes six fictional examples for a climate-reporting process. They are starting points for discussion, not a prescribed control set or an assessment of your organisation.
In this guide
Preview the actual workbook
Fictional entries from the downloadable file. Open the image full-size to inspect the wide table.
Start with the reporting objective
“Data could be wrong” is too broad to design a useful control. Name the figure or process, then state how it could fail. For example: “A newly opened electricity account is omitted from the monthly collection list, so reported consumption is incomplete.”
That description suggests something you can check. Reconcile the collection list against an independently maintained account list, investigate differences and retain the review record.
COSO publishes guidance on internal control over sustainability reporting. It provides a broader framework for considering control design. The matrix here is an original working aid. It does not reproduce the COSO framework or establish compliance with it.
Six worked risk and control examples
All entries below are fictional. Decide whether each control is suitable for your process, systems and available evidence.
| Reporting risk | Example control | Owner and timing | Evidence to retain |
|---|---|---|---|
| An active electricity account is omitted | Reconcile the collection list to the property team's account register and resolve differences | Reporting preparer monthly; reviewer checks exceptions | Dated reconciliation and resolved exceptions |
| A bill is included twice | Compare site, account and invoice references; investigate repeated keys | Preparer before aggregation | Duplicate review and treatment of credits or replacements |
| A bill covers the wrong reporting period | Compare bill dates with the reporting calendar and review allocations | Preparer each close; reviewer checks allocations | Original bill, allocation working and review |
| An unsuitable emission factor is used | Review geography, activity, units, boundary and dataset version against the stated method | Method owner when selecting or changing factors | Factor selection record and approval reference |
| An allocation changes without explanation | Compare the current working with the prior approved method and review differences | Reporting reviewer each cycle | Change explanation and revised working |
| A value changes after approval | Compare the release copy with the approved version and route differences for renewed review | Release owner before publication | Release comparison and decision record |
The table describes possible controls. Whether they operate effectively requires evidence from actual performance. An empty checklist or an owner name does not demonstrate that a control ran.
What the Excel workbook contains
The matrix has fields for risk ID, process, risk description, reporting objective, control ID, control activity, owner, frequency, evidence, reviewer and test approach. It includes the six example rows and space for your own entries.
There is no automatic risk score. A colourful rating can create false confidence when the likelihood, impact and control evidence have not been assessed. If your organisation uses a defined rating method, add it with its criteria and a clear decision owner.
Keep the control description specific enough that another person could understand the task without asking its author. “Finance reviews data” leaves too much unanswered. “The reporting reviewer compares the account list to the property register monthly and signs the exception reconciliation” is more useful.
Design and operation are different questions
| Question | What you are examining | Example problem |
|---|---|---|
| Could this control address the risk? | Design | The reconciliation compares two lists derived from the same incomplete source |
| Was it carried out as described? | Operation | The review was skipped in September |
| Is the evidence sufficient to explain the work? | Retained record | A tick is present but no exception resolution is retained |
A control can be well designed and still not operate. It can also be performed exactly as written while failing to address the actual risk. Record the issue precisely instead of treating every problem as a missing signature.
Walk through one risk before expanding the matrix
Choose one material reporting process. Follow an input from source record through calculation, review and release. Identify where it could be omitted, changed or misunderstood. Then write the controls you actually use, with any gaps visible.
Ask the named owner to explain the control and show an example of its evidence. If the explanation differs from the matrix, resolve the difference. A short accurate matrix is more useful than a long catalogue of controls nobody performs.
Link unresolved findings to the corrective action tracker. Use the factor selection record where a control depends on a documented factor choice.
Does this make a report assurance-ready?
The matrix helps organise the discussion, but assurance readiness also depends on the underlying records, methods, scope and actual review. It does not replace an assurance provider's procedures. Our SOX and climate-controls guide explains why familiar finance-control practices can be useful without making climate reporting identical to SOX reporting.
Prepared with AI assistance using the linked sources and original worked examples. Illustrative records are fictional. No customer results, independent specialist review or hands-on software testing are claimed.