Risk Control Matrix Fields

You can change the following fields for the below Risk attributes (*denotes a required field):

• Risk Title: Risk Short Description (50 character limit)
• Risk Description*: Full length risk description
• Category*: Financial, Operational, Strategic, Regulatory, Governance
• **Inherent Impact*: Very Low, Low, Moderate, High, Critical, N/A 
• **Inherent Likelihood*: Very Unlikely, Unlikely, Possible, Likely, Very Likely, N/A
• **Residual Impact*: Very Low, Low, Moderate, High, Critical, N/A
• **Residual Likelihood*: Very Unlikely, Unlikely, Possible, Likely, Very Likely, N/A
• **Tolerance*: Low, Moderate, High
  • ***depending on “Risk Settings” see Heat Map Help Article
• Assertions: Existence or Occurrence, Completeness, Valuation or Allocation, Rights and Obligation, Presentation and Disclosure. If inputting multiple, they must be separated by a semicolon (;).
• Linked Controls: List a valid Control ID from your Controls listing. If inputting multiple, they must be separated by a semicolon (;).
• Strategy: Transfer, Avoid, Mitigate, Accept
• Owners: Populate using users’ FloQast login email
• Owner Due Dates: Assign a date signoff is due (mm/dd/yyyy)
• Reviewers: Populate using users’ FloQast login email
• Reviewer Due Dates: Assign a date signoff is due (mm/dd/yyyy)
• Custom Fields (see Customizing your RCM): 
  • Text Custom Field: This is an open text field with no character limit.
  • True / False Custom Field: Users must input a True or False into this field.
  • Number Custom Field: Users must input a valid number value into this field.
  • Date Custom Field: Users must input a valid date value into this field.
  • Single-Select Custom Field: Users must input one of the Single Select options for this field.
  • Multi-Select Custom Field: Users must input one or multiple of the Multi Select options for this field. If inputting multiple, they must be separated by a semicolon (;).

You can change the following fields for the below Control Attributes (*denotes a required field):

• Control Title: Control Short Description (50 character limit)
• Control Description*: Full length Control description
• Frequency*: Daily, Weekly, Every 2 weeks, Twice per month, Monthly, Quarterly, Annual, As needed, Custom
• Required Signoff Frequency: None, Monthly, Quarterly, Annual, Custom: Month, Month
• Method*: Manual, Automated
• Impact*: KeyControl, Non-Key
• Assertions: Existence or Occurrence, Completeness, Valuation or Allocation, Rights and Obligation, Presentation and Disclosure. If inputting multiple, they must be separated by a semicolon (;).
• Primary and Secondary Control Owners: Populate using users’ FloQast login email. Note: This is an informational field with NO related signoff. However, these owners can be linked to the recipients of your Certification requests in the ‘Certifications’ page.
• Preparers and Reviewers (Control “Assignees”):  Populate using users’ FloQast login email followed by a “-” and the frequency (Monthly, Quarterly, Annual, or Custom). For example, “nicole.mcdonald+training@floqast.com-Monthly” or “nicole.mcdonald+training@floqast.com-Custom(June, December). If inputting multiple assignees, each assignee’s email must be followed by frequency and be separated by semicolon (;). Note: A Preparer must be assigned in order to assign a Reviewer. Also, the Preparer cannot be the same assignee as the Reviewer.
• Preparer Due Date and Reviewer Due Date: Assign a business day signoff is due each period. Note: "1" means 1 day after the end of period, "-1" means 1 day before the end of period, and "-" means there isn't a due date. You can select from "-99" to "99."
• Custom Fields (see Customizing your RCM): 
  • Text Custom Field: This is an open text field with no character limit.
  • True / False Custom Field: Users must input a True or False into this field.
  • Number Custom Field: Users must input a valid number value into this field.
  • Date Custom Field: Users must input a valid date value into this field.
  • Single-Select Custom Field: Users must input one of the Single Select options for this field.
  • Multi-Select Custom Field: Users must input one or multiple of the Multi Select options for this field. If inputting multiple, they must be separated by a semicolon (;).

IMPORTANT: When making changes to your template, there are some essential things to keep in mind:

1. Please do not remove/add any columns or tabs to the template. If you want to add in Custom Fields to your RCM, please follow the steps in Customizing your RCM.

2. If you would like to add a brand new Risk or Control, you may fill in the appropriate required columns. Please be sure to match the format of the existing items when adding something new.

3. If you would like to remove an existing Risk or Control, you may delete the entire row that the items appears in. (If you remove a Control from the template, it will still exist in the Inactive tab on the Controls Page)

4. Please re-upload your entire template (not just the items you are editing) with no filters applied. Deleting a row indicates that you'd like to remove the item from your RCM.

5. The file will export to .xlsx format and should be re-uploaded in .xlsx. Uploading a .csv could return an error for you.