RCM Development
A risk and control matrix is only as good as the scrutiny it survives.
Ditton builds and repairs RCMs so that each risk is mapped to its assertions, each key control is identified and each control carries the attributes and evidence needed to test it.
The sequence
What usually has to happen
- Process understanding
- Risks mapped to assertions
- Key control identification
- Control attributes and evidence
- Design assessment
- Reviewer sign-off
Deliverables
What Ditton delivers
- Risk and Control Matrix extractThe backbone of the programme: each risk mapped to its assertions, the key control that addresses it, and the attributes needed to test it.
- Walkthrough narrativeTraces a transaction end to end to confirm controls exist where documented and are placed to address the stated risk.
- Control design assessmentProduced after a walkthrough, to determine whether the control as designed addresses the stated risk and could prevent or detect a material misstatement.
Engagement
How to start
Fixed-fee entry point
RCM Quality Review
A review of an existing RCM against the sequence above, with written findings on where it would not survive scrutiny and what it would take to fix.
Fixed fee — confirmed at scopingScoped programme
RCM Development
Scoped from the Quality Review or a scoping call: building the RCM around your processes, from process understanding to reviewer sign-off.
Scoped engagement — quoted after a scoping callStarting from a template? The RCM Library publishes practitioner-built RACMs by process.
RCM LibraryDownload
Engagement Scope Note
How a Ditton engagement is scoped: deliverables, boundaries and commercial terms, agreed before work begins.