# Build the process risk-control matrix

> Connect Acme's supplier risk and disclosure obligation to a versioned control with clear responsibilities.

_Updated: 2026-10-07_

## Continue the Acme case

The [compliance review](/en/learn/grc-compliance-case) identified a late relationship disclosure. Acme defines a control: before approving a supplier selection, obtain the required relationship declaration and independent review. Its purchase and payment evidence remains in Accounting and Core.

## Role and prerequisites

The Internal Control expert prepares the matrix; the process and control owners confirm their respective facts; an independent head reviews the published version. Auditors read permitted approved versions without preparation rights. Begin with the existing purchasing process, not an artificial copy created only for the matrix.

## Define and publish the control

1. Open **Matrices**, select Acme's purchasing process and record its objective, stages, accountable process owner and the relevant risk. Link the approved supplier risk where the installed contract permits it; otherwise retain its authorised evidence reference without inventing automatic synchronisation.
2. Add the control's purpose, performer, reviewer, frequency, trigger and required evidence. Distinguish process ownership from control ownership. State exactly which risk or assertion the procedure addresses.
3. Describe the control design: declaration precedes selection, review is independent and unresolved conflicts prevent the applicable next step. A written policy alone is not proof that the control operated.
4. Open the control dossier inside the matrix; attach the applicable policy, business description and evidence sources. Record source version, date and scope.
5. Obtain the required confirmations and independent decision for this exact matrix revision. A new draft does not replace the previously approved view.

## Verify the saved result

The accepted matrix links process, risk, control, owners and evidence with version history. Reopening a control returns to the same matrix context. A revoked or inaccessible source is a visible limitation, not an unrestricted link. Confirming the description or publishing the matrix does not establish control effectiveness.

Next, [test design and operation](/en/learn/grc-control-testing), using Acme's actual dated records.