However, you can draw a matrix to represent controls that reduce the expected losses during data capture. The elements of the matrix might include a rating of the effectiveness of each internal control at reducing the potential loss from each cause, and the reliability of the control in light of compliance testing results. The IT auditor then performs three types of evaluation in terms of the matrix. These are columnar evaluation, row evaluation, and global evaluation. As explained, the IT auditor asks this question before and after testing the controls for reliability.
Global evaluation means finding the optimal set of controls for the organization.
Such an optimal set of internal controls results from a joint evaluation of columns and rows. With respect to the problem of determining an optimal set of global evaluation, there are still two more complicating factors. Firstly, the marginal costs and, secondly, the marginal benefits of a control often depend on the controls being exercised. Lastly, the marginal benefits of any one control should exceed the marginal costs of that control. The matrix of the evaluation decision can also be used to depict the various functions of the external and internal IT auditor.