Audit Walkthrough: Purpose, Preparation, and Procedure
Understand the audit walkthrough, a core procedure where auditors trace a transaction to verify process integrity and evaluate internal controls.
Understand the audit walkthrough, a core procedure where auditors trace a transaction to verify process integrity and evaluate internal controls.
An audit walkthrough is a procedure where an auditor traces a transaction from its start, through a company’s systems, until it is recorded in the financial statements. This process involves using the same documents and software that company employees use, providing a direct view of a company’s operations. It is a detailed examination of one complete cycle of a transaction, not a random sampling.
For example, an auditor might follow a single sales order from the moment a customer places it until the final payment is received and reflected in the company’s revenue accounts. The goal is to see the process in action to confirm the auditor’s understanding of the company’s documented procedures.
The purpose of a walkthrough is for an auditor to confirm their understanding of how transactions flow through a company’s accounting system. This procedure helps evaluate both the design and implementation of internal controls, which are policies meant to safeguard assets and ensure accurate financial reporting. The walkthrough allows the auditor to identify points where a material misstatement could occur and see what controls exist to prevent or detect such errors.
A primary objective is to assess if controls are designed effectively and have been implemented. For example, in a “procure-to-pay” cycle, an auditor traces the process from a purchase requisition to the final vendor payment. The auditor confirms if a control, like requiring manager approval for large purchase orders, is part of the process design.
To verify implementation, the auditor would inspect documents for evidence of the required approval signature, confirming the control is a consistent practice. This process is also used to comply with regulations like the Sarbanes-Oxley Act (SOX). SOX requires management to assess internal controls, and the walkthrough is a direct way for auditors to gather evidence about those controls to identify risks and plan the audit.
Preparation is a collaborative effort between the company and the auditor. The company must provide specific documents that illustrate the transaction cycle being reviewed. For an “order-to-cash” process, this includes the customer purchase order, the company’s sales order, shipping documents, the sales invoice, and corresponding accounting entries.
Auditors will also request process narratives, which are written descriptions of the transaction cycle, and flowcharts, which are visual diagrams of the process. These documents provide the auditor with a map of the process to verify during the walkthrough. Preparing these materials in advance allows the procedure to be efficient.
A significant part of preparation involves identifying and scheduling the employees who perform the tasks. The auditor needs to speak directly with the people who execute controls and process transactions daily to confirm their understanding of the procedures. The company should ensure these employees are available and understand they will be asked to explain and demonstrate their tasks.
During the walkthrough, the auditor traces a selected transaction, such as a sales invoice or payment voucher. The auditor then employs four main techniques to gather evidence, often used in combination.
By combining these techniques, the auditor builds a comprehensive understanding of the transaction flow and control environment.
Following the procedure, the auditor records the findings in updated process narratives, annotated flowcharts, or summary memorandums. This documentation will note the specific transaction traced, the individuals interviewed, the questions asked, and the documents inspected.
The primary output is the auditor’s conclusion on the design and implementation of the controls. The work papers state whether controls appear effective and have been put into operation. Any identified control deficiencies, such as a missing approval step, are noted. This documentation supports the auditor’s risk assessment and planning for the rest of the audit.