How do you document your audit walkthroughs? Is it better to use checklists, flowcharts or summarize narratively?
Audit Walkthrough Documentation
While you can use checklists, flowcharts, narratives, or any other method that enables you to gain your understanding of controls, my favorite is a narrative mixed with screenshots.
So how do I do this?
I interview personnel. Usually, one or two people can explain a particular transaction flow (e.g., disbursement cycle), but some complicated processes may require several interviews.
Early on, I may not know how each person’s work fits into the whole. It’s like gathering puzzle pieces. The interviews and information may feel random, even confusing. But, later, when you put the parts together, the picture speaks more clearly. Then, you’ll understand the accounting system and control environment.
As you perform a walkthrough, remember your goals: to understand the accounting system and to see if internal controls exist. You also want to see if the controls are properly designed. The walkthrough is a risk assessment procedure. It tells us where risks are. If, for example, the disbursement cycle lacks appropriate segregation of duties, we want to know this. Once we know what the risks are, we assess the risk of material misstatement and plan our audit.
My Walkthrough Tools
I document the conversations using:
- A Livescribe pen
- My iPhone camera
Using a Livescribe pen, I write notes and record the conversations.
I begin the interview by saying, “Tell me what you do and how you do it. Treat me as if I know nothing. I want to hear all the details.” (For sample transaction-level walkthrough questions, see my audit series titled The Why and How of Auditing.)
As I listen, I write notes. At the same time, my Livescribe pen records the audio. Later the conversation can be played from the pen. (For more information about Livescribe, see my article: Livescribe, Note Taking Magic (for CPAs). )
Click the pen below to see Livescribe on Amazon.
I find that most interviewees talk too fast—at least faster than I can write. As I’m writing about the last thing they’ve said, they are moving to the next, and I fall behind. So I write simple phrases in my Livescribe notebook such as:
- Add vendor
- Charlie opens mail
- P.O. issued by Purchasing
- Checks signed by the computer
Later, as I’m typing the walkthrough narrative, I touch the letter “A” in “Add vendor” with the tip of my pen (I’m doing so in my Livescribe notes). This action causes the pen to play the audio for that part of the conversation. Likewise, touching “C” with the tip of my pen–in “Checks signed by the computer”–causes the pen to play that part of the discussion. Since the audio syncs with my notes, I can hear any part of the discussion by touching a letter with my pen.
In addition to writing notes in my Livescribe notebook, I take pictures with my iPhone. Of what? Here are examples (from a payables interview):
- Invoice with approver’s initials
- Screenshot of an invoice entry
- If several people are processing invoices, I take a group picture of them at their desks
- A signed check
- The bank reconciliation
So my inputs into the walkthrough document are as follows:
- Livescribe notes and audio
- Photos of documents and persons
I write my narratives in Word and embed pictures as needed. The walkthrough documentation takes this shape:
- Control identification
- Control weakness identification
Why identify control deficiencies in the walkthrough? So I can link them to the audit procedures to be performed—what audit standards refer to as “further audit procedures.” The system’s strengths and weaknesses tell me where to conduct substantive procedures.
Another key feature of the walkthrough documentation is the identification of who I spoke with and when. So, at the top of the transaction cycle description, I name the persons I interviewed and the date of the conversation. For example:
Charles Hall interviewed Johnny Mann, Hector Nunez, and Suzanne Milton on October 25, 2019.
Identification of Controls and Control Weaknesses
I note appropriate controls as follows:
Control: Additions of new vendors is limited to three persons in the accounts payable department. Each time a new vendor is added, the computer system automatically sends an email to the CFO notifying her of the addition. Persons adding new vendors cannot process signed checks.
I note control weaknesses as follows:
Control Weakness: Only one signature is required on check disbursements. Johnny Mann signs checks, has possession of check stock, keys invoices into the payables system, and reconciles the related bank account.
Response to Risk
The control weakness created by Johnny Mann’s duties increases the risk of theft. My response? I establish audit procedures in my audit program to address the risk such as:
- Review one month’s cleared checks for appropriate payees.
How do you know what audit procedures to perform in response to the risk? Ask, “What can go wrong?” and design a test for that potential. Johnny can write checks to himself. My response? Scan cleared checks to see if the payees are appropriate.
Communication of Control Weaknesses
Though this article focuses on planning and risk assessment, the identification of control weaknesses will impact our end-of-audit communications.
The words Control Weakness (as shown above) makes it easy to locate control weaknesses. Upon completion of the walkthrough, I summarize all control deficiencies so I can track the disposition of each one. Each weakness is a:
- Material weakness
- Significant deficiency, or
- Other weakness
I report material weaknesses and significant deficiencies in writing to management and those charged with governance. I communicate other deficiencies in a management letter (or verbally and document the discussion in my work papers).
For more information about how to categorize control weaknesses, click here.
See my other walkthrough posts: