CORAA
લૉગ ઇનમફત ટ્રાયલ શરૂ કરો
CORAA University / Free walkthrough memo

Internal audit walkthrough memo generator

Document process understanding before RCM design: who does what, which system is used, which document was traced, what control was observed and what needs follow-up.

Walkthrough profile

The defaults below are illustrative. Replace the entity, dates, document numbers and process owners with evidence from the actual walkthrough before using the export in a workpaper file.

Steps traced
5
High facts
2
Design gaps
1
Follow-ups
1
Process facts
AreaFact / understandingCriticality
Walkthrough trace
StepProcess stepOwnerSystemDocument tracedControl observedDesign resultGap / follow-upRCM handoff
Draft process memo

We performed a process walkthrough for Procure to Pay covering Procurement Head, Stores In-charge, AP Lead, Treasury Manager. The walkthrough traced representative documents across the process from initiation to recording and settlement. 1. Purchase requisition is raised by department user (Department requester, ERP procurement module). 2. Purchase order is created against approved PR (Procurement executive, ERP purchase module). 3. Goods are received and GRN is posted (Stores in-charge, ERP inventory module). 4. Vendor invoice is booked after three-way match (Accounts payable, ERP finance module). 5. Payment proposal is prepared and released (Treasury, Bank portal and ERP payment run). The walkthrough identified 1 design gap(s) and 1 follow-up item(s). RCM handoff is required for 5 control row(s).

Walkthrough discipline

Strong memos need a document traced

A process narrative is weak if it only repeats the SOP. A defensible walkthrough normally traces relevant real transactions or documents through the process and records the observed control design, system dependency and RCM consequence.

Use this after the data request list and before the RCM builder. Once controls are selected, build the sampling plan.

How an internal audit walkthrough memo should work

A walkthrough memo records how a transaction or activity moves through a business process before the auditor finalises the RCM. It should capture the process owner, system, document traced, control observed, design result, gap and next RCM action.

The memo should not be a copied SOP. It should show that the auditor traced at least one real item end to end and understood what prevents, detects or fails to prevent the relevant risk.

This generator creates a process-understanding memo, walkthrough trace, design-gap list and RCM handoff sheet. It is useful for P2P, O2C, R2R, H2R, cash, inventory, treasury, compliance and ITGC reviews.

Worked example - P2P walkthrough

The internal audit team traces one purchase from PR to PO, GRN, invoice booking and payment. The ERP approval trail exists, but bank portal approvers are not reconciled to the ERP matrix.

Inputs
CycleProcure to Pay
Steps traced5
Design gaps1
Output
MemoProcess understanding and traced-document narrative
RCM handoffPayment access control added for testing
The walkthrough does not conclude operating effectiveness. It identifies whether the control is designed well enough to be added to the RCM and tested across the period.

Common mistakes

Copying the SOP as the walkthrough
The memo should record what was actually traced and observed. SOP language is background, not walkthrough evidence.
Skipping system touchpoints
Most process failures happen at handoffs between ERP, bank portal, HRMS, WMS, spreadsheets and manual approvals. Record every system dependency.
Treating walkthrough as operating effectiveness testing
A walkthrough supports process understanding and design evaluation. Operating effectiveness still needs sampling, full-population testing or monitoring evidence.
No RCM handoff
Every relevant control observed during walkthrough should become an RCM row or a documented reason for exclusion.

Frequently asked questions

What is a walkthrough in internal audit?+
A walkthrough traces one transaction, document or event through the process so the auditor understands process flow, systems used, controls performed and design gaps before finalising the RCM.
Is a walkthrough the same as test of controls?+
No. A walkthrough helps understand the process and assess control design. Test of controls evaluates whether the control operated consistently across the period.
What should be documented in a walkthrough memo?+
Document interviewees, process steps, owners, systems, documents traced, controls observed, design result, gaps, follow-up questions and the RCM handoff.
How many walkthroughs are needed?+
There is no universal number. The auditor should trace enough items to understand the process, key variations, systems and control design before designing fieldwork.

Authoritative sources

ICAI
ICAI IASB - Compendium of Standards on Internal Audit — Applicable from April 1, 2026; supports planning, evidence, documentation, review and reporting for internal audit work.
ICAI
ICAI IASB - Standards on Internal Audit publications — Lists current and legacy standards covering internal controls, entity knowledge, planning, evidence, documentation, review and reporting.
The IIA - Global Internal Audit Standards — The 2024 standards became effective for internal audit functions on January 9, 2025.
Always confirm against the latest version of the source. Regulations evolve and amendments are common.
Related calculators
Data request list generator →Internal audit RCM builder →Sampling plan generator →Cycle audit programmes →CORAA Internal Audit →
Share this tool
Last reviewed: 2026-08-30 · For informational purposes only — not professional advice.