Glossary/Risk and controls

Walkthrough

A walkthrough follows a single transaction from initiation through processing to recording in the financial statements, to confirm the auditor's understanding of a process and whether its controls are in place.

CORAA TeamUpdated November 5, 2026

Definition

The auditor picks one transaction, such as a customer order, and follows it step by step: who approved it, which system captured it, how it reached the ledger. Walkthroughs usually combine inquiry, inspection of the documents produced at each stage and observation. The term is widely used in practice and appears explicitly in the PCAOB standard on audits of internal control. AU-C 315 does not use it as a defined term.

Why it matters in an audit or review

AU-C 315 requires the auditor to evaluate the design of relevant controls and determine whether they have been implemented, and inquiry alone is not enough for that. A walkthrough is the typical way to do both, and it often exposes steps that differ from the narrative management described.

Example

The auditor selects a $14,300 (illustrative) vendor payment and follows it from purchase requisition to purchase order, receiving report, three-way match, approval, check run and posting. Documents at each step are copied to the file. The auditor finds that the approver can also create vendors, which is noted as a segregation concern.

Common mistakes

  • Walking through a process using only the narrative and not a real transaction.
  • Assuming a walkthrough tests operating effectiveness. One item does not.

FAQ

Is a walkthrough a test of controls?

No. It supports understanding and implementation. Operating effectiveness needs a sample over the period.

Sources

Definitions paraphrase AICPA and FASB guidance; read the standard itself before relying on a requirement. Example figures are illustrative. This page is guidance, not professional advice. Report an error

Standards

AU-C 315

Related terms

  • Tests of controls
    Tests of controls are audit procedures that evaluate whether a control operated effectively throughout the period, and they are required when the auditor plans to rely on controls or substantive tests alone cannot suffice.
  • Inquiry
    Inquiry is an audit procedure that seeks information from knowledgeable people inside or outside the entity, in formal written or informal oral form, and is rarely enough evidence on its own.
  • Observation
    Observation is an audit procedure that consists of looking at a process or procedure being performed by others, such as a physical inventory count or the handling of cash receipts.
  • Risk assessment procedures
    Risk assessment procedures are the audit procedures used to understand the entity and its environment, internal control and applicable framework, in order to identify and assess the risks of material misstatement.

Go deeper

All glossary terms →

For US CPA firms

Join the CORAA waitlist

CORAA AI drafts audit working papers from your client’s QuickBooks books and does the first pass: lead schedules, tie-out, memos, draft notes and letters. CORAA Network reviewers clear every finding. Your firm reviews and signs.

  • First audit free, so you can judge the quality on a real file
  • Flat fee by entity size; messy books included
  • We work only with CPA firms, never their clients
See how it works →

* required