What it is
A walkthrough follows one transaction from initiation through processing to the ledger and the financial statements. It is a common way to evaluate whether controls relevant to the audit are suitably designed and to determine that they have been implemented. Inquiry of entity personnel on its own is not enough for that determination, so each step is paired with something inspected or observed.
The template records the process and scope, the transaction chosen and why it is representative, a step table showing who does what in which system and which evidence was seen, and a controls table with design and implementation conclusions. It also covers segregation of duties, IT general control dependencies, service organizations and spreadsheets.
When to use it
- At planning for each significant transaction cycle where controls are relevant to the audit.
- When a process or system changed during the year.
- To document a first-year understanding of a new client’s processes.
What’s inside
- Process, systems, people interviewed and change since last year
- Transaction traced with source documents and ledger posting
- Step-by-step flow with evidence and control references
- Controls table: risk, assertion, type, information used, design and implementation
- Segregation of duties, IT dependencies, service organization and conclusion
Standard cited
This template follows AU-C 315. It is written in our own words, except for phrases the standard requires the document to contain, with [bracketed placeholders] for client details, amounts in USD and dates as MM/DD/YYYY. Check it against the current standard and your firm’s methodology before use. See AU-C 315 explained.
Questions
Is a walkthrough required?
AU-C 315 requires the auditor to evaluate the design of controls relevant to the audit and determine whether they have been implemented, and it states that inquiry alone is not sufficient for that. A walkthrough is a common way to meet it but not the only one.
How many transactions should I walk through?
One per distinct path through the process. If a process has manual and automated paths or domestic and foreign flows, trace one for each. The documentation should say why the transaction chosen is representative.
What if the process relies on a service organization?
Record the service organization, the report type and period, and the complementary user entity controls. Whether the service organization report is sufficient for your purpose is evaluated separately.
Does a walkthrough test operating effectiveness?
No. It supports the design and implementation conclusion. Testing operating effectiveness over a period needs separate tests of controls.
Related templates
- SOX Control Narrative (ICFR)
- SOX Risk and Control Matrix (RCM)
- Risk of Material Misstatement Matrix by Assertion (AU-C 315)
- Audit Planning Memo (AU-C 300)
Last updated 11/05/2026. All free templates.