Process walkthroughs and the risk and control matrix

• Perform a walkthrough that achieves the four objectives in AS 2201.34
• Document what could go wrong points and the controls that address them
• Build an RCM with the attributes reviewers expect for each key control
• Include IT dependencies and reports used in controls in the walkthrough

What the walkthrough must achieve

AS 2201.34 sets four objectives to understand likely sources of misstatement and to select controls to test:

1. understand the flow of transactions for the relevant assertions, including how transactions are initiated, authorized, processed and recorded;
2. verify that the points where a misstatement, including one due to fraud, could arise and be material have been identified;
3. identify the controls management has implemented to address those potential misstatements;
4. identify the controls over prevention or timely detection of unauthorized acquisition, use or disposition of assets that could result in a material misstatement.

AS 2201.35 requires the auditor to perform these procedures personally or supervise others providing direct assistance, because of the judgment involved. AS 2110.37 notes that AS 2201 regards walkthroughs as frequently the most effective way to achieve these objectives.

How a walkthrough works

AS 2110.37 and .38 describe it: follow a transaction from origination through the company’s processes, including information systems, until it is reflected in the financial records, using the same documents and IT that company personnel use. Procedures usually combine inquiry, observation, inspection of documents and reperformance of controls. At points where important processing happens, question the people who do the work about their understanding of what is required and what they do when they find an error.

Practical rules:

• One real transaction, end to end. Pick an actual invoice, not a sample from a training file.
• Talk to the performer, not the manager. The control owner’s description of what the clerk does is not evidence of what the clerk does.
• Look at the system. Watch the approval screen, the workflow setting or the report parameters. AS 2201.36 requires understanding how IT affects the flow of transactions; the identification of IT risks is part of the top-down approach, not a separate exercise.
• Note every report. Each report used in a control is information produced by the entity and needs its own completeness and accuracy approach (see the IPE lesson).

Documenting it

A walkthrough memo should show who was interviewed, the transaction selected, each step with the document or screen inspected, the "what could go wrong" (WCGW) at each step, the control that addresses it, and the conclusion on design and implementation. Release 33-8810 gives management flexibility in documentation form, so a narrative, a flowchart or both are acceptable as long as a third party can follow it.

The risk and control matrix

The RCM turns the walkthrough into a test plan. Typical columns:

A good control description answers five questions: who performs it, what they look at, how often, what threshold or criteria they apply, and what they do with exceptions. "The controller reviews the reconciliation" fails; "Monthly, the assistant controller compares the subledger total to the general ledger, investigates any difference over $10,000 and signs and dates the reconciliation" passes.

Keeping the RCM alive

Update the RCM when the walkthrough finds a change, when a new system goes live, or when a deficiency leads to redesign. Version it, and keep the prior-year RCM so the auditor can see what changed.

Procure-to-pay walkthrough at Lindale Packaging Co.