A well-performed walkthrough can cement the risk-based foundations of a high-quality audit. As per auditing standards, walkthroughs allow the auditor to evaluate the design and implementation (D&I) of controls relevant to the financial reporting process. This is a requirement for controls addressing significant risks and journal entries as per the standards, even when the auditor does not intend to test the operating effectiveness of controls.

But walkthroughs are not merely an exercise in ISA compliance. Even the most basic walkthrough, effectively performed, can deliver benefits: 

• It provides valuable insights into an entity’s processes and data flows. This allows for a more tailored audit response and can even identify areas where testing can be more efficient.
• It establishes strong foundations for the testing strategy, providing greater confidence in sample sizes, approach to substantive analytical procedures and the evaluation of misstatements.
• It enhances audited entity engagement. An auditor who can demonstrate a deep understanding of a business is more likely to foster a better constructive working relationship with the audited entity.

It may also pave the way for potential testing of operating effectiveness of controls and therefore reduced substantive testing if it can be justified – via an evidenced walkthrough – that the relevant controls are designed and implemented appropriately. They may lead to more streamlined group audit procedures where a walkthrough performed at each entity provides evidence that the group has a common system of control.

The following steps will help you achieve an effective walkthrough:

1) Perform walkthroughs before period-end and not just in the first days of fieldwork 

If you defer walkthroughs to the fieldwork stage, you are not evaluating controls as they operate during the period under audit and you will have left it too late to understand the entity and design better, more tailored responses to assessed risk. 

2) Speak to and observe your client

Emailing a generic checklist may not get results, and inquiry alone cannot provide sufficient evidence on the design and implementation (D&I) of controls. Conversations while observing live processes can provide specific information and get you thinking about more probing questions regarding ‘what’, ‘when’, ‘how’ and ‘what could go wrong’. Doing this face to face offers insight into organisational culture and can be a solid indicator of the strength of the control environment.

3) Do not underestimate the power of a flowchart or map

A well-documented process flowchart enlivened by annotated screenshots can provide a clearer depiction of the information journey than reams of hard-to-follow system notes. 

4) Don’t rely on last year’s notes

A lot can change in a year including technologies, staff and even controls. Your walkthrough documentation should reflect how controls operate during the period you are auditing. Bear in mind that management and staff may not always remember that controls have changed.

5) Focus your walkthroughs on controls relevant to financial reporting 

Too much work is often performed on operational controls that have little to do with financial reporting. The only controls you need to cover are those designed to prevent, detect and correct material misstatements. 

6) Think like a fraudster 

Ask yourself: how would I commit a fraud at this company? This can get you thinking about the potential system gaps that bad actors could exploit. This can then be flipped into a question for the client which gets to the bottom of the controls that are there to fill those gaps. Also remember to consider journals posted throughout the year and not just at the period-end. If you had malicious intent, which period would be most and least likely to attract auditor attention?

Once you’ve documented your system notes, don’t be afraid to send them to the audited entity to confirm your understanding. 

Performed effectively, walkthroughs provide insights into an entity’s processes, establish strong foundations for testing strategies, and enhance audited entity engagement.

Helen Pierpoint, Technical Manager, Audit and Assurance Faculty, ICAEW. 

With thanks to Peter Herbert, Rhodri Whitlock and Stephanie Henshaw for their insights.

A longer version of this article is available at Audit & Beyond, the ICAEW Audit Faculty’s member content hub.

Further resources

Quality documentation getting it right first time

ISA 315: Putting the building blocks together

ISA 315: Assembling the building blocks