How do you document your audit walkthroughs? Is it better to use checklists, flowcharts or summarize narratively?
Audit Walkthrough Documentation
While you can use checklists, flowcharts, narratives, or any other method that enables you to gain your understanding of controls, my personal favorite is narrative mixed with screen shots. So how do I do this?
I determine the people involved in a transaction flow and schedule interviews with them. Usually, one or two people can explain a particular transaction flow (e.g., disbursement cycle), but some complicated processes require several interviews.
Sometimes I don’t know how each person’s work fits into the whole, so it’s like gathering puzzle pieces—at this stage, I am reaching for bits of the picture. The interviews and information may feel random, even confusing. But when you put the pieces together, you will see the picture—and that’s what we’re after, understanding the accounting system and control environment.
I document the conversations using:
- A Livescribe pen
- My iPhone camera
Using a Livescribe pen, I write notes and record the conversations.
I begin the interview by saying, “Tell me what you do and how you do it. Treat me like I know nothing. I want to hear all the particulars.”
As I listen, I write general notes. The Livescribe pen records the audio which syncs with my written notes. Later the conversation can be played from the pen—more in a moment about how I use this tool.
I find that most interviewees talk too fast—at least faster than I can write. And as I’m writing their last comment, they are moving to the next (and I fall behind). So I write simple words in my Livescribe notebook such as:
- Add vendor
- Charlie opens mail
- P.O. issued by Purchasing
- Checks signed by the computer
Later as I’m typing the narrative into Word, I touch the letter “A” in “Add vendor” with the tip of my pen. The touching of the letter “A” causes the pen to play the audio for that part of the conversation. Likewise touching “C” with the tip of my pen–in “Checks signed by the computer”–causes the pen to play the discussion at that point. Since the audio syncs with my written notes, I can hear any part of the discussion by touching a letter with my pen.
And since Livescribe captures the audio, I jot down words—such as “Add vendor”—so I can later retrieve particular parts of the interview. These short phrases are markers for the audio and an outline of the conversation.
In addition to writing notes in my Livescribe notebook, I also take pictures with my iPhone. What am I taking snapshots of? Here are examples (from a payables interview):
- Invoice with approver’s initials
- Screenshot of an invoice entry
- If several people are processing invoices, I take a group picture of them at their desks
- A signed check
- The bank reconciliation
So my inputs into the walkthrough document are as follows:
- Livescribe notes and audio
- Photos of documents and persons
I write my narratives in Word and embed pictures as needed. The walkthrough documentation takes this shape:
- Control identification
- Control weakness identification
Why identify control deficiencies in the walkthrough? So I can link them to the audit procedures to be performed—what audit standards refer to as “further audit procedures.” The weaknesses tell me where to conduct substantive procedures.
Another key feature of the walkthrough documentation is the identification of who I spoke with and when. So at the top of the transaction cycle description, I name the persons I interview and the date of the conversation. For example:
Charles Hall interviewed Johnny Mann, Hector Nunez, and Suzanne Milton on October 25, 2016.
Identification of Controls and Control Weaknesses
I note appropriate controls as follows:
Control: Additions of new vendors is limited to three persons in the accounts payable department. Each time a new vendor is added, the computer system automatically sends an email to the CFO notifying her of the addition. Persons adding new vendors cannot process signed checks.
I note control weaknesses as follows:
Control Weakness: Only one signature is required on check disbursements. Johnny Mann signs checks, has possession of check stock, keys invoices into the payables system, and reconciles the related bank account.
Response to Risks
The control weaknesses created by Johnny Mann’s performance of critical disbursement procedures increases the risk of theft. My response? I establish audit procedures in my audit program to address the risk such as:
- Review one month’s cleared checks for propriety, examining the check signature and payee.
How do you know what audit procedures to perform in response to the risk? Ask, “What can go wrong?” and design a test for that potential. Johnny can write checks to himself. My response? Scan cleared checks to see if the payees are appropriate, particularly on those checks with Johnny’s signature.
Communication of Control Weaknesses
Though this article focuses upon planning and risk assessment, the identification of control weaknesses will impact our end-of-audit communications.
The bolded text (Control Weakness) makes it easy to locate control weaknesses. Upon completion of the walkthrough, I summarize all control deficiencies in separate memos so I can track the disposition of each one. Ultimately each weakness is deemed a:
- Material weakness
- Significant deficiency, or
- Other weakness
I report material weaknesses and significant deficiencies in writing to management and those charged with governance. I communicate other deficiencies in a management letter (or verbally and document the discussion in my work papers).
For more information about how to categorize control weaknesses, click here.
If you missed my first two walkthrough posts, see them here:
Click the pen below to see the Livescribe on Amazon.