What is a Walkthrough in Audit?
A walkthrough is an audit procedure in which the auditor follows one transaction from origination through the company's processes and systems to the financial records, confirming the flow and the controls along it.
- A walkthrough follows one real transaction from origination to the financial records, using the documents and systems the company's own staff use.
- PCAOB AS 2201 describes the procedure: inquiry, observation, inspection and reperformance at each significant point in the process.
- It evaluates design and confirms a control is in operation; it does not prove the control operated effectively across the period.
- Walkthroughs are repeated annually for each significant process in a SOX audit, and most SOX programs mirror that cycle.
- SmartSuite Audit Management keeps walkthrough notes, evidence and the transaction trail linked to each process and control.
What is a Walkthrough in Audit?
A walkthrough is an audit procedure in which the auditor follows a transaction from origination through the company's processes and systems until it reaches the financial records, using the documents and technology company personnel use.
The description comes from PCAOB AS 2201, paragraphs 37 and 38. A walkthrough combines inquiry, observation, inspection of documentation and reperformance. At each significant point in the process the auditor asks personnel about their understanding of the required procedures and controls, and probes for whether the control is performed as described and whether they have seen exceptions. Walkthroughs are performed for each significant process in a SOX audit and repeated annually, and the same technique is used by internal auditors and SOX teams to document processes before testing.
Why it matters
- It validates the process narrative. Documentation drifts; a walkthrough shows what people actually do.
- It locates the risks. The objective is to identify the points where a misstatement could arise and the controls that address them, which is the basis for selecting key controls.
- It catches design gaps early. A control that cannot be walked through, because the evidence does not exist or the owner does not perform it, is a design deficiency before any sample is tested.
What a walkthrough covers
AS 2201 paragraph 34 sets the objectives: understand the flow of transactions, including how they are initiated, authorized, processed and recorded; verify that all points at which a misstatement could occur have been identified; identify the controls management has implemented to address those risks, including controls over unauthorized transactions; and identify controls over the prevention or timely detection of unauthorized acquisition, use or disposition of assets.
Walkthrough versus test of controls
A walkthrough is evidence about design and about whether a control has been placed in operation. It is not evidence that the control operated effectively across the period. That requires a test of operating effectiveness over a sample of instances. Auditors may draw some operating evidence from a walkthrough for controls that operate infrequently, but the two procedures serve different purposes and both are documented.
Running an effective walkthrough
- Pick a real, completed transaction, not a template.
- Sit with the people who perform each step and use their systems and screens.
- Record each control point, the evidence it produces and any manual workaround.
- Note segregation of duties and system access as you go.
- Update the narrative, flowchart and risk-control matrix from what was observed, not the reverse.
Related terms
In SmartSuite
SmartSuite Audit Management stores walkthrough notes, screenshots and the transaction trail against each process and control, so the documented flow, the identified risk points and the key control selection stay linked and can be updated after each annual walkthrough.
Frequently asked questions
Is a walkthrough required every year?
For a SOX integrated audit, the auditor performs walkthroughs for each significant process annually as part of understanding likely sources of misstatement. Management's own assessment does not mandate a formal walkthrough, but most SOX programs repeat them each year because process changes are the main reason documentation becomes stale.
Does a walkthrough test that a control works?
It shows that the control exists and has been placed in operation, and it evaluates design. It does not show that the control operated consistently across the period. That evidence comes from testing a sample of the control's operation, so a walkthrough is a precondition for testing, not a substitute for it.
Who should be interviewed during a walkthrough?
The people who actually perform each step, not only the process owner. AS 2201 directs the auditor to question personnel at each significant point about their understanding of the required procedures and controls, whether they are followed, and whether exceptions have occurred, because that is where undocumented workarounds surface.
Get started with SmartSuite
See how connected GRC, IT and operations work on one platform.