As a former auditor, I performed walk throughs of certain key account processes or cycles to gain a complete understanding of a transaction from start to finish. Sometimes it became quite cumbersome because certain processes were complex or lengthy. However, after walking through a process I was able to gain a solid understanding of the areas of risk exposure and, most importantly, I could answer the question, “what could go wrong in this area.” This informed me further in planning my audits and responding to risks.
As a basis for framing my post today, the PCAOB AU No. 5 at ¶ 37, describes a walkthrough as follows:
In performing a walkthrough, the auditor follows a transaction from origination through the company’s processes, including information systems, until it is reflected in the company’s financial records, using the same documents and information technology that company personnel use. Walkthrough procedures usually include a combination of inquiry, observation, inspection of relevant documentation, and re-performance of controls.
Although this guidance is intended to apply to audits of internal controls over financial reporting, implemented by an entity in preparing its financial statements, the principles gathered from walk throughs can be applied to a variety of circumstances.
As basic as they may seem, walk throughs I believe are the bedrock to understanding the flow of transactions in accounts, particularly complex ones. Following are some powerful things that can be gathered from a walk through:
- Build rapport with the interviewee through conversation that can be transitioned from “formal” (early on in the walk through) to “informal” or more “relaxed” (once enough questions have been discussed and the anxiety of meeting someone for the first time can be overcome)
- Identify “types” of documentation not previously known
- Assess the competency of an account owner/interviewee
- Assess the body language of the interviewee and gather relevant information therefrom
- Identify improper segregation of duties (custody, record keeping, and authorization/verification)
- Identify exposures to fraud and/or error
To do effective walk throughs, it’s critical that the person conducting the meeting have sufficient experience to understand what types of questions to ask and, maybe more importantly, if answers are satisfactory or if probing is necessary. Depending on the risks/allegations, a walk through may encompass a portion of or an entire process, including: initiation, authorization, recording, processing, and reporting.
I’ve found the following types of questions to be helpful in a walk through (of course, adapting the questions to the relevant facts/allegations and circumstances is critical to an effective discussion):
- Please describe your role in this process.
- Who else is involved in this process (preparers, reviewers, approvers, etc.)?
- What happens when a transaction is not approved?
- What systems (internal or external) do you use or rely upon to perform your duties? This type of questioning can assist in identifying the areas of manual intervention, which often times are the areas of highest exposure to fraud and/or error.
- Where do you understand the areas of judgment or estimate to be?
- Have you or anyone you know been asked to override any controls?
- If there were a questionable transaction or request, who would you go to for guidance or advice?
Depending on the situation, I recommend two interviewers in attendance. For example, in an investigative scenario, it may be appropriate to have two persons in attendance, one to ask the questions and interact with the interviewee and another to take notes, but also to stand as a “witness” should allegations come back against the interviewer.
Sometimes a walk through may not be possible because access to the person(s) may be restricted. In these scenarios, the best available information should be considered and, using an experienced professional’s understanding of the flow of similar business transactions, one should formulate an “expectation” for how transactions are processed and then refine that “expectation” as new information becomes available.
As a reiterative point, having an experienced professional involved in the process greatly increases the odds of a successful outcome (“successful” of course being a relative term) and is critical in sorting through what is relevant, what is not, and what may be an intentional diversion.