Walkthroughs and deciding whether to test controls

How to document a walkthrough of a client's process, judge design and implementation, and decide whether to test controls or go fully substantive.

By Achekam · 11 October 2026 · 5 min read · For Accountants & audit firms in South Africa, Nigeria, Kenya

A narrative copied from last year's file, updated with the new financial manager's name, is not a walkthrough. Nor is a flowchart drawn from what the client says should happen. A walkthrough follows one real transaction through the client's process, using the client's own documents and systems, and checks at each step whether what the team was told is what actually happens.

It is also where the team decides one of the bigger questions on the audit: rely on the client's controls and test them, or go fully substantive. Getting that decision on paper, with reasons, is what this article is about.

What a walkthrough confirms

Pick a transaction from the population, for example one credit purchase, and trace it from the request through ordering, receipt, invoice capture, approval, payment and posting to the general ledger. At each step, inspect the document or system record, observe the person who performs the step where you can, and note who did what.

A good walkthrough answers four questions:

1. Does the process work the way the narrative says?
2. Where could an error or fraud enter, and would anything stop it?
3. Which IT systems and reports does the process rely on?
4. Are the controls the client described in place, or only in the policy manual?

Inquiry alone does not answer the last question. Combine it with inspection of the documents and, where useful, observation; a signature on the purchase order is evidence that an approval happened, while a clerk telling you orders are approved is not.

Design and implementation versus operating effectiveness

ISA 315 (Revised 2019) asks the auditor to evaluate whether certain controls are designed effectively and to determine whether they have been implemented. That includes controls that address significant risks and controls over journal entries. The IAASB's page on ISA 315 (Revised 2019) describes the standard on identifying and assessing the risks of material misstatement and why it was revised for a more consistent risk assessment.

Design and implementation is a point-in-time judgement: the control is capable of preventing or detecting the error, and it exists. Operating effectiveness, under ISA 330, is a different question: did the control work consistently throughout the period? A walkthrough supports the first. It does not prove the second, because one transaction says nothing about the other eleven months.

Plan to test operating effectiveness when you intend to rely on a control to reduce substantive work, or when substantive procedures alone cannot give enough evidence, as with high volumes of transactions processed automatically with little manual record.

When a small-entity audit goes fully substantive

For many owner-managed companies, testing controls is neither possible nor efficient. One bookkeeper captures, approves and pays; the owner can override anything; the documentation of controls is thin. In those cases a fully substantive approach is usually the right answer.

Going fully substantive does not remove the walkthrough. The team still needs to understand the process and the controls relevant to the risk assessment, including the design and implementation of controls over significant risks and over journals. What changes is that the team does not test operating effectiveness and does not reduce substantive work on the strength of controls. Record the decision and the reason: "no reliance on controls because duties are not segregated in purchases and the owner approves and pays" tells a reviewer why the substantive samples are the size they are.

Recording the walkthrough in the controls studio

Achekam's Controls & Walkthrough Studio saves its work on the server against the engagement you choose. It has been checked for real server calls and the absence of mock data, though not audited in depth, and the ISA numbers shown on its badges are labels, not evidence that the work meets the standard. The quality of the documentation stays the team's responsibility.

The procedures themselves sit on the work item. Each work item lists the procedures to perform and the documents required, and a step is marked done only with a written response and its documents, or set aside with a reason. A walkthrough step should therefore carry the transaction reference, the documents inspected and what was observed, not a tick.

In the Working Paper Control Centre, the file appears as an index with progress by status, and the same papers can be grouped by preparer, reviewer, risk or statement line. Grouping by risk is a quick check that each significant risk has a controls paper behind it.

Staff can ask AI to draft a conclusion on a working paper, and the draft enters the file only when a person saves it; a template can forbid AI drafting altogether. Reviewers raise review notes on the paper, the preparer answers and the reviewer clears them, with each note's history kept. A useful review note on a walkthrough is the one that asks which document proves the control operated, rather than which person said it did.

A worked example in words: at a distributor, the senior walks through one purchase and finds that the goods-received note is signed by the same storeman who placed the order. The control the client described, independent receipt of goods, is not implemented. The senior records the finding, concludes there is no reliance on that control, and increases substantive testing of purchases and payables cut-off.

Deficiencies found along the way

Walkthroughs are where most control deficiencies are first seen. ISA 265 asks the auditor to communicate significant deficiencies in writing to those charged with governance, and other deficiencies of enough importance to management. Note each deficiency as you find it, with the transaction that revealed it, so the letter is built from evidence. How to write that letter is covered in management letters and control deficiencies, and the wider risk assessment in risk assessment under ISA 315.

A question to ask at planning

For each significant class of transactions, write one sentence: "We will rely on controls because…" or "We will not rely on controls because…". If the team cannot finish the sentence, the walkthrough is not done yet.

General guidance only, not advice on your own circumstances. Tax and payroll rules change: check the current position with the authority or your adviser.