A control can be described perfectly in a policy and still fail in practice. Perhaps the reviewer approves a reconciliation without investigating a material difference, a system report excludes transactions, or evidence is saved without showing what was actually checked. For financial controllers, the challenge is not simply to document controls—it is to demonstrate that they are designed appropriately, performed by the right people, and supported by evidence that makes the conclusion reproducible.
A disciplined control walkthrough helps expose these gaps before year-end. It follows a real transaction or control instance through the process, from source information to the financial reporting result, and checks whether the documented procedure matches what people and systems actually do.
What a control walkthrough should accomplish
A walkthrough is a practical way to understand a process, identify where a misstatement could occur, and evaluate whether key controls are present and implemented. The PCAOB’s [AS 2201](https://pcaobus.org/oversight/standards/auditing-standards/details/AS2201) describes auditor walkthrough procedures that commonly combine inquiry, observation, inspection of documentation, and reperformance. That standard governs auditor work in its applicable context; management can use a similar evidence-oriented approach internally without confusing a management control review with an external audit.
The goal is not to tick a box or prove that every control operated effectively for an entire period based on one example. A walkthrough helps the controller understand the process and assess design and implementation. Operating-effectiveness testing, when required, needs a suitable testing approach and evidence for the period and risk being assessed.
Start with the financial reporting risk
Choose the account, disclosure, assertion, or process that matters—not simply the process that is easiest to document. Examples include revenue recognition, inventory valuation, manual journal entries, account reconciliations, consolidation adjustments, or access to financial reporting applications.
Write down the risk in plain language. For example: “Manual journal entries may be posted to a material account without appropriate review, resulting in an unauthorized or unsupported financial statement adjustment.” Then identify the relevant control objective and the control expected to address that risk.
For US public companies subject to applicable ICFR requirements, the SEC’s [management guidance on internal control over financial reporting](https://www.sec.gov/rule-release/33-8810) describes a top-down, risk-based approach. The scope and obligations depend on the entity and applicable rules; not every private company has the same requirements. Canadian organizations should assess their own reporting, regulatory, lender, and governance obligations rather than assume US SOX requirements automatically apply.
Follow one item end to end
Select a recent, representative instance and trace it from initiation to its final financial reporting impact. For a journal-entry review, that might mean locating the source request, checking the supporting calculation, confirming preparer and approver identities, inspecting workflow history, and tracing the posted entry to the general ledger.
For a balance-sheet reconciliation, follow the account balance to the underlying ledger, inspect the reconciliation, examine reconciling items, and verify how aged or unusual differences were investigated and resolved. For a spreadsheet-based control, inspect where the data came from, which formulas or transformations were applied, who changed them, and how the reviewer validated the output.
Ask the process owner to demonstrate the actual steps while you compare them with the written procedure. Observe the system screens and reports used, not just a summary prepared for the walkthrough. If an automated report is central to the control, document the report parameters and assess whether the population is complete and accurate for the intended purpose.
Test the five areas most likely to reveal gaps
1. Ownership and competence
Confirm who performs the control, who reviews it, and whether each person has the authority and knowledge needed. Check that responsibilities are current and that a reviewer is not merely approving their own work. If a backup reviewer is used during absences, make sure the substitute is authorized and the handover is documented.
2. Precision and thresholds
Look at whether the control is specific enough to identify a potentially material problem. “Review monthly variances” is vague unless the process defines what is compared, what level of difference triggers investigation, how unusual movements are evaluated, and how the conclusion is recorded. Thresholds should reflect the account’s risks and organizational policy, not be chosen only to keep the exception list short.
3. Data completeness and accuracy
Where a control relies on a system report, spreadsheet, or data extract, establish how the reviewer knows the information is complete and accurate. Inspect report filters, dates, company codes, account ranges, currency settings, and any manual exclusions. Reconcile totals to an authoritative source where appropriate. A thoughtful review of an incomplete report can still miss the very transactions the control is meant to detect.
4. Evidence of what was reviewed
Look for evidence that supports the action, not just evidence that a file exists. A useful review record identifies the preparer, reviewer, date, population or report version, issues considered, and resolution of significant exceptions. A generic “approved” stamp may not demonstrate the nature or precision of the review.
5. Exception handling and follow-through
Choose an exception and follow it to closure. Was it assigned to an owner? Was the root cause investigated? Was a correction approved and posted where necessary? Was the control owner notified if the issue indicated a wider problem? Open items should have a documented rationale, owner, due date, and escalation path.
Document findings in a repeatable format
A walkthrough record should be concise enough to maintain, but detailed enough for another knowledgeable reviewer to understand the work. Consider documenting:
- Process and risk: account, reporting assertion, risk statement, and control objective.
- Control description: frequency, performer, reviewer, system, report, and threshold.
- Instance traced: transaction or reconciliation reference, period, and evidence inspected.
- Observed operation: actual steps compared with the documented procedure.
- Data reliability: source, filters, population checks, and relevant report parameters.
- Exceptions: deviation, potential financial impact, owner, remediation, and target date.
- Conclusion and next steps: design or implementation concerns, further testing needed, and responsible approver.
Do not record sensitive personal or financial information beyond what is needed for the control record. Follow your organization’s access, retention, and confidentiality requirements.
How to use walkthroughs in SAP and other ERP environments
For SAP S/4HANA Finance, a walkthrough might trace a manual journal entry through its supporting documentation, workflow approval, posting, and ledger reporting. Another might follow an account reconciliation from the ledger balance through a reconciliation tool or spreadsheet to documented review and exception resolution.
Capture the relevant system configuration and workflow context, but avoid assuming that every SAP implementation uses the same apps, roles, or approval design. Record the system and process variant tested, relevant report parameters, and any manual steps outside SAP. If the control depends on access restrictions or automated workflow, determine whether separate access or IT general control work is needed to support reliance on it.
Controller checklist before closing the walkthrough
- Risk and control objective are clearly stated.
- A representative transaction or control instance has been traced end to end.
- Actual practice has been compared with the documented procedure.
- Control owner, reviewer authority, and segregation of duties are understood.
- Key reports and data populations have been assessed for completeness and accuracy.
- Review precision, thresholds, and exception handling are clear.
- Evidence supports the work performed and the conclusion reached.
- Gaps have an assigned owner, remediation plan, and follow-up date.
- The walkthrough’s limitations are recorded and additional testing is planned where needed.
Conclusion: make the process observable
Effective walkthroughs help controllers find the difference between a control that sounds good on paper and one that works in the real process. Start with financial reporting risk, follow evidence through the system, test the reliability of reports, and trace exceptions to resolution. Use the findings to improve control design and determine where more testing is necessary—without treating one walkthrough as proof of year-round operating effectiveness.
Informational only: This article is general guidance, not legal, accounting, or audit advice. Apply the requirements relevant to your organization and consult qualified professionals when needed.
