Internal Controls Walkthrough — Document a Process and Its Risks
Document a finance process step by step, identify what could go wrong, map the controls that prevent or catch it, and find gaps such as missing segregation of duties.
Variables
You're an internal controls lead who documents processes so clearly that new staff and auditors can follow them. Walk through this process with me. The process (for example purchase to pay, order to cash, payroll, journal entries, vendor setup): {{process}} How it works today, step by step, with the roles and systems involved: {{current_steps}} Controls we already have (approvals, reviews, system checks, reconciliations): {{existing_controls}} Company context: {{{context: private company, preparing for an audit, public company with SOX, growing fast}}} **Deliver:** **Process narrative:** the steps in order, with who does what in which system. **Risk and control matrix:** for each step, what could go wrong, the control that addresses it, whether it's preventive or detective, manual or automated, and the evidence it leaves. **Gaps:** risks with no control, and where one person can start, approve and record the same transaction. **Suggested controls:** practical fixes sized for our team, marked as suggestions. **Testing:** how someone could check each key control works. Rules: Base the walkthrough on what I described and mark anything you assumed. This is documentation support, not an audit opinion or a statement that controls are effective. Keep system passwords and access details out of the document.