Topics in this domain
- ISACA Code of Professional Ethics
- ITAF: The Standards Framework
- Standards vs. Guidelines vs. Tools
- Auditor Independence and Objectivity
- Audit Charter: Purpose and Contents
- Audit Testing: Compliance vs. Substantive
- Financial vs. Operational vs. Integrated Audits
- Forensic and Specialized Audits
- Risk-Based Audit Approach
- Inherent, Control, Detection, and Audit Risk
- Audit Universe and Annual Audit Plan
- Audit Objectives, Scope, and the Audit Program
- Types and Reliability of Audit Evidence
- Sampling: Statistical vs. Non-Statistical
- Sampling Terms: Confidence Level, Tolerable Error and Friends
- Interviews, Observation, and Walkthroughs
- CAATs and Data Analytics
- Continuous Auditing and Monitoring
- Preventive, Detective, Corrective Controls
- General vs. Application Controls
- Compensating Controls and Segregation of Duties
- Materiality and Evaluating Findings
- Audit Report Structure and Communication
- Follow-Up and Management Action Plans
- Control Self-Assessment (CSA)
- Audit Quality and Using Other Experts' Work
Interviews, Observation, and Walkthroughs
Learning how things really work
Before an auditor can test anything, they need to know how the process actually works: who does what, in which system, and where the checks are. Three techniques help: asking people, watching them, and following one real transaction from start to finish.
None of them, on its own, proves a control worked throughout the year. That needs sample testing or re-performance.
Interviews
Interviews are the main way to understand a process and hear about concerns. Good practice:
- plan the questions around the audit objectives
- talk to the people who actually do the work, not only their managers
- write down the answers and confirm your understanding back to them
- back up important answers with documents, system data or observation
Interview evidence is the weakest kind on its own, because it depends on the person’s knowledge and honesty. “We always check that” isn’t proof. Ask to see the evidence. Questionnaires and control checklists are a structured version of the same thing: efficient, but still just asking.
Observation
Observation means watching something happen: backup tapes being handed to the courier, visitors signing in at the data centre, an operator working at the console.
- It’s direct evidence the auditor got personally, so it’s reliable for the moment observed.
- It says nothing about other times, and people often behave better when they know they’re being watched.
Some controls are best tested this way. Segregation of duties often leaves no paper trail, so watching who actually does each task (and comparing it with their system access) is the usual approach. Observation also covers physical controls: fire suppression, locked screens, cabling, door access.
Walkthroughs
A walkthrough follows one real transaction from beginning to end, through the actual documents and systems, asking each person involved what they do.
A walkthrough:
- confirms the auditor’s understanding of the process
- shows where the controls are and whether they’re designed to deal with the risks
- confirms the controls have actually been put in place
It does not prove a control worked every time during the year. For that, the auditor tests a sample spread across the period, or re-performs the control.
Example. To understand purchasing, the auditor takes one purchase order and follows it from the request in the ERP, through the manager’s approval, goods receipt, the three-way match and payment. The walkthrough shows the three-way match is configured. A separate sample of 40 payments from across the year tests whether it actually worked all year.
How the exam asks about it
| If the question asks… | The answer is usually… |
|---|---|
| Purpose of a walkthrough | Confirm understanding of the process and the control design |
| Best way to test segregation of duties in operation | Observe the process and review actual system access |
| Value of interviewing the control owner | Understanding; needs corroboration |
| Weakness of observation | It only shows the moment observed |
| Evidence that a control worked all year | Sample testing across the period, not a walkthrough |
In short
- Interviews help the auditor understand a process, but answers must be backed up with other evidence.
- Observation is direct evidence that something happened at the moment it was watched, not at other times.
- A walkthrough follows one real transaction from start to end to confirm the auditor understands the process and its controls.
- Walkthroughs confirm design and implementation. They don't prove a control worked throughout the year.
- Questionnaires and checklists are efficient, but they're still just asking.
- Segregation of duties often leaves no paper trail, so observing who actually does each task is a key way to test it.
Exam traps
- Interviewing the system administrator isn't evidence that access controls work.
- People may behave differently when they know they're being watched.
- A walkthrough of one transaction doesn't test operating effectiveness over the year.
- Process documents from management show how things SHOULD work, not how they DO.
Slides
Click the slide and use the arrow keys. F toggles full screen.
Learning how things really work
Before an auditor can test anything, they need to know how the process actually works: who does what, using which system, and where the checks are.
Three techniques help: asking people, watching them, and following one real transaction from start to finish. Each proves something different.
Walkthroughs
A walkthrough follows one real transaction through every step, using the actual documents and systems, and asking the people involved what they do.