The Rebirth of the Internal Control Flowchart
In 1966, a book was published by two Canadian Chartered Accountants, Skinner and Anderson, entitled Analytical Auditing. The subtitle of the book was “An Outline of the Flow Chart Approach to Audits." The book was, as far as I know, the first guidance for performing risk-based audits.
In Chapter three, the authors begin discussing the need for standardization of flowcharting with this statement: “A systems-oriented audit plan must include some method of recording systems information accurately and comprehensively.” Narrative forms, the authors continue, quickly become cumbersome and unwieldy. Large quantities of information on narrative forms (memos and questionnaires) are difficult to absorb, integrate and change annually they said. Here is the authors’ suggested solution:
“To these problems a standardized method of flowcharting is the logical solution. First, this is the most concise way of recording the auditor’s review of the system. The flowchart minimizes the amount of narrative explanation and thereby achieves a condensation of presentation not possible in any other form. It gives both a bird’s-eye view of the system and an efficient documentation of the auditor’s testing of it. Secondly, the flow chart is the most efficient tool for doing the actual analyzing. The flow charts clearly show what is taking place and provide an easy method of spotting weaknesses in the system or areas where improvements can be introduced.”
The standardized internal control flowchart and internal control questionnaires were principal methods of documentation by auditors for at least two decades after this book was published. In the mid-1980s, auditing standards were published that permitted auditors to default to high control risk and perform audits using primarily analytical procedures and detailed test of balances. While an auditor was required to understand the business and industry of a reporting entity, there was no requirement to understand, test or rely upon the entity’s internal control system. As a result, very little documentation of internal control was prepared by auditors.
Until 2007, many auditors continued using an audit strategy that ignored internal control. When the risk assessment standards of 2006 became effective, we learned we could no longer default to high control risk without identifying the control deficiencies that precipitated the high risk. To comply with the new auditing standards, firms began to complete internal control questionnaires and memo documentation. In many firms, however, the practice of defaulting to high control risk has continued, even when the reporting entity designed and operated an effective internal control system.
The truth is that there are benefits from using standardized flowcharts today that are similar to, or even greater than, those discussed by Skinner and Anderson in the 1960s.
Here are a few:
• Flowcharts can now be created electronically using Word or Excel draw symbols or special software such as Visio. Using standard templates for transactions cycles can simplify and facilitate the preparation process.
• Asking client personnel to describe the flow of transactions from inception to termination can provide descriptions of client data, documents and procedures for each transaction cycle.
• Using an internal control questionnaire for reference while interviewing client personnel can guide the internal control documentation process.
• The flowcharts can guide systems walk-through procedures designed to support information obtained from client interviews and to provide substantive evidence.
• The flowcharts can be easily analyzed to identify control deficiencies to begin the risk assessment process. Offsetting controls can also be identified and tested to reduce control risk, even on small audits!
• Flowcharts can be replicated for easy updating and for training inexperienced staff personnel in future years.
An internal control flowchart is the most effective and efficient way of complying with SAS No. 109, Understanding the Entity and Its Environment, including Internal Control. Our profession is experiencing a “rebirth” of the use of flowcharts and the related systems walk-through procedures as the most popular methods of internal control documentation.
I have prepared a Flowcharting Guide and Illustrative Flowcharts for basic transactions cycles and related accounts, specifically designed for small to medium-size audits. If you’d like a free copy, please access the “Contact Us” tab on my website, www.cpafirmsupport.com, to make your request.