A warehouse application can omit a shipment even when every recorded invoice adds correctly and the general ledger balances. The auditor must identify where financial reporting information originates, changes, crosses systems, and reaches the statements.
A business process is a connected sequence of activities that produces an operational or financial reporting result. Its audit significance depends on potential financial statement misstatement, including transaction volume, complexity, judgment, unusual activity, and susceptibility to error or fraud.
The auditor should identify significant accounts and disclosures, then connect them with the processes and data sources that support reporting. Large recurring transaction streams and small populations of unusual transactions can both require focused audit attention.
A data flow describes how information moves between people, documents, applications, and reporting outputs, including transformations along the way. Applications may indirectly affect financial statements even when they never create an accounting entry themselves.
The process record should identify these connections:
- Initiation: the economic event, originating employee, source document, and first application receiving the data.
- Processing: calculations, approvals, master data, transaction status changes, and transfers between systems.
Common mistakes
- Stopping at invoicing. Order 418 remains incompletely documented until its ledger classification and medical-instruments disclosure category are traced.
- Ignoring rejected records. Reviewing only 119 accepted transfers excludes the $6,000 exception from the very population intended to detect missing sales.
- Overreading a signature. The signed C5 comparison establishes performance of a review whose $5,000 criterion still misses the concealed credit.
Bottom line
- Significant processes include originating operational data, corrections, ledger postings, consolidation, and relevant disclosures.
- Walkthrough documentation links actual transactions with documents, applications, responsible roles, interfaces, controls, and inspected evidence.
- Application functionality, hosting arrangements, access responsibilities, and interface dependencies require separate understanding.
- Design effectiveness, implementation, and operating effectiveness are distinct conclusions supported by different evidence objectives.
Exam shortcut
Start with the threatened assertion, then locate the transaction stage where the error can arise. Match the proposed control to that exact failure. Circle the evidence verb: “described” suggests inquiry, “inspected” suggests documentary corroboration, and “observed” establishes what happened when watched. Judge the evidence's substance before selecting a conclusion. For reconciliations, check population independence before doing arithmetic. Matching two incomplete reports produces a tidy but uninformative difference.
The full lesson (about 5,474 words, 36 min read) adds 2 worked examples, all 6 common mistakes, a self-check, free in the app.
Learning objectives
- II.C3
Browse all free CPA AUD lessons or jump into free CPA AUD practice questions.