Documenting an Expense Control Walkthrough

A walkthrough follows a single transaction through the actual process to understand how a control is designed and where evidence is created. It is not, by itself, proof that a control operated consistently for a full period. This procedure is for an internal finance or process reviewer mapping an employee expense from submission to accounting or payment. The GAO 2025 Green Book defines federal internal-control standards; its Section 2 says nonfederal entities may use the framework. Private organizations may adapt its approach, but it is not a mandate for all employers.

Choose a transaction and establish the scope

Select one transaction that can be traced end to end and state why it is useful: for example, a standard reimbursable meal, a card purchase, or an approved exception. Record the period, process boundary, systems and teams involved, and the question being answered. Avoid combining different transaction types into one story if their approval paths differ. Ask the submitter or processor to show the original evidence and describe each step while you observe; distinguish observed actions from later explanations. The Green Book Section 2 describes internal control as applying to operations, reporting, and compliance objectives and says management should fit the system to the entity's circumstances.

Trace the transaction from origin through submission, policy review, approval, payment or card settlement, accounting entry, and reconciliation as applicable. At each handoff, note the role, action, timing, information used, evidence created, and next recipient. Capture the policy version. Ask what happens when a receipt is absent, coding disputed, approver unavailable, or payment differs. Record the described exception path; do not imply an exception was observed if it was not.

Compare the described process with evidence

Inspect records that support the selected transaction: the submitted report, relevant receipt, approval record, payment or card record, posting, and reconciliation evidence if those steps fall in scope. Match identifiers, date, amount, purpose, coding, and decision across records. Note missing or conflicting evidence precisely, and ask the process owner to explain it without silently treating the explanation as proof. Principle 12.02 of the Green Book says policies describe expectations while procedures identify actions, and Principle 12.03 connects process responsibilities and related risks to documented control design. Use these as documentation prompts, not a claim that a private organization must follow a federal template.

Worked example: a corporate card purchase

A reviewer traces a $240 software-related card transaction. The card record establishes merchant, date, and amount; the employee's expense report identifies a project purpose and attaches the receipt; a manager's approval appears two days later; and the ledger shows the same total under a software expense account. The walkthrough notes that the records agree, but also that the reviewed procedure does not specify who resolves a missing receipt before reconciliation. The reviewer confirms that this gap is in the written procedure, not an event in the selected transaction, and recommends naming an owner and documenting a pending-item route. The conclusion is limited to understanding this transaction and control design.

Record findings, limits, and follow-up

Write a reproducible sequence: scope and transaction identifier, participants and date, observed steps, evidence inspected, control owner, decision points, exceptions discussed, and open questions. Separate observation from what someone told you. Distinguish a design gap, missing evidence, or observed deviation; one successful example does not establish effectiveness. Assign an owner and due date for corrections and preserve closure evidence. Green Book Principle 12.04 includes corrective follow-up in procedures; Principle 16 distinguishes ongoing monitoring from periodic evaluations. A walkthrough may inform either but does not replace broader testing when needed.

• State objective, scope, transaction type, and process boundary.
• Trace each handoff and retain the underlying evidence inspected.
• Separate observation, explanation, design gap, and operating deviation.
• Limit conclusions to what the walkthrough supports; assign and verify corrective actions.