Purchasing Process Walkthrough Documentation Template

WP Reference xxxx.xxx

Note to Participant: Below, find a template that will assist you in documenting the information provided
and the supporting screenshots you should obtain during the purchasing process walkthrough.

Note that the only client attendee for this walkthrough is Jamie Blake (Purchasing Department
Manager), and your Audit Senior (Kim) is the only other audit team member in attendance.

To completely document the walkthrough, note the walkthrough date, time, attendee details, and the
purpose/procedure at the top of this workpaper.

As the walkthrough occurs, results should be documented under the subheadings (e.g., Purchase Policy,
submitting a purchase request, etc.). Also, document screenshots of the Purchase Request Portal should
where applicable.

Record responses to our list of client questions in line with the questions (already represented in Part B
of this template) during that phase of the walkthrough.

Finally, based on the information gathered, note a conclusion for the walkthrough performed.

Date & Time Walkthrough Performed: 7/28/23 17:43

Client Attendees (including Role): Jamie Blake

Audit Team Attendees: Kim

Purpose/Procedure: Client Walkthrough

Results:

A) Walkthrough of Purchase Request Portal:

1) Purchase Policy
The Risk Management Department annually reviews the Purchase Policy for potential
amendments or additions. Reviews take place at the end of June. The updated policy is sent to
the CFO for approval. If approved, the IT Department is informed about any required updates to
the Purchase Request Portal. In the recent cycle, no updates were necessary.
Once formally approved, the current Purchase Policy is placed on the company-wide shared
drive accessible to all employees. Each year, employees must acknowledge receipt of the
updated policy and take a short quiz to ensure understanding of the internal process.
2) Submitting a Purchase Request
When needed, ABC Company employees may make purchases on the company's behalf as part
of their regular duties. Employees must consult the internal policy to find the applicable request
Purchasing Process Walkthrough Documentation Template
WP Reference xxxx.xxx
threshold for their position. According to the current Purchase Policy, the thresholds are $5,000
or more for Associates and Senior Associates, and $10,000 or more for Managers and above.
If the purchase amount exceeds the defined threshold, the employee must seek pre-approval by
using the Purchase Request Portal. They need to obtain documented approval from their direct
supervisor before proceeding with the purchase from the vendor.
3) Purchase Review/Approval Process
After logging into the portal with their assigned credentials, the supervisor will access the
'Reviewer View' from the Portal dashboard. They will then review the details entered by the
requestor for the purchase. Based on the information provided, the reviewer can choose to
either 'Approve' or 'Deny' the purchase request by clicking on the corresponding buttons and
then clicking 'Submit.'
4) Making a Purchase
As stated in the Purchase Policy, employees are required to seek pre-approval before making
purchases on behalf of ABC Company if the purchase exceeds the defined thresholds. It is the
responsibility of each employee to ensure that they do not proceed with any purchases without
obtaining documented approval as required by the internal policy. This helps maintain
compliance with the company's purchasing guidelines and ensures transparent and accountable
spending practices.
5) Archived Records
Employees can access the archived purchase review results within the Portal at any time. Upon
logging in and accessing the Portal dashboard, employees can view their reviewed purchase
requests through the "Archived Records" view.
The Portal archives both approved and denied purchase requests, arranging them in
chronological order based on the date of the purchase request. This allows employees to easily
review the history of their past purchase requests and the corresponding review outcomes.
6) Table of Employee Supervisors (Org Chart within Portal)

B) Open Questions Follow-Up:

1) Process & Control Changes (Which Have Occurred Since Prior Year Audit Period):
● Please confirm whether the process to review and update the Purchase Policy is the same as in
the prior audit period. : Confirmed: The process to review and update the Purchase Policy
remains the same as in the prior audit period.
● What are the changes to Purchase Request Portal during the audit period (i.e., planned
maintenance, as a result of the most recent Purchasing Policy update cycle, etc.)? : Changes to
Purchase Request Portal: No major changes were made during the audit period since its initial
implementation.
● Have there been any changes to key personnel (as they relate to the purchasing process and
controls during the audit period)? : Changes to key personnel: There were no significant
personnel changes related to the purchasing process during the current audit period. The HR
Department notifies the IT Team promptly about new hires and departures, and the IT
Department updates the Purchase Request Portal's Table of Employee Supervisors accordingly.
For further details, please check with the HR and IT Departments.
2) Purchase Request Portal:
a) Portal Issue Reporting:
Purchasing Process Walkthrough Documentation Template
WP Reference xxxx.xxx
● How are issues with the Portal typically identified/reported? : Issue identification/reporting:
End-users of the Portal can directly escalate issues to the IT Department.
● Who are issues reported to? : Reporting recipients: Issues are reported to the IT
Department.
● How do stakeholders know where to report issues? : Stakeholder reporting instructions:
Stakeholders are informed of the reporting process through postings on various internal
sites, providing a direct line for issue reporting to the IT Department.
● What is done after an issue is reported? : After reporting: The IT Department is responsible
for addressing and handling reported issues. Further details can be obtained from them.
● How often is the Purchase Request Portal tested? : Frequency of Portal testing: The IT
Department, along with the Internal Audit team, is better suited to answer this question.
● Who performs those tests?
● What were the results of the last test(s) performed? : Testing performers and results: The IT
Department, along with the Internal Audit team, can provide information regarding who
performs the tests and the results of the last test(s) conducted.

b) Purchase Approval Assignments (System Maintenance):

● How is the organizational chart within the Portal updated for each promotion cycle?
● Who is assigned responsibility to make those updates?
● When are they performed? : Please refer to the information provided earlier in this
walkthrough for the timing of Portal testing.
● What documentation exists to verify that the control was performed in a complete and
timely manner? : For details on the documentation that exists to verify the completion and
timeliness of the control, please follow up with the IT Department to understand their
specific process. They would be able to provide more insight into the documentation
procedures related to the Purchase Request Portal.

3) Approved Vendor Listing:

● Does ABC Company employ an Approved Vendor Listing (to ensure employee purchases are only
made to approved vendors)? : No, however, vendors are reviewed as part of the purchase
review/approval process.
● How does ABC Company ensure that the purchases are made to third-party (unrelated)
vendors? : see above

4) Prior-Year Exception(s) Follow-up:

● Last year, an issue was identified in some purchase approval documentation not being able
to be retrieved/provided for audit support purposes (Noted that these exceptions occurred
before the Purchase Request Portal was phased in). : As stated during the walkthrough, all
historical purchases/denials are retained by the Purchase Request Portal. The prior year
exception was noted in our process before the Portal “went live” during that audit period.

Please explain the Purchasing Portal process to retain/archive the electronically provided
approvals, including:
o How long is the approval archived within the system? : Perpetually (all records of
purchase approval/denial will be retained).
o In what instances (if any) can data be retroactively altered (i.e., to pre-date
approvals)? : Portal locks requests and results of review from alteration as soon as
o reviewer submits response. No archived records can be adjusted.
Purchasing Process Walkthrough Documentation Template
WP Reference xxxx.xxx
o What are the controls surrounding access for the documented approvals? : The
“Archived Records” view within the portal allows for an employee to see all of their
own purchase requests. For assigned reviewers, personnel can also access any
purchase for which they reviewed and approved/denied.

5) Approval Timing:
● What controls exist to ensure an employee does not externally submit a purchase to a vendor
without the prerequisite, documented approval of such purchase?

6) Disclosure of Issues Which Occurred During the Audit Period:

● Have there been any issues of control gaps (i.e., points in the purchasing process in which an
appropriate control did not adequately cover risks)?
● Have there been any issues in control functionality (i.e., controls did not function as designed
and therefore did not identify issues for which the control was designed to detect/prevent)?
● Has your team identified any purchases submitted to the vendor before obtaining the required
approvals (per the Purchasing Policy)?

7) Internal Reviews (of Purchasing Process & Controls) Performed During Audit Period:
● Have there been any internal reviews (i.e., client’s internal audit team reviewed
process/controls, finance team reviewed process/controls, etc.) which cover the current audit
period?
● How often are the purchasing process controls reviewed/tested/updated?
● When did the last updates to these controls occur?
● When did the last internal tests of these controls occur (please provide supporting
documentation)?
● Have any instances of control gaps or failures (i.e., where a control failed to identify an issue or
inaccuracy in the purchasing process or where a control area was identified for enhancement)?

8) Initial (Drafted) Exceptions Noted as a Result of Current Year Fieldwork Performed:

● Purchase approval obtained from an employee other than the requestor’s direct supervisor
● Purchase was made with vendor before required pre-approval was obtained

Conclusion: