Sharpe CPA / For CPAs / Internal control documentation
Type the steps of a cycle — who does what, with which document, in which system, and which control sits there — and the page draws the swimlane flowchart, writes the narrative, builds the risk and control matrix and flags the people whose duties conflict. Start from a template for the standard cycles or for fuel distributors, contractors, nonprofits and clubs, and governments. No drawing program, nothing to install.
One record, four formats
Visio flowcharts go stale because the drawing and the matrix are kept separately. Here a control is entered once, shown at its step on the flowchart, described in the narrative and listed on the matrix, so the four never disagree.
Swimlanes top to bottom, one column per person or department. Decisions branch; numbered circles mark the controls.
Written from the steps in order, with documents, systems and controls named. Add your own notes at the end.
What could go wrong, the assertion, the control, owner, type, frequency, key and evidence. Download as CSV.
Who authorizes, records, holds and reconciles. Conflicts are flagged so you can look for the compensating review.
The tool
Rename the lanes and roles to the client’s people, change the steps to what you saw on the walkthrough, and mark the controls you observed. Your cycles are kept in this browser only; nothing is sent anywhere. Save a copy (JSON) to put it in the workpapers or to open it on another computer.
Sharpe CPA portal subscribers keep the same documentation with each walkthrough in the audit plan, and copy the controls into the walkthrough with one click.
What the standards ask
| Requirement | Where it comes from | What the tool gives you |
|---|---|---|
| The information system and communication | AU-C 315.25: how transactions are initiated, recorded, processed, corrected and reported, and the records and IT involved | Flowchart and narrative, with documents and systems at each step |
| Controls that address risks | AU-C 315.26–.27: controls over significant risks, journal entries, and those the auditor plans to test | Risk and control matrix; key controls marked |
| Design and implementation | AU-C 315.26d and .30: evaluated beyond inquiry, by observation, inspection or tracing a transaction | The walkthrough confirms the steps; record what you saw in the evidence column |
| Deficiencies | AU-C 315.31 and AU-C 265: grade them; significant deficiencies and material weaknesses go to governance in writing within 60 days of release | Risks with no control and conflicting duties are flagged |
| Tests of controls | AU-C 330.08–.17: only for controls relied on; otherwise control risk at the maximum | Key controls and their evidence become the test plan |
| Reviews | AR-C 90: no evaluation of internal control is required | The narrative is still a quick way to record the accounting practices (AR-C 90.15–.16) |
Paragraph numbers are from AU-C 315 as amended by SAS No. 145. Federal award recipients must also maintain effective internal control over compliance (2 CFR 200.303), and the single auditor reports on it (2 CFR 200.514(c)).
Sources
The standards control. Templates, risks, controls and duties on this page are the firm’s own and are illustrative.