Common Control Weaknesses (and How to Prepare for Audit Walkthroughs)

If you’ve been through a few audits, you’ve probably noticed something reassuring—and a little frustrating:

The same control issues show up again and again.

That’s not because people don’t care.

It’s usually because controls exist informally, documentation is thin, or expectations aren’t clear—especially in small governments.

This post covers:

• The most common control weaknesses auditors see

• Why they happen

• How to prepare for audit walkthroughs so those weaknesses don’t turn into findings

Whether you’re on the government side or the audit side, this is where small changes can make a big difference.

Common Control Weakness #1: Lack of Review Evidence

What auditors see:

• Bank reconciliations prepared but not reviewed

• Reports generated but no indication anyone looked at them

• Verbal reviews with no documentation

Why it happens:
In small offices, review happens—but it isn’t written down.

How to strengthen it:

• Add initials and dates to reconciliations and reports

• Include short notes for unusual items

• Keep review evidence consistent, even if it’s simple

If a control isn’t documented, it’s very hard for auditors to rely on it.

Common Control Weakness #2: Too Much Responsibility in One Role

What auditors see:

• One person handling receipts, disbursements, payroll, and reconciliations

• No compensating controls documented

Why it happens:
Staffing constraints—not poor design.

How to strengthen it:

• Implement management or board review of key reports

• Require approval for payments or payroll changes

• Document compensating controls clearly

Auditors understand limited staffing—but they still need to see how risk is mitigated.

Common Control Weakness #3: Inconsistent or Outdated Procedures

What auditors see:

• Procedures that don’t match what’s actually happening

• Controls that worked years ago but no longer fit current systems

• Staff following habits instead of written guidance

Why it happens:
Processes evolve, documentation doesn’t.

How to strengthen it:

• Update procedures annually or when systems change

• Keep documentation short and realistic

• Align written procedures with actual practice

Common Control Weakness #4: Informal Approval Processes

What auditors see:

• Approvals happening verbally

• No clear thresholds for when approval is required

• Inconsistent authorization across transactions

Why it happens:
Trust replaces structure over time.

How to strengthen it:

• Define approval thresholds clearly

• Document approvals through signatures, emails, or system logs

• Apply approval requirements consistently

Consistency matters more than complexity.

Common Control Weakness #5: Limited Understanding of Internal Controls

What auditors see:

• Staff unsure why controls exist

• Confusion during walkthroughs

• Incomplete or inconsistent explanations

Why it happens:
Internal controls aren’t explained—they’re just expected.

How to strengthen it:

• Walk through processes internally before the audit

• Make sure staff understand their role in controls

• Document processes in plain language

What Is an Audit Walkthrough, Really?

An audit walkthrough isn’t a test.
It’s a conversation.

Auditors are trying to understand:

• How a transaction flows from start to finish

• Who performs each step

• Where controls occur

• How errors would be detected

If staff aren’t prepared, even strong controls can look weak.

How to Prepare for Audit Walkthroughs

1. Walk Through Your Own Processes First

Before the audit:

• Pick a transaction (payroll, cash receipt, invoice)

• Trace it step by step

• Identify who does what and when

If it’s confusing internally, it will be confusing to auditors.

2. Align Documentation with Practice

Make sure:

• Written procedures reflect reality

• Controls described actually exist

• Review evidence can be shown

Don’t explain a control you can’t demonstrate.

3. Decide Who Should Answer Which Questions

Not everyone needs to answer everything.

Designate:

• One person to explain the process

• Another to show documentation

• A reviewer to explain oversight

This keeps walkthroughs efficient and accurate.

4. Be Honest About Limitations

Auditors don’t expect perfection.

It’s better to say:

“We’re small, so this role handles multiple steps, but here’s how we mitigate the risk.”

Than to overstate segregation that doesn’t exist.

For CPAs: How to Help Clients Improve Walkthroughs

If you audit small governments:

• Explain walkthrough expectations early

• Share examples of strong documentation

• Focus on improving clarity—not catching mistakes

• Help clients align controls with staffing reality

Better walkthroughs lead to fewer findings and smoother audits.

Most Findings Start with Small Gaps

Control weaknesses aren’t usually about big failures.

They’re about:

• Missed documentation

• Unclear roles

• Informal processes

• Inconsistent review

Addressing these before audit season:

• Strengthens controls

• Reduces findings

• Improves confidence

• Saves time on both sides

Strong audits don’t come from perfect systems.

They come from clear processes, honest communication, and consistent documentation.

And that’s something every small government can achieve.