Search "internal controls documentation template" and the results split into audit exam explainers and one fill-in format, and all of them treat the narrative and the flow diagram as two documents to keep in sync by hand. One guide even states that a control appearing in the narrative should also appear on the flowchart, and vice versa, a task rather than something the file enforces on its own. A standalone control description can be complete, an ID, an assertion, a frequency, and still carry no step number to attach it to.
Castellan Filtration, Inc., an illustrative filtration equipment manufacturer with 28.4 million in fiscal 2026 revenue, numbers order to cash, procure to pay and close into 21 steps across three narratives. Sixteen controls attach to the steps that carry real risk, five, six and five per cycle. Each narrative closes with a flow diagram carrying the same codes on the same lines, so the two agree by construction, not by a later cross-check. PCAOB AS 2201 requires understanding how transactions are initiated, authorized, processed and recorded, and identifying where a misstatement could arise first.
Seven of the sixteen controls are key and get tested every year, seventy-four sample items sized from how often each one runs, and this year's testing found two exceptions. One invoice cleared the Procure to Pay match hold with no logged override, 18,400 dollars, a control deficiency. One vendor banking change skipped its callback, and the 61,300 dollars paid afterward is a significant deficiency, since that callback is the only control against a redirected payment. 15 U.S.C. 7262 is why severity matters: management assesses it every year, naming its framework under 17 CFR 229.308.
Internal Controls Documentation Template