Process Narratives, Risk and Control Matrices, and Process Flow Charts


  • There are 40 to 50 people involved in the process from across the retail company.
  • The company has approximately 120 to 150 key controls—including those on the entity-level side that can include the higher level COSO Framework controls. In addition, there are 25 process owners located across several departments of the organization.
  • A small internal controls department previously used Word® and Excel® to accumulate process documentation and risk and control matrices. When updates were made, the department used a review process to make sure others involved in the process agreed.
  • To update documentation, process owners received a notification to review and made changes as necessary. They submitted changes back to internal audit, and internal audit edited as requested. Internal audit also made changes to the risk and control matrices.
  • The biggest challenge for the internal audit team was ensuring updates were reflected appropriately in all locations.
  • The company's SEC reporting team was looking for a solution to increase efficiency at the same time the internal audit team was also looking for an audit software solution. After a personalized Wdesk demo, it was easy to get executive buy-in for both departments.

Why Wdesk works for the SOX team

  • Because the SEC reporting team at the company decided to use Wdesk, it made sense for the internal audit team to implement it as well to provide a consistent solution for all involved in the reporting processes.
  • Wdesk provides significant efficiencies for both teams through linking—allowing the team to make a change in one place and see it flow through to all the impacted documents. The internal controls team has reduced its administrative workload.
  • The internal audit team uses Wdesk for process narratives, risk and control matrices, and some process flowcharts—using the process narratives as source data. The company anticipates putting its testing and COSO Framework documents as well as certifications in Wdesk in the near future.
  • Workiva worked with the team to load all risk and control matrices and process documentation in Wdesk and leverages an intern in its department to continue modifications to documentation and linking as the process evolves.


  • The biggest benefit the team has seen from implementing Wdesk is the efficiency gained and time saved from linking documents and data together. The team plans to explore how it can expand the benefits of Wdesk for audit committee presentations, testing, and certifications.
  • With the help of Wdesk, the team has been able to improve the accuracy and consistency of its documentation by linking information together—allowing changes to be made in a single location that automatically updates all linked instances.
  • Although the internal audit team is responsible for testing, it plans to get its internal controls specialist involved in the process and to utilize Wdesk.
  • The company plans to incorporate process owners, allowing them to make changes directly to the documentation. The process owners will be responsible for keeping all the documentation updated, which will free up the internal audit team.
  • Though still in the process of implementing Wdesk, the company anticipates that the time savings gained from Wdesk will allow it to do more operational audits and focus on other areas of the business.

Word and Excel are registered trademarks of Microsoft Corporation in the United States and/or other countries.

Read More