Which of the following audit techniques is used to evaluate control design while also embodying auditing's analytical process?

A risk and control matrix (RCM) is a tool that systematically documents and analyzes the relationship between business objectives, risks, and control activities. It embodies the analytical process by requiring the auditor to identify specific risks and then map the corresponding controls designed to mitigate them. This structured format facilitates a direct evaluation of control design adequacy against identified risks, making it a core analytical tool in auditing. The matrix itself represents the output of the analytical process of linking risks to controls.

B. A flowchart is a visual representation of a process; it documents the flow but does not inherently contain the structured analytical risk-to-control linkage of an RCM.
C. A walk-through is a test procedure used to confirm the auditor's understanding of a process and its controls, not a documentation tool that embodies the analytical process itself.
D. A process narrative is a written description of a process. Like a flowchart, it serves as documentation rather than a structured analytical tool for evaluating control design against risks.

1. Anderson, U. L., Head, M. J., Ramamoorti, S., Riddle, C., & Salamasick, M. (2017). Internal Auditing: Assurance & Advisory Services (4th ed.). The Institute of Internal Auditors Research Foundation. In Chapter 7, "Performing the Engagement," the text describes the risk and control matrix as a tool that "provides a clear and concise way to document the linkage between risks and controls," which is fundamental to the analytical evaluation of control design.

2. The Institute of Internal Auditors (IIA). (2017). International Professional Practices Framework (IPPF). Standard 2210.A1 requires auditors to "identify and assess the risks relevant to the area under review." The RCM is a primary tool used to document this analytical assessment, linking identified risks to specific controls and evaluating their design.

3. Pickett, K. H. S. (2019). The Internal Auditing Handbook (4th ed.). Wiley. Chapter 15, "Documenting, Evaluating and Testing Internal Controls," explains that the RCM is used to "evaluate the design of the controls" by linking them to risks and control objectives, which is a fundamental analytical step in the audit process.