Pick one real exception and trace it end to end: the request, the approval, the scanner or gate update, the expiry, and the closure. Name the person and the system at each step and have the evidence ready to show. A walkthrough tests whether the process you wrote is the process you run.
Auditors commonly use a walkthrough to understand a control before they test it. The questions are practical: who, when, where is the record, and what happens next.
What a walkthrough usually covers
Expect to explain the flow in the order it happens. Auditors may ask for inquiry (talk through it), inspection (show a record), and observation (watch a step). Prepare for all three.
Build your trace
Choose an exception that was approved, renewed or expired, and closed during the period. A complete lifecycle is more useful than one still open. Then collect:
| Step | Who | System | Evidence |
|---|---|---|---|
| Request | Engineer | Ticket tracker | Ticket with the five fields |
| Review | Approver | Same ticket | Comment and timestamp |
| Approval | Named approver | Same ticket | Status change, ID of approver |
| Enforcement | Gate or scanner | Policy tool | Rule showing expiry date |
| Expiry or renewal | Owner | Ticket | Reminder, renewal or fix commit |
| Closure | Owner | Ticket and scanner | Finding closed, rule removed |
Rehearse out loud
Walk a colleague through it in 10 minutes. Ask them to interrupt wherever they would ask "how do you know?". Those moments are your gaps.
Know the weak spots
Be ready for these questions and answer them with facts.
- What stops someone from applying a suppression without a ticket?
- How do you know the list is complete?
- Who covers when the approver is away?
- What happens on the expiry date, automatically or manually?
- How do you handle an emergency?
If the honest answer is "nothing stops it", say so and describe what you plan to change. Auditors respond better to a known gap with a plan than to a confident answer that falls apart under a follow-up.
Bring the written process
The document should match what you demonstrate. If the policy says expiry is enforced automatically and your walkthrough shows a manual reminder, one of them must change before the audit, not during it.
Where Safeguard fits
Safeguard policies and gates can enforce an exception's expiry, and its compliance and evidence automation can collect the records for each step of the trace.
Try it yourself
Click through it at your own pace, or open it full screen. Open the gate demo and find where a policy decision is shown, since that is the enforcement step you will be asked to demonstrate.
Quick check
How long should a walkthrough take?
Plan on 30 to 60 minutes for one control. A tight, rehearsed trace takes less.
Should I choose an easy example?
Choose a representative one. A lifecycle with a renewal or an expiry shows more of the control than a trivial one.
Last reviewed: 19 October 2026.
