Which of the following is a common method for documenting systems and internal controls?

• A. Narrative.
• B. Flowchart.
• C. Data flow diagram.
• D. Control matrix.

Answer: (A)

Documenting how a system operates and where controls exist is best explained through a written, step-by-step description of the process. A narrative lays out each activity in order, who performs it, which systems are involved, what controls apply, and how exceptions are handled. This format is flexible, easy to update as processes change, and readable by both management and auditors, making it a practical foundation for capturing how controls are actually applied in practice. It also allows you to tie each step to control objectives and testing considerations in a single document.

Other methods have their uses: flowcharts provide a visual map of the steps, data flow diagrams focus on how information moves through IT systems, and a control matrix links controls to objectives in a table. But as a general, widely-used documentation approach, the narrative is the most straightforward way to convey the full process and its controls in one coherent description.