How auditors decide whether evidence should come from control testing, substantive testing, or both.
Audit evidence is not gathered by performing every possible procedure. The auditor designs a response to assessed risks, then chooses the mix of tests of controls and substantive procedures that will provide sufficient appropriate evidence for each relevant assertion.
The AUD exam often tests this decision as a planning and evidence question. If the auditor plans to rely on controls, the controls must be tested. If controls are ineffective, not relevant, or not tested, the auditor usually increases substantive procedures. Even when controls are strong, substantive procedures are still required for material classes of transactions, account balances, and disclosures.
flowchart TD
A["Assess risk of material misstatement"] --> B{"Plan to rely on controls?"}
B -- "No" --> C["Design primarily substantive procedures"]
B -- "Yes" --> D["Test design and operating effectiveness"]
D --> E{"Controls effective?"}
E -- "Yes" --> F["Use reliance strategy and adjust substantive extent"]
E -- "No" --> G["Revise risk assessment and expand substantive work"]
C --> H["Evaluate whether evidence is sufficient"]
F --> H
G --> H
Tests of controls evaluate whether a control is designed and operating effectively. Substantive procedures look directly for material misstatements in amounts, transactions, or disclosures.
| Procedure type | Primary question | Examples | Evidence focus |
|---|---|---|---|
| Test of controls | Did the control operate effectively? | Inspect approval evidence, observe segregation of duties, reperform a reconciliation | Control design and operation |
| Test of details | Is this transaction, balance, or disclosure misstated? | Confirm receivables, inspect invoices, recalculate depreciation | Direct evidence about amounts and assertions |
| Substantive analytical procedure | Does a recorded amount make sense compared with an expectation? | Compare gross margin, payroll per employee, or interest expense to independent expectations | Plausibility of recorded amounts |
A control test may support lower control risk. A substantive procedure supports the auditor’s conclusion about whether the financial statements are materially misstated. The two categories can work together, but they answer different questions.
An auditor tests controls when the audit strategy depends on control reliance or when standards require control testing. In an integrated audit of an issuer, the auditor must test internal control over financial reporting because the engagement includes an opinion on ICFR. In a financial statement audit of a nonissuer, the auditor may choose to test controls if reliance is efficient and appropriate.
Controls testing is more likely when:
Testing controls does not mean the auditor can ignore substantive work. It means the auditor may reduce the extent, change the timing, or adjust the nature of substantive procedures if the control evidence supports the planned reliance.
Substantive procedures become the main response when controls are weak, informal, not relevant, not tested, or not operating effectively. They are also central for high-risk estimates, unusual transactions, significant nonroutine entries, and areas where management bias may affect recognition or valuation.
Common reasons to emphasize substantive procedures include:
| Condition | Audit consequence |
|---|---|
| Controls are poorly designed | Do not rely on them; obtain direct evidence from transactions and balances |
| Controls fail operating-effectiveness testing | Revise control risk upward and expand substantive procedures |
| Entity is small and controls are informal | Use substantive work unless controls can still be evaluated and tested reliably |
| Significant fraud risk exists | Add targeted substantive procedures and unpredictable elements |
| Year-end balance is highly judgmental | Test assumptions, source data, and management’s estimate directly |
Substantive procedures include both tests of details and substantive analytical procedures. Tests of details are usually stronger for existence, rights, occurrence, accuracy, and valuation. Substantive analytical procedures are stronger when the auditor can build a precise expectation from reliable independent data.
The auditor does not choose between controls and substantive procedures once for the whole audit. The mix changes by assertion and account.
| Assertion or risk | Likely evidence mix |
|---|---|
| Revenue occurrence with strong automated approval controls | Test relevant controls, then perform targeted substantive procedures near cutoff and unusual entries |
| Inventory existence in a warehouse with weak count controls | Observe physical inventory and perform expanded substantive count procedures |
| Payroll completeness in a stable system with strong HR controls | Test access and change controls, then perform analytical and selected detail procedures |
| Complex fair value estimate | Use substantive procedures over assumptions, models, source data, and specialist evidence |
| Cash existence | Confirmation and bank reconciliation testing remain important even if controls are strong |
The stronger exam answer usually links the procedure to the assessed risk. A generic statement such as “perform more audit work” is weaker than “increase substantive testing of year-end manual revenue entries because cutoff and occurrence risk are elevated.”
The audit file should show why the evidence mix was appropriate. The auditor documents the assessed risks, controls selected for testing, the nature and extent of testing, results, and any changes to planned substantive procedures.
If control testing identifies deviations, the auditor considers:
Testing is iterative. Evidence obtained during fieldwork can change the plan.
Do not choose an answer that says strong controls eliminate substantive procedures. Some substantive procedures are required for material areas.
Do not choose an answer that says inquiry alone is enough to test operating effectiveness. Inquiry can support understanding, but control testing usually needs inspection, observation, reperformance, or system-generated evidence.
Do not assume a reliance strategy is always more efficient. If controls are weak, difficult to test, or unrelated to the assertion, substantive procedures may be the better response.