4.2 Tests of Controls vs. Substantive Procedures

Tests of Controls vs. Substantive Procedures

1. Auditor Responses to Assessed Risks (ISA 330 Framework)

Under ISA 330 (The Auditor's Responses to Assessed Risks), once the auditor has identified and assessed the risks of material misstatement (RMM) at both the financial statement level and assertion level under ISA 315, the auditor must design and implement overall responses and further audit procedures.

Further audit procedures are categorized into two primary types:

1. Tests of Controls (ToC)
2. Substantive Procedures

The overarching objective of ISA 330 is to obtain sufficient appropriate audit evidence regarding the assessed risks of material misstatement through designing and implementing appropriate audit responses. The auditor's assessment of risk drives the audit strategy: a combined approach (relying on controls and substantive testing) versus a substantive approach (relying primarily or exclusively on substantive tests).

---

2. Tests of Controls (ToC)

Definition and Purpose

Tests of controls are audit procedures designed to evaluate the operating effectiveness of internal controls in preventing, or detecting and correcting, material misstatements at the assertion level.

It is crucial to note that testing controls is not about detecting monetary errors directly; rather, it assesses whether the control mechanism functioned consistently throughout the period under audit.

When Tests of Controls are Mandatory / Required

The auditor is required to design and perform tests of controls when:

• The auditor's assessment of risks of material misstatement at the assertion level includes an expectation that controls are operating effectively (i.e., the auditor intends to rely on controls to reduce substantive testing).
• Substantive procedures alone cannot provide sufficient appropriate audit evidence at the assertion level (for instance, in highly automated electronic data interchange (EDI) environments where routine transactions are initiated and processed without manual paper trails).

Core Audit Methods for Testing Controls

Auditors test controls by applying a combination of four procedures:

• Inquiry: Asking relevant staff about control execution (insufficient on its own).
• Observation: Observing control activities (e.g., security access checks or segregation of duties).
• Inspection: Examining documentation for evidence of control performance (e.g., looking for authorization signatures or supervisor stamp on bank reconciliations).
• Reperformance: Re-executing the control procedure (e.g., reperforming a system matching routine).

Deviations vs. Misstatements

When testing controls, a failure of a control is termed a deviation or control exception. A control deviation indicates that the control did not operate as designed, but it does not necessarily mean a financial misstatement occurred. However, a high rate of control deviations forces the auditor to revise the control risk assessment upward and expand substantive testing.

---

3. Substantive Procedures

Definition and Purpose

Substantive procedures are audit procedures designed to detect material misstatements at the assertion level. They measure monetary accuracy and financial statement truthfulness directly.

Substantive procedures comprise two main components:

1. Tests of Details (ToD): Examining individual transactions, account balances, and disclosures (e.g., vouching sales invoices to dispatch notes, physically inspecting equipment, confirming receivables).
2. Substantive Analytical Procedures: Evaluating financial information by studying plausible relationships between financial and non-financial data (e.g., comparing annual payroll expense against employee headcount and average wage rates).

Mandatory Substantive Testing Requirement

Under ISA 330.18, regardless of the assessed risks of material misstatement or how effective internal controls are evaluated to be, the auditor shall design and perform substantive procedures for each material class of transactions, account balance, and disclosure.

This is a fundamental rule tested frequently by ICAB: controls can never completely eliminate substantive testing because internal controls have inherent limitations (such as management override, human error, or collusion).

Dual-Purpose Tests

In practical field work, auditors often perform a dual-purpose test—a procedure that operates simultaneously as a test of control and a test of details. For example, inspecting a sample of vendor invoices for supervisory approval signatures (test of control) while verifying the monetary amounts and expense classifications (substantive test of details).

---

4. Comprehensive Comparison: Tests of Controls vs. Substantive Procedures

---

5. Financial Statement Assertions Framework

Auditors use assertions to consider the different types of potential misstatements that may occur. Under ISA 315, assertions fall into two main categories:

Category 1: Assertions about Classes of Transactions and Events (P&L Items)

• Occurrence: Transactions and events that have been recorded have occurred and pertain to the entity (e.g., verifying recorded revenue represents real sales delivered).
• Completeness: All transactions and events that should have been recorded have been recorded (e.g., ensuring all unbilled shipments at year-end are recorded as sales/receivables).
• Accuracy: Amounts and other data relating to recorded transactions have been recorded appropriately (e.g., arithmetic multiplication on invoices is correct).
• Cut-off: Transactions and events have been recorded in the correct accounting period (e.g., checking sales dispatch dates around year-end).
• Classification: Transactions and events have been recorded in the proper accounts (e.g., repairs expense not capitalized as fixed assets).
• Presentation: Transactions are appropriately aggregated or disaggregated and clearly described.

Category 2: Assertions about Account Balances at Period-End (Balance Sheet Items)

• Existence: Assets, liabilities, and equity interests exist (e.g., physical verification of machinery).
• Rights and Obligations: The entity holds or controls the rights to assets, and liabilities are the obligations of the entity (e.g., verifying title deeds for land or loan contracts).
• Completeness: All assets, liabilities, and equity interests that should have been recorded have been recorded (e.g., identifying unrecorded trade payables).
• Accuracy, Valuation and Allocation: Assets, liabilities, and equity interests are included at appropriate amounts and any allocation/valuation adjustments are properly recorded (e.g., assessing allowance for doubtful debts or inventory NRV).
• Classification: Assets, liabilities, and equity interests have been recorded in proper accounts.
• Presentation: Items are appropriately aggregated or disaggregated and disclosures are relevant and understandable.