Dual-Purpose Test

What is a dual-purpose test?

On about one in three files we review, the team ran a dual-purpose test and documented a single conclusion: "no exceptions noted." That is not a dual-purpose test. That is one conclusion where two were required, and it will not survive an ISA 230.8 challenge on inspection. The efficiency gain of combining procedures is real, but the documentation requirement is the part teams consistently get wrong.

ISA 330 .A23 permits designing a single procedure that addresses both a test of controls and a substantive test of details. Consider a purchase invoice: you can inspect whether the invoice was approved by an authorised person (test of controls for the approval control) and at the same time vouch the invoice amount, date, supplier, and delivery reference to the purchase order and goods received note (test of details for occurrence and accuracy). One sample, two conclusions.

But efficiency creates a design risk. The sample size for a test of controls is determined by the tolerable deviation rate and the expected deviation rate under ISA 530 .A10. The sample size for a test of details is determined by the tolerable misstatement and the expected misstatement. These two calculations almost never produce the same number. ISA 330 .A23 requires you to use the larger of the two sample sizes. In practice, the substantive sample is usually larger because it must provide sufficient evidence to detect misstatements at the assertion level.

The WP must clearly separate the two evaluations. A dual-purpose test that only records "no exceptions found" without distinguishing whether the exception relates to the control element or the substantive element is undocumented under ISA 230.8 . Each objective gets its own conclusion.

Why it matters in practice

We have seen this on about half the engagements where the team attempts a dual-purpose test: they use the test of controls sample size, which is almost always smaller than the substantive requirement. ISA 330 .A23 requires the sample to be sufficient for both purposes. If the substantive calculation demands 40 items and the controls calculation demands 25, the sample is 40. Using 25 is not a minor shortcut. It means the substantive conclusion has no statistical basis.

WPs also frequently record a single conclusion for the dual-purpose test ("no exceptions noted") without separating the control evaluation from the substantive evaluation. When an exception relates to the control element but not the substantive element (or vice versa), the single-conclusion format obscures which objective is affected. ISA 230.8 requires documentation sufficient for an experienced auditor to understand the work performed and the conclusions reached. Nobody enjoys reworking a sample because the WP was ambiguous, but that is exactly what happens when a reviewer cannot tell which element failed.

Worked example: Galway Software Ltd

Client: Irish SaaS company, FY2024, revenue EUR 22M, IFRS reporter.

Galway licenses cloud-based project management software on annual subscription contracts. The engagement team designed a dual-purpose test over subscription revenue. Here is how the file was structured.

Identify the dual objectives

The control being tested: Galway's revenue manager reviews and approves each new subscription contract before it enters the billing system, verifying the contract terms match the price list and the revenue recognition schedule. The substantive objective: test the occurrence and accuracy of recorded subscription revenue by vouching recorded revenue entries back to signed contracts.

Determine the sample size

The test of controls requires a sample of 25 items (based on tolerable deviation rate of 5%, no expected deviations, 90% confidence level). The substantive test requires 40 items (based on a population of 1,840 subscription lines totalling EUR 22M, PM of EUR 330K). The team selected the larger: 40 items. This is the step where teams most often get it wrong by defaulting to the controls number (a PIOOMA approach that does not hold up on review).

Execute the test

For each of the 40 selected subscription lines, the team inspected: (a) the revenue manager's approval on the contract (test of controls element), and (b) the contract amount, billing period, start date, and revenue allocation schedule against the recorded revenue entry (substantive element).

Evaluate results separately

Control element: 39 of 40 contracts showed revenue manager approval. One contract (EUR 8,400 annual subscription, Client #IE-2219) showed approval by the sales director instead of the revenue manager. Deviation rate: 2.5% (1/40). Substantive element: all 40 revenue entries matched the underlying contract amounts, billing periods, and allocation schedules. Zero misstatements identified.

The dual-purpose test provided evidence on both objectives from a single sample. The control deviation (undocumented delegation) did not breach the tolerable deviation rate but generated a management letter point. The substantive results supported revenue occurrence and accuracy. Both conclusions are documented separately, which is defensible under ISA 330 .A23 and ISA 230.8 .

Key standard references

• ISA 330 .A23 permits designing a test of a control to simultaneously serve as a test of details (dual-purpose test). The auditor must consider each objective separately.
• ISA 530 .A10 covers factors affecting sample size. The dual-purpose sample must satisfy both the controls and substantive calculations.
• ISA 230.8 requires documentation sufficient for an experienced auditor to understand the nature, timing, extent, and results of procedures performed and the evidence obtained.
• ISA 330.7 requires that further audit procedures be responsive in nature, timing, extent, and focus to the assessed risks of material misstatement.

Related terms

Related reading

Frequently asked questions