What are substantive procedures?
ISA 330.4(a) defines substantive procedures as procedures designed to detect material misstatements at the assertion level. ISA 330.18 makes them mandatory: irrespective of the assessed risks of material misstatement, the auditor must design and perform substantive procedures for each material class of transactions and each material account balance, including related disclosures. This requirement applies even when the auditor has tested controls and found them effective. Controls reduce the extent of substantive testing needed. They do not eliminate the requirement.
The two sub-types serve different purposes. Tests of details examine individual transactions, balances, or disclosures directly. Vouching a sample of purchase invoices to supporting documentation is a test of details. Substantive analytical procedures compare recorded amounts to independently developed expectations and investigate significant differences. An expectation model for payroll expense (headcount × average salary × months) that identifies a €400K unexplained variance is a substantive analytical procedure.
ISA 330.21 adds a further requirement for significant risks. Where a risk is assessed as significant under ISA 315 (Revised), substantive procedures must be specifically responsive to that risk. ISA 330.A52 notes that tests of details are ordinarily more responsive to significant risks than analytical procedures alone.
Key Points
- ISA 330.18 requires substantive procedures for every material balance and class of transactions, regardless of the assessed risk or control effectiveness.
- The two types are tests of details (testing individual items) and substantive analytical procedures (testing relationships and expectations).
- You cannot audit a material balance using only tests of controls. Substantive procedures are always required.
- For significant risks, ISA 330.21 requires substantive procedures that are specifically responsive to those risks.
Why it matters in practice
Worked example: Meridian Software Ltd
Client: Irish SaaS company, FY2024, revenue €28M, IFRS reporter. Revenue is recognised under IFRS 15 across approximately 1,800 SaaS subscription contracts. Revenue recognition is assessed as a significant risk (fraud presumption under ISA 240.26 plus complexity of multi-element arrangements).
Determine the nature of substantive procedures needed: Because revenue is a significant risk, ISA 330.21 requires substantive procedures specifically responsive to that risk. The team designs a combination: a test of details on a sample of contracts and a substantive analytical procedure on monthly recurring revenue.
Test of details (contract sample): The team selects 55 contracts using stratified MUS (8 enterprise contracts tested in full, 47 sampled from the remaining population). For each contract, the team agrees the contract terms to the signed agreement, recalculates the revenue allocation across performance obligations under IFRS 15.73–15.77, verifies the timing of revenue recognition against delivery evidence, and traces cash receipts to bank statements.
Substantive analytical procedure (MRR analysis): The team builds an independent expectation of monthly revenue by multiplying active subscriber count (from the billing system) by the average monthly fee per tier. The expectation produces €27.4M; recorded revenue is €28M. The €600K difference (2.1%) exceeds the investigation threshold of €280K. The team investigates and identifies €520K attributable to mid-year price increases. After adjustment, the residual unexplained difference is €80K, below the threshold.
The combination of a test of details (addressing existence, accuracy, cutoff, and valuation) and a substantive analytical procedure (addressing completeness) provides sufficient appropriate evidence. Relying on either one alone would leave an assertion uncovered.
Key standard references
- ISA 330.4(a): Defines substantive procedures as procedures designed to detect material misstatements at the assertion level.
- ISA 330.18: Requires substantive procedures for each material class of transactions, account balance, and disclosure, irrespective of assessed risk.
- ISA 330.21: Requires substantive procedures specifically responsive to significant risks.
- ISA 330.A52: Notes that tests of details are ordinarily more responsive to significant risks than analytical procedures alone.
- ISA 520.5: Governs the design and evaluation of substantive analytical procedures.
Related terms
Related reading
Frequently asked questions
Can tests of controls eliminate the need for substantive procedures?
No. ISA 330.18 requires substantive procedures for every material class/balance/disclosure, regardless of control effectiveness. Controls reduce the extent but never eliminate the requirement.
What additional requirement applies to significant risks?
ISA 330.21 requires substantive procedures specifically responsive to the identified risk. ISA 330.A52 notes that tests of details are ordinarily more responsive than analytical procedures for significant risks.
What is the difference between substantive procedures and tests of controls?
Substantive procedures detect misstatements in balances and transactions. Tests of controls evaluate whether controls operated effectively. They answer different questions but are often combined in an audit strategy.