Key Points
- Tests of controls ask whether a control worked; substantive procedures ask whether the numbers are right.
- You cannot reduce substantive testing below a minimum level, even if every control passed.
- Skipping tests of controls means running a fully substantive approach with larger sample sizes.
- Confusing the two produces evidence that answers the wrong question for the assertion.
Side-by-side comparison
| Dimension | Tests of controls | Substantive procedures |
|---|---|---|
| What it answers | Did the control operate effectively during the period? | Is the amount or disclosure free of material misstatement? |
| When required | Only when the audit strategy relies on controls operating effectively | Always required for every material class of transactions and account balance |
| Evidence type | Occurrence-based: each item confirms one instance of control operation | Amount-based: each item provides direct evidence about a monetary value |
| Timing | Must cover the entire period of intended reliance (ISA 330.12) | Can be performed at an interim date with roll-forward procedures (ISA 330.22) |
| Sample drawn from | Occurrences of control operation (daily approvals, weekly reconciliations) | Financial statement populations (invoices, receivable balances, journal entries) |
When the distinction matters on an engagement
The distinction bites hardest when a team runs tests of controls but reads the results as substantive evidence. ISA 330.8 requires the auditor to design and perform tests of controls when the planned approach includes reliance on operating effectiveness. If you test whether an accounts payable clerk approved each invoice, that evidence confirms the approval process worked. It tells you nothing about whether the recorded payable is accurate.
A reviewer who sees 40 tested approvals and concludes "payables are fairly stated" has confused control evidence with substantive evidence. The fix is structural: file each type of evidence under the assertion it supports, and cross-reference ISA 330.18 for the substantive response that still needs to follow. Two different questions need two different procedures.
Worked example: Dekker Logistics B.V.
Client: Dutch logistics company, FY2024, revenue €38M, IFRS reporter.
Risk: Revenue occurrence (IFRS 15). Management's key control is a daily automated three-way match that reconciles delivery confirmations to purchase orders and sales invoices before the revenue entry posts.
Test of controls applied
Selected 25 daily match reports spread across all 12 months of FY2024. For each report, confirmed the system completed the match before the revenue entry posted and that the team investigated all flagged exceptions.
Documentation note: "Tested operating effectiveness of the automated three-way match control over revenue occurrence. 25 items selected across the full period, zero deviations noted. Control operated effectively throughout FY2024. Ref: ISA 330.10."
Substantive procedure applied to the same assertion
Selected a sample of 30 revenue transactions (€3.2M from the €38M population) and agreed each to signed delivery confirmation and the corresponding customer purchase order.
Documentation note: "Substantive test of details over revenue occurrence. 30 items tested, €3.2M coverage. No misstatements identified. Ref: ISA 330.18."
Both tests target revenue occurrence but produce different evidence. The controls test confirms the match process worked throughout the year. The substantive test confirms specific revenue amounts are supported by external documentation. If the team had filed only the controls evidence, the file would lack direct evidence about whether the €38M revenue figure is materially correct.
What reviewers get wrong
The FRC's 2023/24 inspection cycle found that engagement teams frequently did not extend tests of controls when interim testing covered only part of the period of reliance. ISA 330.12 requires the auditor to obtain evidence about the operating effectiveness of controls during the remaining period. A controls test covering nine months with no update for the final quarter leaves a gap that reviewers will flag.
Teams often set sample sizes for tests of controls using the same logic they apply to substantive samples (e.g., coverage-driven). ISA 330.A25 makes clear that the sample size for tests of controls depends on the planned degree of reliance, the expected deviation rate, the tolerable rate of deviation, and the assessed risk of material misstatement. Importing a monetary-threshold approach from substantive testing produces the wrong sample.
Key standard references
- ISA 330.8–17: Requirements for tests of controls, including design, timing, and extent.
- ISA 330.18–22: Requirements for substantive procedures for every material balance and class of transactions.
- ISA 330.12: Requires controls evidence to cover the entire period of intended reliance.
- ISA 330.A25: Guidance on sample size considerations for tests of controls.
Related terms
Related reading
Frequently asked questions
Can tests of controls replace substantive procedures?
No. ISA 330.18 requires substantive procedures for every material class of transactions and account balance, regardless of how effective the controls are. Strong controls can reduce the extent of substantive testing, but they cannot eliminate it.
What happens if a test of controls finds deviations?
Deviations increase assessed control risk, which means you need more extensive substantive procedures. If deviations exceed the tolerable rate, you cannot rely on the control at all and must move to a fully substantive approach for that assertion.
How do sample sizes differ between tests of controls and substantive procedures?
Tests of controls use deviation-rate logic (planned reliance, tolerable deviation rate, expected deviation rate). Substantive samples use monetary logic (tolerable misstatement, expected misstatement, population value). Importing one method into the other produces the wrong sample size.