Opening subject page...
Loading your content
Evaluating whether an entity's internal controls operate effectively to reduce assessed risks of material misstatement.
The practice of testing internal controls did not emerge overnight; it evolved over more than a century of auditing practice driven by corporate scandals, regulatory responses, and the increasing complexity of business operations. Early audits in the late nineteenth and early twentieth centuries were largely substantive in nature—auditors verified every transaction or a large proportion of them, focusing on the detection of fraud and clerical errors. As organizations grew in scale, a purely substantive approach became impractical, pushing the profession to develop a more risk-based methodology that recognized the role of internal controls as a gatekeeper against material misstatement.
The motivation behind testing controls is fundamentally economic and analytical: if the auditor can demonstrate that well-designed controls are operating effectively, the nature, timing, and extent of substantive procedures can be reduced, yielding a more efficient and focused audit. Conversely, if controls are unreliable, the auditor must expand substantive testing to compensate. Understanding this interplay is central to the modern risk-based audit model codified in professional standards such as AU-C Section 330 and PCAOB AS 2301.
The central question that tests of controls address is straightforward yet consequential: Are the entity's internal controls operating effectively throughout the relevant period such that the auditor can rely on them to reduce the assessed risk of material misstatement at the assertion level? Answering this question requires a disciplined methodology—one that specifies what evidence to gather, how much to gather, and how to evaluate deviations. The sections that follow provide a thorough treatment of that methodology.
Before diving into the mechanics of performing tests of controls, it is essential to establish the foundational concepts that underpin this area of auditing. A test of controls is an audit procedure designed to evaluate the operating effectiveness of controls in preventing, or detecting and correcting, material misstatements at the assertion level. The auditor performs tests of controls in two situations: first, when the auditor's risk assessment includes an expectation that controls are operating effectively (i.e., the auditor intends to rely on controls); and second, when substantive procedures alone are insufficient to provide sufficient appropriate audit evidence at the assertion level.
The diagram above illustrates the complete lifecycle of a tests-of-controls engagement. At the top, during the risk assessment phase, the auditor determines whether to rely on controls. If the answer is no—perhaps because the entity is small with limited segregation of duties—the auditor proceeds directly to substantive procedures. If the answer is yes, the auditor designs tests of controls by selecting the appropriate nature (inquiry, observation, inspection, reperformance), timing (interim versus year-end), and extent (sample size) of the tests. After execution, the observed deviation rate is compared against the tolerable deviation rate to determine whether the controls may be considered effective.
The nature of a test of controls refers to the type of audit procedure employed. Auditing standards identify four primary procedures, and the persuasiveness of evidence generally increases as one moves from inquiry to reperformance. Inquiry consists of asking knowledgeable personnel how a control is performed; while essential for obtaining an understanding, inquiry alone is never sufficient to support a conclusion on operating effectiveness. Observation provides evidence about the application of a control at a point in time—for example, watching a bank reconciliation reviewer initial a document—but its limitation is that behavior may change when the subject is not being observed. Inspection of documents (such as verifying that a purchase order bears an authorized signature) provides evidence that a control was applied to a specific transaction. Reperformance is the most persuasive: the auditor independently executes the control procedure and compares the result to what the client obtained, such as re-footing an invoice and matching it to the approved price list.
The timing of tests of controls addresses when the testing is performed relative to the period of reliance. If the auditor tests controls at an interim date, the auditor must obtain evidence about the nature and extent of any significant changes in internal control that occurred subsequent to the interim period. The auditor bridges the gap between the interim testing date and the period-end by performing additional procedures—such as extending the sample to cover the remaining period, making inquiries about changes, or performing walkthrough procedures. A critical consideration is that the longer the remaining period after interim testing, the more additional evidence is needed. Furthermore, under PCAOB standards for integrated audits, the auditor generally tests controls close enough to the 'as of' date (fiscal year-end) that the conclusions remain relevant.
The extent of testing is primarily a question of sample size. In attribute sampling for tests of controls, the auditor determines sample size based on the desired confidence level (typically 90% or 95%), the tolerable deviation rate (TDR), and the expected population deviation rate (EPDR). The relationship among these variables can be expressed conceptually and, in practice, is operationalized through attribute sampling tables or formulas.
Not all controls are tested the same way. The nature of the control—whether it is a manual control, an automated (IT) control, or a hybrid—significantly affects how the auditor designs and calibrates the test. Furthermore, controls operate at different frequencies (daily, weekly, monthly, quarterly, annually), and the frequency determines both the population size and the appropriate sample size.
A key distinction in practice concerns automated controls. Because software executes identically every time (absent a code change), the auditor can test a single instance of the control and rely on that result for the entire period—provided the IT general controls (ITGCs) that govern change management, logical access, and computer operations are also tested and found to be effective. If ITGCs are not effective—for example, if unauthorized changes could have been made to application code—the auditor cannot rely on the consistency assumption and must treat the automated control with greater skepticism, possibly expanding testing or reverting to substantive procedures.
Consider the following scenario: An auditor is performing the annual audit of Apex Manufacturing, Inc. for the fiscal year ended December 31, 20X4. During risk assessment, the auditor identified that the company processes approximately 15,000 purchase orders per year. A key control over the completeness and authorization of purchases is that the purchasing manager reviews and approves each purchase order above $500 before it is transmitted to the vendor. The auditor plans to rely on this control and assess control risk below maximum for the purchasing/payables cycle.
Tests of controls occupy a specific and consequential niche in the audit process. Their value lies in their ability to provide evidence about the reliability of the client's internal processes, which in turn shapes the entire audit strategy. However, they also carry inherent limitations that the auditor must understand and manage. The table below summarizes the principal strengths and limitations.
| Dimension | Strengths | Limitations |
|---|---|---|
| Audit Efficiency | Effective controls allow significant reduction in the nature, timing, and extent of substantive procedures, saving time and cost. | If controls are not effective, the time spent on tests of controls is wasted, and additional substantive testing must still be performed. |
| Evidence Quality | Reperformance and inspection provide persuasive evidence about whether controls operated throughout the period. | Observation provides only point-in-time evidence. Inquiry alone is insufficient. Controls without documentary evidence are harder to test. |
| Sampling Risk | Statistical and nonstatistical sampling methods provide structured, defensible bases for drawing conclusions from samples. | Sample results may not be representative of the population. The risk of assessing control risk too low (Type II error) can lead to under-auditing. |
| IT Controls | Automated controls offer consistency and may be tested with very small samples (even one instance) if ITGCs are effective. | Reliance on automated controls depends on effective ITGCs. A failure in change management or access controls can invalidate the entire testing basis. |
| Management Override | Well-designed controls with segregation of duties reduce the opportunity for fraud and misstatement. | Controls cannot fully prevent management override of controls. The auditor must always perform certain substantive procedures (e.g., journal entry testing) regardless of control effectiveness. |
For students preparing for the AUD section of the CPA exam, it is important to understand how tests of controls in a standard financial statement audit relate to the more comprehensive requirements of an integrated audit under PCAOB standards (applicable to issuers, or public companies). In an integrated audit, the auditor simultaneously expresses an opinion on the financial statements and on the effectiveness of internal control over financial reporting (ICFR) as of year-end. This dual objective significantly elevates the importance and rigor of tests of controls.
| Dimension | Financial Statement Audit (AU-C 330) | Integrated Audit (PCAOB AS 2201 / AS 2301) |
|---|---|---|
| Objective | Obtain evidence that controls are operating effectively to justify reduced substantive testing | Obtain evidence sufficient to opine on the effectiveness of ICFR as of year-end, in addition to the financial statement opinion |
| When Required | Tests of controls are optional; the auditor may choose a purely substantive approach | Tests of controls are mandatory for all significant accounts and relevant assertions |
| Timing | Interim testing is common; rollforward evidence bridges to period-end | Controls must be tested as of the reporting date; some testing must be close to year-end |
| Extent | Sample size varies based on planned reliance and tolerable deviation rate | Generally more extensive testing; every significant process requires control testing regardless of the substantive approach |
| Rotational Testing | Not specifically addressed; reliance on prior-year results is limited by the need for current-period evidence | Permitted for less-significant controls in multi-location audits, but significant controls must be tested every year |
An additional advanced concept is the notion of rotational testing and benchmarking of automated controls. Under PCAOB guidance, if an automated application control has been tested in a prior year and the relevant ITGCs (particularly change management controls) have been tested and found effective in the current year, the auditor may reduce the extent of direct testing of the automated control. This concept of benchmarking allows the auditor to accumulate evidence about automated controls over multiple audit periods, recognizing that software behaves consistently absent deliberate changes. This efficiency gain is one of the principal benefits of IT-dependent audit approaches and is increasingly relevant as entities automate more of their financial processes.
Tests of controls are audit procedures performed to evaluate the operating effectiveness of an entity's internal controls in preventing, or detecting and correcting, material misstatements at the assertion level. The auditor designs these tests by considering three dimensions: the nature of the procedure (inquiry, observation, inspection, or reperformance—with inquiry alone never sufficient), the timing (interim testing with rollforward procedures or testing near period-end), and the extent (sample size determined by the tolerable deviation rate, expected deviation rate, and desired confidence level). The simplified Poisson-based formula n = R / TDR provides a practical starting point when zero deviations are expected.
After execution, the auditor compares the observed deviation rate against the tolerable deviation rate and performs both quantitative and qualitative analysis of any deviations found. For automated controls, testing a single instance may suffice if IT general controls are effective, and benchmarking may reduce retesting in subsequent years. In an integrated audit under PCAOB standards, tests of controls are mandatory because the auditor must opine on the effectiveness of ICFR. Regardless of the audit type, the results of tests of controls directly influence the nature, timing, and extent of substantive procedures—effective controls allow for reduced substantive testing, while control failures require expanded substantive work to maintain the overall level of audit assurance.