In an audit, internal control matters for one reason: it changes how much other testing is needed. The auditor first understands the controls, then decides whether to rely on them. If yes, the controls are tested. If the tests pass, less substantive testing is needed. If they fail, or are not tested, more is needed.
Last reviewed: 17 October 2026. Facts checked. We ran web searches on SA 330 and SA 265. The SA 330 points below come from an exposure-draft listing, a ClearTax explainer and an ICAI branch newsletter that quotes the requirements; we could not open the final ICAI text of SA 330, SA 315 or SA 265, and the searches returned almost nothing on SA 265 itself, so that section is general and hedged. The example is invented. Check the standards before you cite a paragraph.
The steps are: understand the controls, decide whether to rely on them, and test them. For the risk model above them, see inherent, control and detection risk.
Step 1: Understand the controls
The auditor learns how transactions flow, where errors could occur, and which controls address them. Walkthroughs are the usual method: follow one transaction from start to finish and note each control. The auditor also checks that the control actually exists and is in use, not only that it is written in a manual.
One distinction matters here. Looking at design and implementation tells you a control exists and is placed to catch errors. It does not tell you the control worked all year. A study guide we read makes this point plainly. Testing across the period is a separate step.
Step 2: Decide whether to rely
SA 330, as described in the sources we read, requires tests of controls in two situations:
- the auditor's risk assessment expects the controls to operate effectively, and the auditor plans to rely on them in setting the extent of substantive work; or
- substantive procedures alone cannot give sufficient appropriate evidence for an assertion.
The second situation is common where transactions are many, small and automated, such as a retail chain's till sales or a telecom billing system. Testing a sample of outputs without testing the system that produced them may not be enough.
When the controls are weak, or testing them would cost more than the substantive work it saves, the auditor may decide not to rely. That is a legitimate choice, as long as the substantive work is then larger.
Step 3: Test the controls
The same sources say the evidence must be more persuasive the more the auditor relies on a control. Inquiry alone is never enough. It must be combined with other procedures such as:
- observation of the control being performed;
- inspection of evidence, for example a signed approval;
- re-performance, doing the control again to see if the result matches;
- for automated controls, testing the logic and then the controls over changes to it.
The test must also cover the period. A control that worked in March tells you little about October. For a control that operated all year, auditors pick items from across the year.
A worked example (invented): purchases
A trading company's purchase process says that every purchase order above a set amount needs the finance head's approval, and that goods are booked only when a goods receipt note matches the invoice and the order.
| Step | What the auditor does |
|---|---|
| Understand | Walks one purchase from order to payment. Notes the approval and the three-way match |
| Decide | Expects the controls to work, so plans reliance and a smaller substantive sample |
| Test | Picks purchases from across the year. Checks approval on each large order, re-performs the three-way match |
| If tests fail | Several unmatched invoices were booked. Reliance is dropped, and the substantive sample is enlarged |
Our post on test of controls under SA 330 goes through a fuller version of this case.
What a failed test means
A failed test is not a failed audit. It changes the plan:
- reduce or drop reliance and increase substantive procedures;
- identify the deficiency and decide how serious it is;
- consider whether the weakness points to a risk of fraud or of a broader failure;
- tell the right people.
For grading, see control deficiency, significant deficiency and material weakness. For telling the right people, SA 265 covers communicating deficiencies to those charged with governance and management. We could not open the standard's text, so check it for what must be written and when. The wider communication duty is covered in SA 260 explained.
Two different things called "internal control"
Readers often mix up two ideas.
- Controls relevant to the audit of the financial statements. This is the scope of the tests above, and the auditor reports on the accounts only.
- Internal financial controls reporting. For companies covered by the Companies Act, 2013, the auditor also reports on the adequacy and operating effectiveness of internal financial controls over financial reporting. That is a separate report and a wider test. See internal financial controls under section 143(3)(i).
For the framework behind both, read the COSO 2013 five components.
Frequently Asked Questions
What is internal control in auditing?
The processes a business uses to prevent and catch errors and fraud in its transactions and reporting. The auditor studies them to decide how much other testing is needed.
Must an auditor always test controls?
No. SA 330, as described in sources we read, requires tests of controls when the auditor plans to rely on them or when substantive procedures alone are not enough.
Is inquiry enough to test a control?
No. It must be combined with observation, inspection or re-performance.
What if a control fails the test?
The auditor reduces reliance, raises substantive work, grades the deficiency and communicates it as the standards require.
Is this the same as the internal financial controls report?
No. That is a separate report under the Companies Act, 2013, with a wider scope.
Related Articles
Last reviewed: 17 October 2026. Facts checked. Opened: web search results on SA 330 (an exposure-draft listing, a ClearTax explainer, an ICAI branch newsletter); our own site posts. Could not open: the final ICAI text of SA 330, SA 315 and SA 265. Check requirements and wording there.
Statutory facts on this page are checked against their sources, and the page says where it relied on secondary reporting. How we verify · Report an error