A test of controls is an audit procedure that checks whether a control actually operated effectively throughout the period, as distinct from a substantive procedure, which looks at the numbers themselves. SA 330 requires tests of controls where the auditor plans to rely on them, or where substantive procedures alone cannot give sufficient evidence.
Facts checked: 10 October 2026. The SA 330 requirements (when controls must be tested, more persuasive evidence for greater reliance, substantive procedures for each material class irrespective of risk, the four ways of testing, rotation of tests at least once in every third audit) were checked against an ICAI-hosted SA 330 summary chart and secondary commentary. The ICAI Guidance Note on the audit of internal financial controls over financial reporting and section 143(3)(i) were checked against secondary summaries; the Guidance Note itself was not opened. I have not cited SA paragraph numbers. The example is invented.
Where it fits
SA 315 identifies and assesses the risks of material misstatement. SA 330 is the auditor's response: the nature, timing and extent of further procedures must be matched to those assessed risks. There are two kinds of further procedure.
| Tests of controls | Substantive procedures | |
|---|---|---|
| Question | Did the control operate effectively? | Is the amount or disclosure right? |
| Examples | Was each purchase order approved by the authorised person? | Vouch purchase invoices, confirm creditors, test cut-off |
| Outcome | Reliance on controls, reducing substantive work | Direct evidence on balances |
| Required | When reliance is planned, or substantive procedures alone are not enough | For each material class of transactions, balance and disclosure, whatever the assessed risk |
So testing controls never removes substantive work. It only changes how much is needed.
When tests of controls are needed
- The auditor's risk assessment expects the controls to be operating effectively and the auditor plans to rely on them.
- Substantive procedures alone cannot provide sufficient appropriate evidence, which happens with high-volume, automated transactions.
The greater the planned reliance, the more persuasive the evidence required. If a control has not changed and is not a significant-risk control, the auditor may test it once in every third audit, but controls over significant risks have to be tested in the current period.
How to test a control
| Method | What it gives | Limit |
|---|---|---|
| Inquiry | Understanding of how the control works | Not enough on its own |
| Observation | Seeing the control performed | Only at the moment observed |
| Inspection | Evidence on documents: signatures, stamps, system approvals | Shows it was done, not always done well |
| Re-performance | The auditor repeats the control independently | Most reliable, most time-consuming |
Tests are combined. Inquiry is always paired with another procedure.
Sample size and deviations
The sample for a test of controls depends on the frequency of the control and the risk. The population is every instance of the control in the period, not the rupee value, and the auditor chooses items to be representative. Refer to the audit sampling calculator for working out a size.
A deviation is any instance where the control did not operate as designed. For each one the auditor asks why, and whether it points to a wider failure. If the deviations exceed what was tolerated, the control cannot be relied on, and the auditor widens substantive procedures. The conclusion is recorded in the working papers either way.
Worked example: testing purchase controls (illustrative)
A trading company buys goods worth ₹48 crore a year, with about 1,500 purchase orders (POs). All figures are invented.
| Control | Test | How |
|---|---|---|
| PO is approved by the authorised person before it goes to the supplier | Inspection of approval; compare against the delegation of authority | 25 POs picked across the year |
| Goods receipt note (GRN) is made on receipt, against the PO | Inspection of GRN against PO and delivery challan | Same 25 items |
| System three-way match: PO, GRN and supplier invoice agree before posting | Re-performance of the match; check tolerance settings | Re-match 25 invoices and look at the exception report |
| Payment is released after dual authorisation, to the registered bank account | Inspection of payment approval; compare account to vendor master | 25 payments, plus a test of changes to the vendor master |
Say 25 items are chosen and 24 pass. In one case, a PO of ₹3.2 lakh was approved a week after the goods arrived. The auditor asks the purchase head why, finds that the approver was on leave and no delegate was set up, and checks whether it has happened elsewhere by looking at all POs raised in the same fortnight. Two more are found. The auditor concludes the approval control did not operate effectively in that period, performs more substantive tests on purchases and creditors for the affected months, and reports a control deficiency to management.
A fuller checklist is in the procure-to-pay internal audit checklist and the P2P internal audit RCM guide.
The Indian IFC context
For a company, section 143(3)(i) of the Companies Act, 2013 requires the auditor's report to state whether the company has an adequate internal financial controls system in place and the operating effectiveness of such controls. The ICAI Guidance Note on Audit of Internal Financial Controls over Financial Reporting sets out how to plan and perform that audit. Its approach is the same as above: understand the controls, test design and operating effectiveness, and evaluate deficiencies. Testing is expected across the year, not just at the balance sheet date. The result is reported in a separate annexure. For how this ties to the CARO reporting, see ICFR automation and CARO 2020.
Frequently asked questions
What is the difference between tests of controls and substantive procedures?
A test of controls checks whether a control worked during the period. A substantive procedure checks the amounts or disclosures themselves. SA 330 requires substantive procedures for every material class even where controls are strong.
Is inquiry enough to test a control?
No. Inquiry has to be combined with observation, inspection or re-performance.
How many items should I test?
It depends on how often the control runs, the assessed risk and the tolerable deviation rate. There is no single number in SA 330.
What if I find a deviation in the sample?
Find the cause, see if it recurs, and consider whether the control can still be relied on. If not, widen substantive procedures.
Do tests of controls apply to internal audit as well?
Yes, though the purpose differs. Internal audit tests controls to report to management, using the same four methods.
See also the statutory audit workflow and what is internal audit.
Statutory facts on this page are checked against their sources, and the page says where it relied on secondary reporting. How we verify · Report an error