Control testing answers one question: did a control operate as designed, consistently, throughout the period the auditor wants to rely on it? If the answer is yes, the auditor can reduce substantive work in the area. If the answer is no, or the evidence is thin, the auditor falls back on substantive procedures. This guide covers how to plan the test, how many items to select, how to write the test so that a second person could reperform it, and how to evaluate a deviation.
The guide is written for financial statement audits of nonissuers under AU-C 330. Audits of internal control for public companies follow PCAOB standards and are covered in the SOX 404 guide.
When does the auditor test controls?
Under AU-C 330, the auditor designs and performs tests of controls when:
- the auditor's risk assessment expects the controls to operate effectively, so the auditor plans to reduce substantive procedures in reliance on them, or
- substantive procedures alone cannot provide sufficient appropriate audit evidence at the assertion level. This is common where a process is highly automated and little evidence exists outside the system.
Where neither applies, the audit can be entirely substantive. Many small-entity audits are, because the controls are informal or not worth testing. That is a choice, and the risk assessment should say why. See substantive testing versus tests of controls.
Design, implementation and operating effectiveness
Three different questions get confused:
- Design: if the control operated as described, would it prevent, or detect and correct, a material misstatement for the assertion it addresses?
- Implementation: does the control exist and is the entity using it? A walkthrough of one transaction answers this.
- Operating effectiveness: did the control work, applied consistently by the right people, throughout the period? Only this requires testing a sample.
Understanding design and implementation is part of risk assessment under AU-C 315. A walkthrough alone does not support reliance on a control. Inquiry alone does not either.
Test procedures
| Procedure | Use it when | Example |
|---|---|---|
| Inspection | Evidence of performance is a signature, stamp, system flag or document | Approval initials on an invoice over the limit |
| Observation | The control leaves no record, and timing matters | Watching a cash count |
| Reperformance | Checking the control's own accuracy | Re-matching a three-way match, re-running a report |
| Inquiry plus another procedure | To understand how the control works | Asking the reviewer what they look at, then inspecting what they reviewed |
Combine them. A reviewer who says they "review the bank reconciliation every month" should be able to show the reconciliation with a sign-off and evidence of what was investigated. A signature on a form tells you the reviewer signed. It does not tell you the reviewer looked, which is why the test script should ask what the reviewer would have caught.
How many items to test?
AU-C 530 governs sampling for tests of controls, and the sample must be large enough to reduce sampling risk to an acceptably low level. The standards do not prescribe a number. Two common approaches follow.
Approach 1: attribute sampling
Attribute sampling suits controls that operate many times, such as approvals on thousands of invoices. The inputs are the confidence level, the tolerable deviation rate and the expected deviation rate. With no expected deviations, the zero-deviation sample sizes follow from binomial probability:
| Confidence | Tolerable rate | Sample size |
|---|---|---|
| 90% | 10% | 22 |
| 95% | 10% | 29 |
| 90% | 5% | 45 |
| 95% | 5% | 59 |
If any deviation is found, the sample must be larger or the achieved upper deviation limit will exceed the tolerable rate. The audit sample size calculator computes both. See audit sampling methods.
Approach 2: fixed sizes by frequency
When the population is small, such as twelve monthly reviews, sampling formulas stop making sense and firms use a methodology table keyed to how often the control operates. Published practitioner tables vary, and the AICPA's audit sampling guidance is non-authoritative. Typical ranges seen in firm methodologies are:
| Control frequency | Population per year | Typical sample |
|---|---|---|
| Annual | 1 | 1 |
| Quarterly | 4 | 2 |
| Monthly | 12 | 2 to 5 |
| Weekly | 52 | 5 to 15 |
| Daily | about 250 | 20 to 40 |
| Multiple times per day | 250 or more | 25 to 60 |
These ranges are common firm practice, not requirements of any standard. Use the higher end for higher assessed risk, a control that is the only safeguard against a significant risk, a new control, or a prior-year deviation. Document the table the firm applies and why.
A small sample has limited power. A sample of two monthly items can miss a control that fails in several months. That is acceptable when risk is low and the control is one of several, and not otherwise.
A control test script template
Write the test so that someone else can perform it. Each script has these parts:
| Field | What to enter |
|---|---|
| Control ID and description | Who performs it, what they do, how often, what evidence it leaves |
| Risk and assertion addressed | The misstatement it prevents or detects |
| Population | The completeness of the list and its source, and period covered |
| Sample size and basis | Method, confidence, tolerable rate or firm table |
| Selection method | Random, systematic or haphazard, and how |
| Attributes tested | One line per thing that must be true, such as "approver is authorized for amount," "approval dated before payment," "invoice agrees to PO" |
| Deviation definition | What counts as an exception |
| Results | Per item: attributes met or not met, reference to evidence |
| Exceptions and follow-up | Cause, whether isolated, effect on reliance |
| Conclusion | Reliance supported or not, and effect on substantive testing |
The control test workpaper and the attribute sampling size worksheet follow this layout.
Completeness of the population matters more than the sample size. If the list of invoices excludes some, the sample says nothing about the excluded ones. For system reports used as populations, test the report's accuracy and completeness; see information produced by the entity.
Worked example: approval of invoices over $2,500
Illustrative numbers. A distributor's policy requires a manager's approval for any vendor invoice over $2,500. The year's population is 1,840 invoices over $2,500, taken from the payables system after testing the report's completeness. The auditor wants 95% confidence and a 10% tolerable deviation rate, expecting no deviations.
- Sample size: 29 (from the table above).
- Selection: random selection of 29 invoice numbers.
- Attributes: (a) approval initials present, (b) approver authorized for the amount, (c) approval dated on or before payment.
Result: 28 items meet all attributes. One item has approval dated three days after payment. Sample deviation rate: 1 / 29 = 3.4%.
The achieved upper deviation limit at 95% confidence for 1 deviation in 29 is about 15.3% (binomial calculation), which exceeds the 10% tolerable rate. The sample does not support reliance as planned.
The auditor does what AU-C 330 and AU-C 530 call for: inquire into the deviation and its cause. Suppose it was a one-time system outage and the manager approved the invoice in writing before the outage, with a timing gap. The auditor decides it is not representative but still treats the sample as failing to support the planned level of reliance. Options are to extend the sample, or to reduce reliance and expand substantive testing of purchases and payables. Extending only helps if the cause explains the deviation and the larger sample is expected to come back clean; with one deviation already in hand, a larger sample is needed to bring the upper limit under 10%. The auditor documents the choice and the reason.
A single deviation that looks deliberate, such as a forged approval, is evaluated qualitatively and may signal fraud. See fraud risk assessment.
Documentation and communication
Document the test script, the population and how its completeness was tested, the sample selected, the evidence for each item, the deviations and the conclusion. If deviations show a deficiency in internal control, evaluate it under AU-C 265 and communicate significant deficiencies and material weaknesses in writing. See the deficiency evaluation worksheet.
Frequently asked questions
What is the difference between control testing and substantive testing?
Control testing evaluates whether a control operated effectively. Substantive testing evaluates whether account balances, transactions and disclosures are misstated. The two together support the audit opinion.
How many samples should I test for a monthly control?
There is no standard number. Many firm tables use two to five months, higher where risk is higher. Document the firm's table and the factors considered.
Can I rely on a control I only walked through?
No. A walkthrough supports understanding of design and implementation. Reliance requires tests of operating effectiveness.
What if I find one deviation?
Investigate the cause, decide whether it is isolated, and compute the effect on the sample result. For an attribute sample, compare the upper deviation limit to the tolerable rate.
Do I have to test controls every year?
AU-C 330 contains rules on using audit evidence from prior periods about the operating effectiveness of controls. Read those paragraphs before setting a rotation plan, and document the reasoning.
Sources
- AICPA, AU-C Section 330, Performing Audit Procedures in Response to Assessed Risks and Evaluating the Audit Evidence Obtained
- AICPA, AU-C Section 530, Audit Sampling
- AICPA, AU-C Section 265, Communicating Internal Control Related Matters Identified in an Audit
- AICPA, Audit Sampling audit guide (non-authoritative), for illustrative sample size tables
CORAA prepares ready-to-review audit files for US CPA firms from QuickBooks books; you review and sign. See /us.
Part of CORAA University · Evidence and audit procedures: related guides, calculators and templates.
AU-C references are to AICPA Professional Standards, paraphrased here; read the standard itself before relying on a requirement. This page is guidance, not professional advice. Report an error