Substantive Testing vs Tests of Controls: Substantive Procedures and Analytical Procedures Explained

Every audit program mixes three kinds of work: tests of controls, tests of details and analytical procedures. The mix has to follow the risk assessment. Otherwise the firm over-audits low-risk areas or leaves a significant risk without a real response.

This guide explains how these procedures relate under GAAS for nonissuer audits. The core standards are AU-C 315 (risk assessment), AU-C 330 (responses to assessed risks) and AU-C 520 (analytical procedures), with AU-C 530 on sampling. The guide paraphrases these sections.

The big picture

AU-C 330 organizes the auditor's response to assessed risks into further audit procedures, which are:

• Tests of controls: procedures designed to evaluate the operating effectiveness of controls in preventing, or detecting and correcting, material misstatements at the assertion level.
• Substantive procedures: procedures designed to detect material misstatements at the assertion level. They include tests of details and substantive analytical procedures.

Analytical procedures also appear at two other points, under different requirements: as risk assessment procedures under AU-C 315, and as final analytical procedures near the end of the audit under AU-C 520.

How risk assessment drives the mix

Under AU-C 315 as revised by SAS No. 145, the auditor assesses inherent risk and control risk separately at the assertion level. Inherent risk is assessed using the inherent risk factors (complexity, subjectivity, change, uncertainty and susceptibility to misstatement due to management bias or fraud). Control risk can only be assessed below maximum if the auditor plans to test the operating effectiveness of controls.

That leads to a practical rule:

• If the auditor does not plan to test controls for an assertion, control risk is assessed at maximum and the risk of material misstatement equals inherent risk. Substantive procedures must provide all the evidence.
• If the auditor plans to test controls and they operate effectively, control risk can be assessed lower, and the nature, timing or extent of substantive procedures can be reduced. Substantive procedures cannot be eliminated for material areas.

Where an entity's controls are informal and the number of transactions is manageable, a fully substantive approach can be more efficient than testing controls. That does not remove the requirement to understand the components of internal control and evaluate the design and implementation of controls that address risks, including controls over journal entries.

Tests of controls

When tests of controls are required

AU-C 330 requires the auditor to design and perform tests of controls when:

1. the auditor's risk assessment includes an expectation that controls are operating effectively (the auditor intends to rely on them), or
2. substantive procedures alone cannot provide sufficient appropriate audit evidence at the assertion level.

The second situation arises in highly automated environments, for example an e-commerce company where revenue is initiated, recorded and processed entirely by systems with little or no documentary trail outside them.

Designing tests of controls

• Inquiry alone is not enough. Tests of controls combine inquiry with other procedures such as inspection of evidence of performance, observation and reperformance.
• Cover the period of reliance. If controls are tested at an interim date, the auditor obtains evidence about significant changes after that date and decides what additional evidence is needed for the remaining period.
• Indirect controls. The auditor considers whether the tested controls depend on other controls, such as IT general controls over a system report.
• Use of prior-audit evidence. Evidence from previous audits about controls that have not changed may be used in some cases, after the auditor establishes that it remains relevant. If a firm rotates its testing of unchanged controls, it should not let that rotation leave controls untested for long periods, and it should test some controls in each audit. Controls over a significant risk must be tested in the current period if the auditor relies on them.
• Deviations. When deviations are found, the auditor makes specific inquiries to understand them and determines whether the tests provide an appropriate basis for reliance, whether additional tests are needed, or whether the risks need a different response. Deviations may also be control deficiencies to evaluate under AU-C 265.

Sample sizes for tests of controls

Attribute sampling under AU-C 530 is common: the auditor sets a tolerable rate of deviation and an expected rate, and the sample size depends on those rates, the desired confidence and the frequency of the control. A firm's methodology may include a table by control frequency (annual, quarterly, monthly, weekly, daily, multiple times per day) built into their methodology.

Substantive procedures

The minimum requirement

Regardless of the assessed risk of material misstatement, AU-C 330 requires the auditor to design and perform substantive procedures for each relevant assertion of each material class of transactions, account balance and disclosure. This reflects the facts that risk assessment is judgmental and that internal control has inherent limitations.

AU-C 330 also requires certain procedures related to the financial statement closing process: agreeing or reconciling the financial statements, including disclosures, to the underlying accounting records, and examining material journal entries and other adjustments made during preparation of the statements.

Significant risks

When the auditor determines that a risk is a significant risk, substantive procedures must be specifically responsive to that risk. If the approach to a significant risk consists only of substantive procedures, those procedures must include tests of details. Substantive analytical procedures alone are not enough.

Tests of details

Tests of details examine individual items. Common forms include:

• Vouching from the recorded amount to support (tests existence or occurrence)
• Tracing from source documents to the records (tests completeness)
• External confirmation of receivables, bank balances, debt or legal matters (AU-C 505)
• Physical inspection or observation, for example inventory counts (AU-C 501)
• Recalculation of depreciation, accruals or interest
• Cutoff testing around period-end
• Search for unrecorded liabilities in subsequent disbursements

Direction matters. Vouching from the general ledger to invoices tests existence, not completeness. For completeness of liabilities, start outside the ledger, from subsequent payments, vendor statements or receiving reports.

Timing of substantive procedures

Substantive procedures performed at an interim date need to be covered by further procedures for the remaining period, either substantive procedures combined with tests of controls, or further substantive procedures alone, that provide a reasonable basis for extending the conclusions to period-end. The higher the risk, the more the auditor leans toward performing procedures at or near period-end.

Analytical procedures

AU-C 520 defines analytical procedures as evaluations of financial information through analysis of plausible relationships among financial and nonfinancial data, including investigation of fluctuations and relationships that are inconsistent with other information or that differ significantly from expected values.

Substantive analytical procedures: four steps

When the auditor uses analytical procedures as substantive procedures, AU-C 520 requires the auditor to:

1. Determine suitability of the procedure for the assertion, considering the assessed risks and any tests of details for the same assertion. Analytics work best for large volumes of transactions that are predictable over time, such as payroll, interest, rent or occupancy-driven revenue.
2. Evaluate the reliability of the data used to develop the expectation, considering its source, comparability, nature and relevance, and the controls over its preparation. Data produced by the entity needs testing for accuracy and completeness, or reliance on controls over it.
3. Develop an expectation of recorded amounts or ratios and evaluate whether it is precise enough to identify a misstatement that, individually or in aggregate, could cause the statements to be materially misstated. "Up 3% because of inflation" is rarely precise enough; a model built from headcount, pay rates and pay periods often is.
4. Determine the amount of difference from the expectation that is acceptable without further investigation, typically linked to performance materiality under AU-C 320.

When the difference exceeds the threshold, the auditor investigates by inquiring of management and obtaining appropriate audit evidence relevant to management's responses, and performs other procedures as needed. An unverified explanation is not evidence.

Example: payroll expense (illustrative)

• Expectation: average headcount by month from HR records multiplied by average pay rates, adjusted for the raise effective in July and bonus accruals.
• Data reliability: headcount tested to payroll registers for two months; pay rates agreed to approved rate changes for a sample.
• Threshold: a defined percentage of performance materiality.
• Result: recorded expense within threshold of expectation; no further investigation needed. Document the calculation, sources, threshold and conclusion.

Final analytical procedures

Near the end of the audit, the auditor must design and perform analytical procedures that help form an overall conclusion about whether the financial statements are consistent with the auditor's understanding of the entity. If this identifies a previously unrecognized risk, the auditor revises the risk assessment and modifies planned procedures.

Dual-purpose tests

A single procedure can serve as both a test of controls and a test of details. For example, a sample of purchase invoices can be examined for evidence of approval (control) and for correct amount and period (substantive). Dual-purpose tests save time, but the sample must be designed to meet the objectives of both tests, and each result must be evaluated on its own terms.

Documentation

AU-C 330 and AU-C 230 expect the file to show:

• the overall responses to assessed risks at the financial statement level
• the nature, timing and extent of further audit procedures and how they link to assessed risks at the assertion level
• the results, including conclusions where not otherwise clear
• for tests of controls relied on from prior audits, the conclusions about relying on them
• for substantive analytics, the expectation, its basis, the threshold, the comparison and the investigation of differences

Frequently asked questions

What is the difference between substantive testing and tests of controls?

Tests of controls evaluate whether a control operated effectively throughout the period. Substantive testing looks directly for material misstatements in balances, transactions and disclosures, through tests of details or substantive analytical procedures.

Can an audit be performed without testing any controls?

Yes. A fully substantive audit can be performed, provided substantive procedures alone can give sufficient appropriate evidence. The auditor must still understand internal control and evaluate the design and implementation of controls that address risks, and control risk is assessed at maximum.

Are analytical procedures enough for a significant risk?

No. When the response to a significant risk is only substantive, AU-C 330 requires that it include tests of details. Substantive analytical procedures can supplement them but cannot be the only response.

How precise does an expectation need to be?

Precise enough to identify a misstatement that could be material individually or in aggregate. Expectations built from disaggregated, independent and tested data are more precise than year-over-year comparisons of totals.

Sources

• AICPA, AU-C Section 330, Performing Audit Procedures in Response to Assessed Risks and Evaluating the Audit Evidence Obtained
• AICPA, AU-C Section 315 (as revised by SAS No. 145), Understanding the Entity and Its Environment and Assessing the Risks of Material Misstatement
• AICPA, AU-C Section 520, Analytical Procedures
• AICPA, AU-C Section 530, Audit Sampling; AU-C Section 265; AU-C Section 320; AU-C Section 501; AU-C Section 505; AU-C Section 230

CORAA prepares ready-to-review audit files for US CPA firms from QuickBooks books; you review and sign. See /us.

AU-C references are to AICPA Professional Standards, paraphrased here; read the standard itself before relying on a requirement. This page is guidance, not professional advice. Report an error