Join the waitlist
Glossary/Risk and controls

Tests of controls

Tests of controls are audit procedures that evaluate whether a control operated effectively throughout the period, and they are required when the auditor plans to rely on controls or substantive tests alone cannot suffice.

CORAA TeamUpdated November 5, 2026

Definition

A test of controls checks operating effectiveness: did the control run, consistently, by the right person, for the whole period under audit? It differs from understanding design and implementation, which is part of risk assessment. Typical techniques are reperformance, inspection of evidence such as approval signatures, and observation. Inquiry alone does not test operating effectiveness.

Why it matters in an audit or review

AU-C 330 calls for tests of controls when the auditor's risk assessment expects controls to be operating effectively, or when substantive procedures alone cannot provide enough evidence (common with highly automated revenue processing). Reliance on controls lets the auditor reduce substantive work, but only if the testing supports it.

Example

A control requires a second approver on vendor payments above $10,000 (illustrative). The auditor selects 60 payments over the threshold using attribute sampling and inspects each for the second approval. Two lack it. The deviation rate of 3.3 percent is compared with the tolerable rate to decide whether reliance holds.

Common mistakes

  • Testing only the quarter-end month and extending the conclusion to the full year.
  • Ignoring deviations as isolated without understanding why they occurred.

FAQ

Are tests of controls required on every audit?

No. Many small-entity audits go fully substantive after judging controls will not be relied on.

Sources

  • AICPA, AU-C Section 330, Performing Audit Procedures in Response to Assessed Risks
  • AICPA, AU-C Section 315 (as amended by SAS No. 145)
  • AICPA, AU-C Section 530, Audit Sampling

Definitions paraphrase AICPA and FASB guidance; read the standard itself before relying on a requirement. Example figures are illustrative. This page is guidance, not professional advice. Report an error

Standards

AU-C 330AU-C 315

Related terms

  • Substantive procedures
    Substantive procedures are audit tests designed to detect material misstatements in account balances, transactions and disclosures, made up of tests of details and substantive analytical procedures.
  • Walkthrough
    A walkthrough follows a single transaction from initiation through processing to recording in the financial statements, to confirm the auditor's understanding of a process and whether its controls are in place.
  • Attribute sampling
    Attribute sampling estimates how often a defined characteristic occurs in a population, most often the rate at which a control was not followed, and compares that rate with a tolerable deviation rate.
  • Inquiry
    Inquiry is an audit procedure that seeks information from knowledgeable people inside or outside the entity, in formal written or informal oral form, and is rarely enough evidence on its own.

Go deeper

All glossary terms →

For US CPA firms

Join the CORAA waitlist

CORAA AI drafts audit working papers from your client’s QuickBooks books and does the first pass: lead schedules, tie-out, memos, draft notes and letters. CORAA Network reviewers clear every finding. Your firm reviews and signs.

  • First audit free, so you can judge the quality on a real file
  • Flat fee by entity size; messy books included
  • We work only with CPA firms, never their clients
See how it works →

* required