ACCA Applied Skills · Audit and Assurance

Tests of controls: formula sheet

Full chapter guide

Key formulas

Purpose of tests of controls: Tests of controls → evidence of operating effectiveness of controls → lower control risk → less substantive testing; Only valid if the controls are well designed and you plan to rely on them.
Purpose of substantive procedures: Substantive procedures = tests of detail + substantive analytical procedures; They address the risk of material misstatement directly, whatever the controls are like.
Walkthrough vs test of controls: Walkthrough = one transaction, understanding and implementation; Test of controls = sample, operating effectiveness over the period; Use this one-line contrast in every comparison question.
When tests of controls are required: Required if: (1) reliance on controls is planned, or (2) substantive procedures alone cannot give sufficient appropriate evidence; Learn both conditions.
Audit risk link: Audit risk = risk of material misstatement × detection risk; Effective controls lower the assessed risk of material misstatement, so you can accept higher detection risk and do less substantive work.
Objective to control to test: Control objective → control → test of control → conclusion on reliance; Use this chain to structure any answer.
Reliability of techniques: Re-performance and inspection are usually stronger than observation, and observation is stronger than enquiry alone; A guide, not a rule. Strength depends on the control and the circumstances.
Enquiry rule: Enquiry + another technique = adequate evidence; Enquiry alone does not give sufficient appropriate evidence on operating effectiveness.
Result of failed test: Control fails → reduce reliance → increase substantive procedures; State the effect on the audit approach.
Test of control structure: Control → Method (inspect / observe / re-perform / enquire) → Evidence sought; Write each test in this order so it links directly to a named control.
Purpose of tests of controls: Effective controls → lower control risk → less substantive testing; If controls fail, control risk is higher and more substantive work is needed.
Three-way match: Purchase order = goods received note = supplier invoice; The core purchases control. Test by inspecting documents for evidence of matching.
Test versus procedure: Tests of controls check HOW a system operates; substantive procedures check WHAT the balance is; Do not give substantive tests when the question asks for tests of controls.
Audit risk model: Audit risk = Risk of material misstatement (inherent risk × control risk) × Detection risk; Inherent risk × control risk together make the risk of material misstatement. Acceptable audit risk is set first. Detection risk is then the balancing figure that you set through substantive procedures.
Control risk and detection risk: Lower control risk → higher acceptable detection risk → less substantive work. Higher control risk → lower acceptable detection risk → more substantive work.; The inverse link is the exam answer. You set detection risk through substantive procedures.
Deficiency reporting rule: Significant deficiencies → in writing to those charged with governance; other deficiencies → to management (orally or in writing) if they merit management's attention and management is not already aware.; Based on ISA 265. Whether a deficiency is significant is a matter of judgement. Report on a timely basis. Include description, potential effects and recommendations.
Management letter point structure: Deficiency + Possible consequence + Recommendation; Use this three-part structure for every point in a written answer.

Quick revision

Tests of controls check that controls operated effectively during the period.
Substantive procedures check the figures and disclosures themselves.
Control testing is needed when you plan to rely on controls, or when substantive procedures alone cannot give enough evidence.
Main methods: enquiry, observation, inspection, re-performance.
Enquiry alone is weak evidence and needs support from other methods.
Observation only proves the control worked at the time you watched.
Test controls for the full period, or consider extra evidence for any gap.
Sales: test authorisation of credit, matching of goods despatched notes to invoices and sequence checks.
Purchases: test approval of orders, matching of orders, goods received notes and invoices, and authorisation of payment.
Payroll: test starter and leaver authorisation, overtime approval and reviews of payroll changes.
Effective controls allow less substantive testing. Ineffective controls need more.
Report significant deficiencies to those charged with governance, with recommendations.

Common mistakes

Saying tests of controls check the figures in the financial statements. Fix: Remember that tests of controls check how the system operates. Substantive procedures check the amounts.
Treating a walkthrough as the main test of controls. Fix: A walkthrough is one transaction and confirms understanding and implementation. It is not enough evidence of operating effectiveness over the period.
Relying on enquiry alone as the test. Fix: Always pair enquiry with inspection, observation or re-performance.
Describing substantive procedures instead of tests of controls. Fix: Ask whether the procedure checks the control operating or the figure itself. Test the control.
Giving substantive procedures, such as confirming receivables balances, when asked for tests of controls. Fix: Check the verb in the question. If it says tests of controls, every point must relate to how a control operates.
Writing only "enquire of staff" for every control. Fix: Use inspection, observation or re-performance where possible. Add enquiry only as support.
Saying that effective controls mean no substantive procedures are needed. Fix: Say substantive work is reduced, not removed. Material balances and significant risks always need some substantive testing.
Confusing control risk with detection risk. Fix: Control risk belongs to the client's system. Detection risk belongs to the auditor's procedures. Only detection risk is set by the auditor.

Exam tips

Always use the phrase operating effectiveness when defining tests of controls. Examiners look for it.
In a scenario, check the controls first. If they are weak, say the auditor will not rely on them and will use a substantive approach.
In comparison questions, give one clear point on each side: system vs figures, sample over period vs one transaction.
Never write that controls testing replaces substantive work. Write that it reduces it.
For OT cases, read each option for what is actually being tested: a control, a transaction trace or an amount.
Every test you write should name the action and the evidence, for example 'inspect a sample of GRNs for signature'.
Never offer enquiry alone. Add a second technique.
Match the technique to the control: signatures to inspection, live checks to observation, reconciliations to re-performance, automated controls to CAATs.