Skip to content

Audit and Assurance · Tests of controls

Control Objectives and Testing Methods in Audit

Updated 11 October 2026 · Fact-checked

Tests of controls are audit procedures that check whether a control operated effectively. You start with the control objective, then pick a technique: inspection, observation, enquiry, re-performance or CAATs. Enquiry alone is never enough. Always describe what you do, what you look at and what a failure looks like.

Understand Control Objectives and Testing Methods

A control objective is what a control is meant to achieve, for example that every sale is recorded or that only authorised payments are made. A control is the specific step that delivers that objective, such as a credit limit check or a second signature.

A test of controls gathers evidence that the control worked throughout the period. It is different from a substantive procedure, which checks the figures themselves. You test controls when you plan to rely on them to reduce substantive work, or when substantive procedures alone cannot give enough evidence, for example with highly automated systems.

The main techniques are:

  • Inspection: examine documents or records for evidence the control was done, such as a signature, initials or a system approval.
  • Observation: watch the control being performed, such as a stock count or a goods receipt check. It only proves the control worked at that moment.
  • Enquiry: ask staff how the control works. It is weak evidence by itself and must be backed by other techniques.
  • Re-performance: do the control again yourself, for example recalculate a payroll check or redo a bank reconciliation, and compare your result.
  • CAATs: use software or test data to test automated controls or analyse whole populations.

The link is simple. Each control objective has a control, and each control needs a test that would show if it had failed. If the control leaves no trace, such as a verbal check, you use observation or enquiry. If it leaves a trace, you use inspection or re-performance. If it is automated, you consider CAATs.

Key rules to remember

Objective to control to test
Control objective → control → test of control → conclusion on reliance
Use this chain to structure any answer.
Reliability of techniques
Re-performance and inspection are usually stronger than observation, and observation is stronger than enquiry alone
A guide, not a rule. Strength depends on the control and the circumstances.
Enquiry rule
Enquiry + another technique = adequate evidence
Enquiry alone does not give sufficient appropriate evidence on operating effectiveness.
Result of failed test
Control fails → reduce reliance → increase substantive procedures
State the effect on the audit approach.

How to solve Control Objectives and Testing Methods questions

Use this method for any question asking how to test a control or what procedure fits an objective.

  1. 1Identify the control objective or the control described in the scenario.
  2. 2Decide whether the control leaves evidence (a signature, a report) or is performed without a trace.
  3. 3Choose the technique: inspection for documents, observation for live performance, re-performance for calculations and reconciliations, CAATs for automated controls or large populations.
  4. 4Write the procedure in full: what you select, what you look at and what you check for.
  5. 5Add enquiry only as support, and say what you would corroborate it with.
  6. 6State what a deviation means, such as reduced reliance and more substantive testing.

Quickest way: Control, technique, evidence

When to use it: Use for Section A and OT case questions, and for short Section B or C requirements that ask for tests of controls.

  1. Underline the control in the question.
  2. Ask: can I see a trace of it? If yes, inspect or re-perform. If no, observe.
  3. Reject any option that relies on enquiry alone.
  4. For automated controls, think test data or other CAATs.
  5. In written answers, give the format: Control – Test of control.

Common mistakes in Control Objectives and Testing Methods

  • Relying on enquiry alone as the test.

    It feels like the easiest procedure to write.

    Fix: Always pair enquiry with inspection, observation or re-performance.

  • Describing substantive procedures instead of tests of controls.

    Students confuse testing the control with testing the balance.

    Fix: Ask whether the procedure checks the control operating or the figure itself. Test the control.

  • Writing vague tests such as 'check the control'.

    No specific action is thought through.

    Fix: State what you select, what you look at and what you compare.

  • Assuming observation proves the control worked all year.

    Students forget staff may behave differently when watched.

    Fix: Note that observation only covers the moment watched and combine it with inspection of records.

  • Ignoring what happens if the test fails.

    Answer stops at the procedure.

    Fix: Add that deviations reduce reliance on controls and increase substantive procedures.

Worked examples

Example 1

A company requires a manager to authorise every purchase order above a set limit before it is sent to the supplier. Describe tests of controls the auditor could perform to check this control.

Show the solution
  1. Control objective: only valid, authorised purchases are made.
  2. Inspection: select a sample of purchase orders above the limit and check for evidence of manager authorisation, such as a signature or system approval.
  3. Check that the authoriser had the appropriate authority level.
  4. Re-performance: for orders in the sample, confirm the limit applies and that authorisation was obtained before the order date.
  5. Enquiry: ask staff what happens if the manager is absent, and corroborate the answer by inspecting orders from that period.
  6. If unauthorised orders are found, reduce reliance on the control and extend substantive testing of purchases.

Answer: Inspect a sample of orders above the limit for authorisation, check authority and timing, support with enquiry, and respond to any deviations by reducing reliance and increasing substantive procedures.

Example 2

A client's system automatically blocks a sales order if the customer's balance would exceed its credit limit. Explain how the auditor could test this control.

Show the solution
  1. Control objective: sales are made only to customers within approved credit limits.
  2. This is an automated control, so a CAAT such as test data is suitable.
  3. Prepare test orders that would exceed the credit limit and some that would not, and process them through the system.
  4. Check the system blocks the over-limit orders and accepts the others.
  5. Inspect evidence that credit limits in the master file were approved and that changes to them are controlled.
  6. Consider testing general IT controls over program changes, since the result is only reliable if the program was unchanged during the period.

Answer: Use test data to confirm the system blocks over-limit orders, inspect approval of credit limits, and check IT general controls over changes so the result applies to the whole period.

Exam tips

  • Every test you write should name the action and the evidence, for example 'inspect a sample of GRNs for signature'.
  • Never offer enquiry alone. Add a second technique.
  • Match the technique to the control: signatures to inspection, live checks to observation, reconciliations to re-performance, automated controls to CAATs.
  • In OT questions, eliminate options that test the balance rather than the control.
  • Where marks allow, add the effect of a failed test on the audit approach.

Control Objectives and Testing Methods in other exams

The same ground in other exams, if you are preparing for more than one or want another angle on it.

Control Objectives and Testing Methods: frequently asked questions

What is the difference between a test of controls and a substantive procedure?

A test of controls checks whether a control operated effectively. A substantive procedure checks whether a balance or transaction is materially misstated. You may use both on the same area.

Why is enquiry weak evidence on its own?

It relies on what staff say, which may be inaccurate or biased. You need to corroborate it with inspection, observation or re-performance.

When would I use CAATs to test controls?

Use them when controls are automated or when the volume of data is large. Test data can show whether the system applies a control correctly.

What is the difference between inspection and re-performance?

Inspection examines evidence that a control was done, such as a signature. Re-performance means you carry out the control yourself and compare your result with the client's.