Audit and Assurance · Tests of controls

Tests of Controls for Sales, Purchases and Payroll Cycles

Updated 11 October 2026 · Fact-checked

A test of controls is an audit procedure that checks whether a control operated effectively during the period. For each cycle, name the control, then state what you will inspect, re-perform, observe or enquire about. Link each test to the control, not to the balance. Examiners reward specific, actionable tests.

Understand Tests of Controls for Sales, Purchases and Payroll Cycles

Auditors test controls when they plan to rely on them to reduce substantive work, or when substantive procedures alone cannot give enough evidence. A test of controls checks that a control was operating effectively throughout the period. It is different from a substantive procedure, which checks the balance or transaction itself.

The key skill in the exam is turning a control into a test. Start with the control, such as "a goods despatched note is matched to the sales order before invoicing". Then ask: what evidence shows this happened? The answer is usually a document with a signature or a system record, or something you can watch or repeat.

There are four main methods. Inspection means looking at documents for evidence of a control, such as a signature or a tick. Observation means watching a control being performed, such as an inventory count. Re-performance means doing the control yourself, such as recalculating a payroll figure or redoing a bank reconciliation. Enquiry means asking staff how the control works. Enquiry alone is weak evidence. Combine it with another method.

Each business cycle has its own typical controls. Sales: credit checks, order authorisation, despatch matching, sequence checks and price control. Purchases: authorised orders, goods received notes (GRNs), three-way matching and approval for payment. Payroll: authorised starters and leavers, approved overtime, and segregated preparation and payment. Inventory: regular counts, restricted access and reconciliation to records. Cash: bank reconciliations, dual signatories and separate cash handling and recording.

If tests show controls work, you can reduce substantive testing. If they show failures, you cannot rely on the controls. You then carry out more substantive procedures and may report the deficiencies to management.

Key rules to remember

Test of control structure: Control → Method (inspect / observe / re-perform / enquire) → Evidence sought; Write each test in this order so it links directly to a named control.
Purpose of tests of controls: Effective controls → lower control risk → less substantive testing; If controls fail, control risk is higher and more substantive work is needed.
Three-way match: Purchase order = goods received note = supplier invoice; The core purchases control. Test by inspecting documents for evidence of matching.
Test versus procedure: Tests of controls check HOW a system operates; substantive procedures check WHAT the balance is; Do not give substantive tests when the question asks for tests of controls.

How to solve Tests of Controls for Sales, Purchases and Payroll Cycles questions

Use this method for any scenario asking for tests of controls in a given cycle.

1Identify the cycle in the scenario: sales, purchases, inventory, payroll or cash.
2List the controls the scenario describes. Use only controls that are stated or clearly implied.
3For each control, decide the best method: inspect, observe, re-perform or enquire.
4Write each test as an action: "Inspect a sample of sales orders for evidence of credit approval". Say what you look for.
5Name the sample or scope where useful, such as "a sample of 25 invoices" or "for all starters in the year".
6Do not add substantive tests or recommendations unless the question asks for them.
7Keep the number of points equal to the marks available. Aim for about one point per mark.

Quickest way: Control-to-test conversion

When to use it: Use when time is short and the question lists controls or a system description.

Underline each control in the scenario.
Start each answer line with a verb: inspect, observe, re-perform, enquire.
Add the evidence you expect: signature, stamp, sequence number, matching document.
Move to the next control. Stop when you have enough points for the marks.

Common mistakes in Tests of Controls for Sales, Purchases and Payroll Cycles

Giving substantive procedures, such as confirming receivables balances, when asked for tests of controls.
Students recall familiar audit procedures for the cycle without reading the question carefully.
Fix: Check the verb in the question. If it says tests of controls, every point must relate to how a control operates.
Writing only "enquire of staff" for every control.
Enquiry is quick to write and feels safe.
Fix: Use inspection, observation or re-performance where possible. Add enquiry only as support.
Describing the control but not the test.
Students restate what the system does instead of how the auditor checks it.
Fix: Begin each point with an auditor action and say what evidence you expect to see.
Writing vague tests like "check payroll is correct".
Students do not break the control into a testable step.
Fix: Be specific: "Re-perform the calculation of gross to net pay for a sample of employees and agree to the payroll record".
Testing controls that do not exist in the scenario.
Students recite a textbook list instead of using the facts given.
Fix: Anchor each test to a control in the scenario. If a control is missing, that is a deficiency to report, not a test to perform.
Forgetting that failed tests change the audit approach.
Students stop at the test and do not link it to the audit plan.
Fix: When asked about results, say control risk is higher and more substantive procedures are required.

Worked examples

Example 1

Moreton Ltd sells goods on credit. Its controls are: (1) new customers are credit-checked and a credit limit is approved by the credit controller before the first order is accepted; (2) a goods despatched note (GDN) is raised for each despatch and matched to the sales order before an invoice is raised; (3) invoices are sequentially numbered and the sequence is checked monthly. Describe tests of controls the auditor could perform. (6 marks)

Show the solution

Control 1 is credit approval. The evidence is a signed approval, so inspect.
Control 2 is matching of GDN to order. The evidence is a document with a matching mark, so inspect and re-perform.
Control 3 is the sequence check. The evidence is the monthly review record, so inspect and re-perform.
Add an enquiry or observation point only if marks remain.

Answer: - Select a sample of new customers and inspect the file for evidence of a credit check and a credit limit signed by the credit controller. - Inspect a sample of sales invoices and agree each to a GDN and a sales order, checking for evidence the match was performed. - Re-perform the match for the sample, agreeing quantities and prices across the order, GDN and invoice. - Inspect the monthly sequence check records for evidence that they were completed and signed. - Re-perform the sequence check for a sample of months, looking for gaps or duplicates and checking that exceptions were followed up. - Enquire of the credit controller how limits are set and how exceeding a limit is dealt with.

Example 2

Harlow Ltd has these payroll controls: (1) new employees are added to the payroll only on a form signed by the HR manager; (2) overtime is authorised by line managers before payroll processing; (3) the payroll is approved by the finance director before the bank payment run. Describe tests of controls the auditor could perform. (6 marks)

Show the solution

Control 1 is the authorisation of starters. Inspect starter forms and agree them to the payroll.
Control 2 is overtime approval. Inspect authorised overtime records and agree them to payroll.
Control 3 is the finance director's approval. Inspect for a signature before payment.
Add re-performance of a calculation and an observation of the payment run if marks remain.

Answer: - Select a sample of new employees from the payroll and inspect the personnel file for a starter form signed by the HR manager. - Select a sample of employees paid overtime and inspect the overtime sheet for the line manager's authorisation. - Re-perform the overtime pay calculation for the sample and agree it to the amount paid in the payroll. - For a sample of months, inspect the payroll summary for the finance director's signature and check that it is dated before the bank payment run. - Observe the payroll payment run and confirm that approval is obtained before payments are released. - Enquire of HR how leavers are notified to payroll to confirm that the process works.

Exam tips

Read the scenario and tie every test to a control it describes. Generic lists score poorly.
Start each point with an action verb. Examiners look for what the auditor does.
Match the number of points to the marks. Do not write long explanations for a one-mark point.
If the question asks for substantive procedures, do not give tests of controls. Check which one is wanted before writing.
In objective questions, look for the answer that describes an auditor action on a control rather than on a balance.

Tests of Controls for Sales, Purchases and Payroll Cycles in other exams

The same ground in other exams, if you are preparing for more than one or want another angle on it.

ACCA Applied KnowledgeSales Tax (VAT) on Sales and Purchases

Tests of Controls for Sales, Purchases and Payroll Cycles: frequently asked questions

What is the difference between a test of controls and a substantive procedure?

A test of controls checks whether a control worked during the period. A substantive procedure checks the actual balance or transaction. For example, inspecting a signature on an order checks a control, while confirming a receivable balance is substantive.

How do I write a test of controls in the AA exam?

Name the control, state the method such as inspect or re-perform, and say what evidence you expect to see. Keep it specific and linked to the scenario. One clear action per mark works well.

Is enquiry enough as a test of controls?

No. Enquiry alone does not give sufficient evidence about whether a control operated. Combine it with inspection, observation or re-performance.

What happens if tests of controls fail?

The auditor cannot rely on the controls, so control risk is assessed as higher. More substantive procedures are needed. The deficiencies may also be reported to management or those charged with governance.