Audit and Assurance · The use and evaluation of systems of internal control by auditors

Tests of Controls and Substantive Procedures in ACCA Audit and Assurance

Updated 11 October 2026 · Fact-checked

Tests of controls check whether a control operated effectively throughout the period. Substantive procedures check whether transactions, balances and disclosures are free from material misstatement. If controls test well, the auditor can reduce substantive work. If they fail, the auditor typically does more substantive work, often at or after the year end and on larger samples.

Understand Tests of Controls and Substantive Procedures

An auditor must gather enough appropriate evidence to support the opinion. There are two broad ways to do this. One is to test the controls the client uses to prevent or detect errors. The other is to test the numbers directly.

Tests of controls ask: did the control work, every time, all year? Examples are inspecting evidence of authorisation, re-performing a bank reconciliation, observing a goods inwards check, and enquiring of staff (enquiry alone is never enough). They are done only where the auditor plans to rely on controls, or where substantive procedures alone cannot give enough evidence (for example, with highly automated systems).

Substantive procedures ask: is the balance or transaction right? They are of two types: tests of detail (for example, agreeing a sample of receivables to after-date cash receipts) and substantive analytical procedures (for example, comparing payroll cost to headcount trends).

The two approaches link through risk. The auditor assesses the risk of material misstatement, then decides on the approach. A controls-based approach relies on controls and does less substantive testing. A substantive approach does not rely on controls and tests more heavily. Most audits combine both. Substantive procedures are always needed for material balances, whatever the controls look like, because controls can reduce risk but never remove it.

The test results change the nature (which type of procedure), timing (interim or year end) and extent (sample size) of substantive work. Effective controls allow lighter, earlier, smaller tests. Ineffective controls mean heavier, later and larger tests, and possibly a report to management on the deficiencies.

Key rules to remember

Controls effective: Controls operate effectively → lower control risk → higher detection risk acceptable → less substantive work; Detection risk is the part of audit risk the auditor controls through substantive work. Higher acceptable detection risk means fewer or lighter substantive procedures.
Controls ineffective: Controls fail → higher control risk → lower detection risk required → more substantive work; Do more, larger and later tests, nearer the year end.
Audit risk model: Audit risk = Risk of material misstatement × Detection risk; Risk of material misstatement = inherent risk × control risk. Used as a conceptual model, not a calculation.
Effect on substantive work: Nature, timing and extent; Use these three words to structure any answer on how control test results change the audit.
Two types of substantive procedure: Substantive procedures = tests of detail + substantive analytical procedures; Tests of controls are not substantive procedures.

How to solve Tests of Controls and Substantive Procedures questions

Use this method for any question asking you to describe tests of controls, distinguish the approaches, or explain the effect of results.

1Identify the area or cycle in the scenario (sales, purchases, payroll, inventory) and the assertion at risk.
2Name the control and what it is meant to prevent or detect, for example credit limit approval preventing irrecoverable sales.
3State the test of control: inspect, re-perform, observe or use CAATs. Say what evidence you expect to see and over what period.
4If asked for substantive procedures, give a test of detail or analytical procedure that checks the balance itself, not the control.
5Link the result to the approach: if the control works, reduce substantive work; if it fails, increase it.
6Structure the effect as nature, timing and extent, and give a specific change for each.
7Add a reporting point where relevant: communicate deficiencies to management or those charged with governance.

Quickest way: Control or number? The one-line test

When to use it: In Section A and B objective questions that ask you to classify a procedure or choose the effect of a result.

Ask: is the procedure checking how the system works, or checking an amount? How it works means test of control. An amount means substantive.
Look for words: authorised, approved, reconciled, signed, segregation, sequence checks point to controls. Agree to, recalculate, confirm, cut-off, count point to substantive.
For effect questions: good controls mean less, earlier, smaller substantive work. Poor controls mean more, later, larger.
Eliminate options that say controls remove the need for all substantive work. That is never correct for material items.

Common mistakes in Tests of Controls and Substantive Procedures

Calling a test of detail a test of controls because it uses a sample of transactions.
Both use samples of documents, so they look similar.
Fix: Ask what the sample proves. If it proves the control operated, it is a test of controls. If it proves the amount is right, it is substantive.
Saying enquiry alone is a sufficient test of controls.
Enquiry is easy to write and sounds sensible.
Fix: Combine enquiry with inspection, observation or re-performance. Enquiry on its own does not give enough evidence.
Stating that effective controls mean no substantive procedures are needed.
Students over-simplify the controls-based approach.
Fix: Say substantive work is reduced, not removed. Material balances and significant risks always need substantive procedures.
Reversing the effect of poor controls and reducing the substantive sample.
Confusing control risk with detection risk.
Fix: Remember: control risk up means detection risk must go down, so more substantive work.
Listing tests of controls without saying what the control is.
Rushing to procedures without linking them to the scenario.
Fix: Start each point with the control, then the test, for example: sales orders are approved by a manager, so inspect a sample of orders for signatures.
Ignoring timing and extent when asked about the effect on the audit.
Focusing only on the nature of procedures.
Fix: Use the nature, timing and extent headings every time, with one concrete change under each.

Worked examples

Example 1

You are auditing Kora Ltd, a wholesaler. Management says all customer orders over $5,000 are approved by the sales director before dispatch. Describe tests of controls the auditor could perform, and one substantive procedure on the same area. (5 marks)

Show the solution

Identify the control: sales director approval of orders over $5,000 before dispatch. The risk is unauthorised sales and sales to customers who may not pay. This affects occurrence of sales and valuation of receivables.
Test of control 1: select a sample of orders over $5,000 from across the year and inspect each for the sales director's signature or system approval, before the dispatch date.
Test of control 2: re-perform the approval check on a sample of orders. Re-check the order value and the customer details against the approval criteria that management says apply, to confirm the approval was appropriate. Do not assume a credit-limit check unless management says one is part of the control.
Test of control 3: enquire of the sales director and staff how approval works, and observe a dispatch to see whether goods leave without approval. This supports, not replaces, the inspection.
Substantive procedure: select a sample of year-end receivable balances and agree them to after-date cash receipts, or send receivables confirmations. This checks the amount, not the control.

Answer: Tests of controls: inspect sample orders over $5,000 for approval evidence before dispatch, re-perform the approval checks on a sample against the criteria, and enquire and observe. Substantive: agree year-end receivables to after-date cash receipts or confirmations.

Exam tips

Always tie a test to a named control from the scenario. Generic lists of procedures score poorly.
If a question says 'substantive', do not describe control testing, and the reverse. Mixing them is the commonest way to lose marks.
For effect-of-results questions, use the headings nature, timing and extent and give one point under each.
In objective questions, watch for absolute words such as 'no need for' or 'eliminates'. These options are usually wrong.
In constructed answers, add a short comment on reporting deficiencies when tests of controls fail.

Tests of Controls and Substantive Procedures: frequently asked questions

What is the difference between tests of controls and substantive procedures?

Tests of controls check that a control operated effectively during the period. Substantive procedures check that transactions, balances and disclosures are materially correct. The first assesses the system; the second assesses the numbers.

Can an auditor rely only on tests of controls?

No. Controls reduce risk but cannot remove it. Substantive procedures are still needed for material balances and significant risks, even when controls are tested as effective.

When must an auditor perform tests of controls?

When the auditor plans to rely on controls to reduce substantive work, or when substantive procedures alone cannot give sufficient appropriate evidence. The second case often arises with highly automated systems.

What happens if tests of controls fail?

Control risk is assessed as higher, so the auditor does more substantive work: different or more direct procedures, nearer the year end and with larger samples. The deficiencies should also be communicated to management.