A test of controls is an audit procedure designed to evaluate the operating effectiveness of controls in preventing, or detecting and correcting, material misstatements at the assertion level (AICPA, AU-C 330, .04). Operating effectiveness means the control was applied the way it was meant to be, by someone able to apply it, across the period the auditor cares about. An assertion is one of management’s representations about a class of transactions, an account balance or a disclosure, so testing at the assertion level means asking whether the control held for a specific claim, such as whether recorded sales occurred.
When an Auditor Has to Test Controls
Two conditions trigger the testing, and either one alone is enough. The auditor should design and perform tests of controls if the risk assessment at the relevant assertion level includes an expectation that the controls are operating effectively, or if substantive procedures alone cannot provide sufficient appropriate audit evidence at that level (AU-C 330, .08). The clearest case behind the second condition is an entity that conducts its business using IT with no documentation of transactions produced or maintained outside the IT system (AU-C 330, .A25), which leaves a substantive procedure nothing to inspect on its own.
Reliance sets the bar. The auditor obtains more persuasive evidence the greater the reliance placed on a control, and where the auditor intends to rely on controls over a risk already judged a significant risk, the operating effectiveness of those controls has to be tested in the current period rather than carried forward (AU-C 330, .09 and .15). Which controls come into scope at all is decided during risk assessment, covered in audit challenges in accounting.
Design Effectiveness Versus Operating Effectiveness
This is the distinction the term gets tangled with most often. Tests of controls are performed only on controls the auditor has already determined are suitably designed, and testing operating effectiveness is a different exercise from understanding and evaluating design and implementation, even though the same types of procedures serve both (AU-C 330, .A21 and .A22). A well designed control that nobody performed in August is a design pass and an operating failure.
Asking is never the whole procedure. The auditor performs other procedures in combination with inquiry, covering how the controls were applied at relevant times, the consistency with which they were applied, and by whom or by what means, including whether that person had the authority and competence to perform the control effectively; inquiry alone is not sufficient (AU-C 330, .10 and .A28). Public company work splits the same pair explicitly. Design effectiveness asks whether the controls, if operated as prescribed by people possessing the necessary authority and competence, satisfy the control objectives and can effectively prevent or detect errors or fraud that could result in material misstatements. Operating effectiveness asks whether the control is operating as designed and whether the person performing it possesses that same authority and competence (PCAOB, AS 2201, .42 and .44).
Timing and Evidence From a Prior Period
Controls are tested for the particular time or throughout the period the auditor intends to rely on them, and evidence gathered at an interim date obliges the auditor to look for significant changes since then and decide what the remaining period still needs (AU-C 330, .11 and .12).
Evidence from earlier audits has a hard limit. Inquiry combined with observation or inspection has to confirm the understanding of those controls first, changes send them back for testing in the current audit, and where nothing changed they are still tested at least once in every third audit, with some tested in every audit (AU-C 330, .14).
Tests of Controls Versus Substantive Procedures
The separator is what each one asks: a test of controls asks whether the control worked, a substantive procedure asks whether the amount is right, and vouching names one direction the substantive half can run in. Neither substitutes for the other. A clean substantive result proves nothing about the control, because the absence of detected misstatements is not audit evidence that the related controls are effective, and deviations found in control testing send the auditor back to decide whether more control testing or a substantive response is needed (AU-C 330, .16 and .17). Working controls buy no exemption from substantive work either, as the audit level of service sets out.
Whether the testing happens at all depends on the engagement. Generally accepted auditing standards govern audits of non-issuers, meaning entities outside the public company regime, and there the testing is conditional on the two situations above, except where a governmental audit requirement calls for tests of controls even when reliance is not planned (AU-C 330, .A18). A public company integrated audit puts the auditor’s opinion on internal control itself, so the testing serves that opinion and the control risk assessments together (PCAOB, AS 2201, .03 and .07).
Where the Testing Sits in a Firm’s Work
It is engagement work and it belongs to the audit team. The engagement partner takes responsibility for the direction and supervision of the engagement team and the review of their work, so an associate can run the procedure while the judgment about whether the evidence supports reliance stays above them (AU-C 220, .29). Where the client’s own internal auditors provide direct assistance, a boundary drawn in outsourced audit support, the external auditor’s review of that work has to include testing some of it (AU-C 610, .31). Independence narrows it further when the same firm also performs internal audit services touching the client’s internal accounting controls, which internal audit co-sourcing works through.
Two neighboring things get mistaken for a firm’s own control testing. An audit trail is a property of the client’s own records that exists whether anyone audits them or not, while a test of controls is a procedure an auditor performs on a control. A type 2 report on a service organization carries a service auditor’s opinion on operating effectiveness over a stated period that a user auditor may take evidence from, which is the service auditor’s testing rather than the user auditor’s own, compared in SOC 1 vs SOC 2.
Common Questions
Inspecting approved purchase orders for the approver’s sign off, observing a month end close review as it happens, reperforming a bank reconciliation the client already performed, and recalculating a system generated aging. Each is paired with inquiry rather than replacing it.
The familiar four are the set AS 2201 names for public company work, where the procedures for testing operating effectiveness include a mix of inquiry of appropriate personnel, observation of the company’s operations, inspection of relevant documentation and reperformance of the control (PCAOB, AS 2201, .45). It is not a closed set. Under generally accepted auditing standards the requirement is other procedures in combination with inquiry, and recalculation is named alongside inspection and reperformance as a pairing that can carry more assurance than inquiry and observation, because an observation is pertinent only at the moment it is made (AU-C 330, .A28).
Accountably places trained offshore accountants and tax preparers inside US CPA and EA firms, and a firm can put a block of its own bookkeeping and tax preparation through a trial task to free its own reviewers for engagement work like this.
