Test of Controls in Audit: A Practical Guide

A test of controls gives you evidence that a control operated effectively throughout the period you want to rely on it. If it did, you can reduce the substantive work on the balances that control protects. If it did not, you are back to substantive testing, usually more of it.

This guide covers when you have to test controls, how to design the test, how many items to pick, and what to do when you find a deviation.

Where it sits in the standards

• AICPA (private companies): AU-C 330, Performing Audit Procedures in Response to Assessed Risks.
• PCAOB (public companies): AS 2301 for the financial statement audit, and AS 2201 for integrated audits of internal control.
• International and Canada: ISA 330 and CAS 330, which match AU-C 330 closely.

The wording differs, but the logic is the same in all of them.

When a test of controls is required

You test operating effectiveness when either of these is true:

1. You plan to rely on the control. Your risk assessment assumes the control works, and you are reducing substantive procedures because of it.
2. Substantive procedures alone cannot give enough evidence. This happens with high-volume transactions processed automatically with little manual paper trail, such as e-commerce revenue or payroll run through a system.

If neither applies, you can take a fully substantive approach. You still have to understand the controls relevant to the audit and check they have been implemented (AU-C 315), but you do not test whether they operated all year.

Design, implementation and operating effectiveness

These three get mixed up often.

Question	How you answer it	Is it a test of controls?
Is the control designed to prevent or detect the misstatement?	Inquiry and judgment about the control as described	No
Was it implemented, does it exist and is it in use?	A walkthrough of one transaction, observation	No
Did it operate effectively all period?	Inspection, reperformance and observation over a sample	Yes

A walkthrough shows the control is in place on the day you look. It does not tell you it worked in March, July and November.

Procedures you can use

• Inquiry: ask who performs the control and how. Inquiry alone is never enough evidence of operating effectiveness.
• Observation: watch the control happen. Good for controls that leave no trail, but it only covers the moment you watched.
• Inspection: look at the evidence the control leaves, such as a signed reconciliation, an approval in the system or a review sign-off with comments.
• Reperformance: do the control yourself and compare. The strongest evidence, and the most work.

Most tests combine inquiry with inspection or reperformance.

Step 1: define the control and its attributes

Write the control so it can be tested: who does what, how often, using what, to prevent or detect which misstatement.

Then list the attributes: the specific things that must be true for one instance of the control to count as performed correctly. Each attribute is tested for every sample item.

Example control: "The AP clerk matches each vendor invoice to an approved purchase order and a receiving report before the invoice is entered for payment. Differences over $500 go to the controller for approval."

Attributes:

1. A purchase order exists and was approved before the invoice date.
2. A receiving report exists for the goods or services.
3. Quantities and prices on the invoice agree with the PO and receiving report, or the difference is under $500.
4. Differences over $500 carry the controller's approval.
5. The match was done before payment.

Step 2: decide the sample size

Sample size depends on how often the control runs, how much you rely on it, and how many deviations you expect.

Many firms use a frequency table like this for manual controls you plan to rely on:

How often the control runs	Typical sample size
Annually	1
Quarterly	2
Monthly	2 to 5
Weekly	5 to 15
Daily	20 to 40
Many times a day	25 to 60

Use the higher end when you rely on the control heavily or when it addresses a significant risk.

For statistical sampling, the AICPA Audit Sampling guide gives sizes based on confidence, tolerable deviation rate and expected deviation rate. Two common ones: with zero expected deviations and a 5% tolerable rate, the sample is 59 items at 95% confidence and 45 items at 90% confidence.

Automated controls are different. An application control works the same way every time unless someone changes it. You can usually test one instance, provided the IT general controls over change management and access are effective.

Step 3: pick the sample across the period

Select items from the whole period you rely on, not just the months you were on site. If you test at an interim date, you need evidence for the remaining period too: a roll-forward of inquiries and a few more items, or reliance on how stable the process was.

Step 4: test and document each attribute

Use one row per sample item and one column per attribute. Record the document you inspected and where it is, not just a tickmark. A reviewer should be able to pick any row and see what you saw.

Step 5: evaluate deviations

A deviation is any sample item where an attribute was not met. When you find one:

1. Find out why. A one-off by a temporary employee is different from "we stopped doing that in June."
2. Do not just add more items to dilute the result. If you planned for zero deviations, one deviation usually means the control cannot be relied on at the planned level.
3. Decide the effect. Either the control is not effective and you increase substantive testing for the related assertions, or you have a justified basis that the deviation is isolated, and you document that basis.
4. Communicate. Significant deficiencies and material weaknesses go to those charged with governance in writing (AU-C 265).

Using evidence from prior years

Under AU-C 330 and ISA 330, if a control has not changed since you last tested it, you may rely on prior-year evidence. You must still confirm it has not changed, and you must retest it at least once every third year. This does not apply to controls over significant risks: those are tested every year.

Common mistakes

• Testing the walkthrough transaction and calling it a test of operating effectiveness.
• Attributes that only check a signature exists, not that the reviewer actually reviewed anything.
• Sampling only from the months you were on site.
• Writing "no exceptions noted" without saying what was inspected.
• Treating a deviation as a substantive misstatement. A control can fail with no misstatement in the sample, and the control is still not effective.

How this connects to substantive work

When controls test clean, you can often reduce the size of your substantive tests, but never to zero for material balances. When they fail, the substantive work grows. Either way, the working papers need to show the link between the controls conclusion and the substantive plan.

Warp runs controls testing on the samples you give it: each attribute is checked against the evidence, and every result links to the page it came from, so your reviewer checks the conclusion instead of re-doing the inspection. See controls testing in Warp.