All 18 Internal Controls Evaluation questions
More in Internal Controls Evaluation
How does the auditor obtain an understanding of internal control? What is the difference between design effectiveness and operating effectiveness? What are entity-level controls versus process-level (transaction) controls? What is the difference between manual and automated controls? How do you document the understanding of internal controls? What are compensating controls and how do they affect the audit? What is the difference between a deficiency, a significant deficiency, and a material weakness? What are IT general controls (ITGCs) and why do they matter? How does management override of controls create risk, and how do auditors address it? How do you evaluate controls in a system that uses a service organization (SOC reports)?
Advertisement
Auditing & Assurance › Internal Controls Evaluation

When does the auditor decide to test controls versus take a fully substantive approach?

Intermediate

Answer

The auditor tests controls when they intend to rely on them to reduce substantive work and when controls are expected to be effective, or when substantive procedures alone can't provide sufficient evidence (e.g., highly automated, paperless processes). A fully substantive approach is used when controls are weak, absent, or testing them is inefficient relative to substantive testing.
Real-world example For a paperless e-commerce revenue stream, the auditor must test automated controls because substantive testing alone is impractical.

Common follow-ups: When is a substantive-only approach not enough? | Why test controls to reduce substantive work?

Audit Evidence & Procedures Audit Risk & Materiality Internal Controls Evaluation
All 18 Internal Controls Evaluation questions