Test of Controls in Audit: Tips & Best Practices
Testing controls is a critical step in any audit engagement. Before an auditor can rely on an organization's internal controls to reduce substantive testing, those controls must be evaluated for design effectiveness and operating effectiveness. A well-executed test of controls saves time, focuses resources on genuine risk areas, and strengthens the overall audit opinion.
What is a Test of Controls?
A test of controls is an audit procedure designed to evaluate whether an internal control is operating effectively over a given period. Unlike substantive procedures, which focus on detecting material misstatements in account balances or transactions, tests of controls assess the reliability of the processes that prevent or detect those misstatements in the first place.
For example, if a company requires managerial approval on all purchase orders above a certain threshold, the auditor would test whether that approval was consistently obtained during the audit period. If the control is effective, the auditor gains assurance that related financial statement assertions are less likely to contain errors.
When to Perform Tests of Controls
Auditors perform tests of controls when they plan to rely on internal controls to reduce the nature, timing, or extent of substantive testing. This decision is made during the planning phase after the auditor gains an understanding of the entity's internal control environment.
If controls appear well-designed and the auditor believes they are likely operating effectively, testing those controls can be more efficient than performing extensive substantive procedures. However, if the control environment is weak or controls are poorly designed, the auditor may skip control testing altogether and proceed directly to substantive testing.
Common Types of Tests
Inquiry involves asking personnel responsible for performing or monitoring a control about how it operates. While inquiry alone is rarely sufficient, it provides useful context when combined with other procedures.
Observation requires the auditor to watch a control being performed in real time. This is effective for controls that leave no documentary evidence, such as segregation of duties, but it only provides evidence for the specific moment observed.
Inspection involves examining documents, reports, or records for evidence that a control was performed. Reviewing signed approvals, reconciliation sign-offs, or exception reports are all examples of inspection.
Reperformance is the most rigorous method. The auditor independently executes the control procedure to verify that it produces the expected result. Reperforming a bank reconciliation or recalculating an automated system output are common examples.
Best Practices for Effective Control Testing
Define the control precisely. Before testing, document exactly what the control is supposed to do, who performs it, how frequently it operates, and what evidence it produces. Ambiguity at this stage leads to wasted effort.
Select appropriate sample sizes. The frequency of the control dictates the sample size. A daily control requires a larger sample than a quarterly one. Auditing standards provide guidance on minimum sample sizes based on the desired level of assurance.
Document deviations carefully. When a control does not operate as expected, record the nature of the deviation, its potential impact, and whether it represents an isolated incident or a systemic failure. A single deviation in a large sample may not undermine reliance on the control, but a pattern of deviations will.
Coordinate with the client early. Request supporting documentation well in advance. Delays in receiving evidence are one of the most common causes of audit timeline overruns.
Leverage technology. Manual control testing is time-consuming. Tools that automate document matching, extraction, and comparison can dramatically reduce the hours spent on inspection and reperformance procedures.
Linking Control Testing to Audit Risk
The results of control testing directly influence the auditor's assessment of control risk. When controls operate effectively, control risk decreases, allowing the auditor to reduce the extent of substantive procedures. When controls fail, the auditor must compensate by expanding substantive testing to maintain an acceptably low level of audit risk.
This relationship underscores why control testing is not a checkbox exercise. It is a strategic decision that shapes the entire audit approach.
Speed up your control testing with Blast Audit — the Excel add-in that automates document matching and extraction for auditors.