Testing controls

For each control the auditor identifies in the control activities component — for example controls over significant risks and over journal entries, and any control whose operating effectiveness the auditor plans to test — the auditor first evaluates design and implementation (ISA 315 (Revised 2019) paras 26 and 27; older texts say "controls relevant to the audit"): is the control capable of preventing or detecting a material misstatement, and does it actually exist? A walkthrough — following one transaction through the process with inquiry plus inspection or observation — usually provides this. It does not show the control worked all year.

Tests of operating effectiveness (ISA 330) are needed when the auditor plans to rely on a control to reduce substantive work, or when substantive procedures alone can't provide sufficient appropriate evidence — for example, high-volume revenue processed with no manual intervention. The tests show how the control was applied at relevant times during the period, how consistently, and by whom or by what means.

Procedures: inquiry combined with inspection (signed approvals, review evidence), observation (only shows a point in time) and reperformance (redo the reconciliation or the match). Inquiry alone is never sufficient. Automated controls can often be tested with a single instance per configuration, provided IT general controls are effective.

Sample sizes depend on how often the control operates, the tolerable rate of deviation, the expected rate of deviation and the confidence the auditor needs. Firms publish tables like the one below.

A deviation is any departure from the prescribed control — an approval missing, given late, or given by the wrong person. The sample deviation rate is deviations ÷ items tested. Compare it with the tolerable rate, remembering sampling risk: if the sample was sized on the expectation of no deviations, finding even one usually means the auditor can't conclude the control operated at the planned level. ISA 330.17 requires the auditor to investigate the cause. Responses include testing more items (only sensible if the deviation looks isolated), testing a compensating control, or — most often — not relying on the control and extending substantive procedures. Deficiencies are evaluated under ISA 265; significant deficiencies are communicated in writing to those charged with governance.

Evidence from earlier audits can sometimes be used for unchanged controls, which must then be tested at least once in every third audit (ISA 330.14) — but never for controls that mitigate a significant risk.