Substantive testing

Substantive procedures are designed to detect material misstatement at the assertion level. ISA 330 requires some substantive procedures for every material class of transactions, account balance and disclosure. There are two kinds.

Substantive analytical procedures (ISA 520) work best for large volumes of predictable transactions. The four steps: 1. Develop an expectation precise enough to identify a misstatement — from independent, reliable data (member numbers, room nights, headcount, contract prices), disaggregated where possible (by month, product, location). 2. Set a threshold — the difference that can be accepted without further investigation, linked to performance materiality and the assurance needed. 3. Compare the recorded amount with the expectation. 4. Investigate differences above the threshold: inquire of management and corroborate the answer with evidence. An unexplained difference is a potential misstatement.

The precision of the expectation is everything: a crude expectation produces false alarms and, worse, can hide real misstatements.

Tests of detail examine individual items. For revenue: vouch recorded sales to orders, contracts and proof of delivery (occurrence); trace dispatch records into the sales ledger (completeness); test cut-off by examining dispatches and invoices either side of the year end and credit notes issued after it. Under IFRS 15, revenue is recognised when control transfers, so delivery terms matter.

For receivables: external confirmations (ISA 505) give strong evidence of existence. The auditor controls the process — selects the balances, checks the addresses and contacts, sends the requests and receives replies directly. Non-responses need alternative procedures, such as testing cash received after year end or inspecting signed delivery evidence. Exceptions are investigated: some are timing differences (cash or goods in transit); others are misstatements. Valuation is tested separately — aging, post-year-end receipts, disputes and credit-loss estimates.

If management refuses to let the auditor send a confirmation, ISA 505 requires the auditor to ask why, look for evidence about whether the reason is valid and reasonable, consider the effect on the risk assessment (including fraud risk) and perform alternative procedures. If the refusal is unreasonable or alternatives can't provide sufficient evidence, the auditor communicates with those charged with governance and considers the effect on the opinion.