## Evaluating Operating Effectiveness of Controls

At the conclusion of TOC, the auditor evaluates whether the internal controls are operating effectively. The interaction between substantive procedure findings and this evaluation follows specific rules:

### Three Key Evaluation Scenarios

**Scenario ①: Substantive procedures identify a misstatement**

→ This indicates the related controls are NOT operating effectively, even if TOC showed no deviations. A misstatement in the books is evidence that something in the control system failed.

**Scenario ②: Substantive procedures do not identify a misstatement**

→ The absence of misstatement does NOT prove controls are operating effectively. Controls might be weak, but luck or other factors could mean no misstatement occurred in the sampled period.

Scenario ③: A material misstatement is detected AND a significant deficiency in Internal Control is identified

→ The auditor must communicate this significant deficiency to those charged with governance (TCWG), as required under SA 265.

---

### Key Principle

> Controls can fail without producing a detectable misstatement (in a given period), and misstatements can be absent even with weak controls. Evaluation must not equate outcome with process quality.

### Summary Table

Finding	Inference about controls
Misstatement found by substantive procedures	Controls NOT operating effectively
No misstatement found by substantive procedures	Cannot conclude controls are operating effectively
Material misstatement + significant IC deficiency	Must report to TCWG

Worked example

### Example 1

Scenario ① Example: The auditor's substantive testing reveals that ₹2 lakh of revenue was recorded in the wrong period. Even if TOC showed all review controls were applied, this misstatement is evidence that the period-end cut-off control failed in practice.

### Example 2

Scenario ② Example: The auditor tests all 50 trade receivable balances and finds no overstatement. This does not prove the accounts receivable confirmation/review control is operating effectively — the control may be weak, but no misstatement happened to occur in this sample.

⚠️ Common exam mistakes

Concluding controls are effective simply because no misstatement was found during substantive procedures — this is explicitly incorrect under SA 330.
Failing to report a significant deficiency in internal control to those charged with governance when both a material misstatement and IC deficiency are found simultaneously.
Using the word 'effective' loosely — 'operating effectively' means the control prevents or detects material misstatements as designed, not just that it exists or was sometimes applied.

Reference: Para 16 — SA 330 — The Auditor's Responses to Assessed Risks

Now that you've read this — what's next?

Move from understanding → mastery in 3 clicks. Each option below picks up from this lesson's topic.

🔥 Drill 5 Qs on this → ✍️ Adaptive practice →