## Extent of Test of Controls — Factors (Mnemonic: FLEER)
The auditor must decide how much TOC to perform. Five factors determine this:
### Factor Table
| # | Factor | Direction |
|---|---|---|
| F | Frequency of control performance by entity | More frequent control → More testing required |
| L | Length of time auditor is relying on the control | Longer reliance period → More testing |
| E | Expected Rate of Deviation from the control | Higher expected deviation → More testing |
| E | Evidence (Reliability) of AE to be obtained about operating effectiveness | Less reliable evidence available → More testing |
| R | Rest of controls (evidence from other controls) | If other controls provide corroborating evidence → Less testing needed |
### Using Audit Evidence from a Previous Audit
An auditor may use evidence obtained in a prior year's audit for TOC — but must consider:
1. ROMM and extent of reliance — higher risk requires fresh testing
2. Risk from characteristics of the control — e.g., manual controls are more prone to human error
3. Risk of lack of change — has the control changed since last tested?
4. Nature and extent of deviations noted in the previous audit
5. Personnel changes — who operates the control matters
> Key Rule: The auditor must test controls at least once every 3 years even if prior audit evidence is relied upon.
### General IT Controls
When relying on automated controls, the auditor must also consider the risk arising from General IT Controls (e.g., access controls, change management controls), since automated controls are only reliable if the IT environment they run in is reliable.