## Tests of Controls (SA 330)

### When Must the Auditor Test Controls?

The auditor must design and perform tests of controls when either of two conditions is met:

Condition	Trigger
A — Planned reliance	Risk assessment includes an expectation that controls are operating effectively, i.e., the auditor intends to rely on controls to reduce substantive work
B — Substantive procedures alone are insufficient	Substantive procedures alone cannot provide sufficient appropriate audit evidence at the assertion level

> Key insight: Condition B is non-negotiable — even if the auditor didn't plan to rely on controls, if substantive alone can't work, controls must be tested.

---

### Nature of Tests of Controls

When designing tests of controls, the auditor must address three dimensions:

1. What to investigate:

How the control was applied at relevant times
Consistency of application throughout the period
Who or what applied the control (person vs. system)

2. Indirect controls: Determine if the control under test depends on another control (an indirect control). If so, test the indirect control too.

3. Audit procedure mix:

Inquiry alone is never sufficient — always combine with another procedure
Inquiry + Inspection/Reperformance > Inquiry + Observation
Observation is pertinent only at the moment it is made
If effectiveness is documented → inspect the documentation
If more persuasive evidence is needed → increase extent of testing

---

### Extent of Tests of Controls

Factors that determine how much testing is required:

1. Frequency of control performance during the period

2. Length of time the auditor is relying on the control's effectiveness

3. Expected rate of deviation from the control

4. Relevance and reliability of evidence about operating effectiveness at the assertion level

5. Extent of evidence already obtained from tests of other related controls

---

### Timing of Tests of Controls

Scenario	Approach
Point-in-time control (e.g., physical inventory count at period-end)	Evidence pertaining to that specific point may be sufficient
Control relied upon across a period	Tests must cover relevant times throughout the period

---

### Using Prior-Audit Evidence

Evidence from previous audits may be used, but the auditor must consider six factors before doing so:

1. Effectiveness of other internal control elements (control environment, monitoring, risk assessment process)

2. Risks from control characteristics — manual vs. automated

3. Effectiveness of general IT controls

4. Effectiveness of the control itself and its application — including deviations noted before, and personnel changes

5. Whether unchanged controls now pose risk due to changed circumstances

6. Risks of material misstatement and extent of reliance on the control

---

### Handling Deviations from Controls

When deviations are detected in controls the auditor intends to rely on, the auditor must make specific inquiries and determine:

Whether the tests performed still provide an appropriate basis for reliance
Whether additional tests of controls are needed
Whether substantive procedures must address the potential risk of misstatement

> Important rule: Regardless of assessed risks, the auditor must always design and perform substantive procedures for each material class of transactions, account balance, and disclosure — because (i) risk assessment is judgmental and may miss risks, and (ii) internal control has inherent limitations including management override.

Worked example

### Example 1

Example — Condition A: An auditor plans to rely on the three-way match control (PO + GRN + Invoice) to reduce substantive testing of purchases. Since reliance is planned, tests of controls must be performed to confirm the control operates effectively.

Example — Condition B: In a highly automated environment where individual transactions cannot be reconstructively verified (e.g., millions of micro-transactions), substantive procedures alone cannot cover all assertions. The auditor must test the relevant automated controls.

### Example 2

Timing example: The entity performs a physical stock count only at year-end. The auditor observes the count and inspects count sheets. Since this is a point-in-time control (year-end only), evidence pertaining to that date is sufficient — no need to test it across the year.

### Example 3

Prior-audit evidence example: The auditor relied on an automated bank reconciliation control in the previous year with zero deviations. In the current year, the entity upgraded its ERP. The ERP upgrade is a 'changed circumstance' and a change in IT systems — both factors (5 and 3) indicate re-testing is necessary; prior-year evidence cannot be carried forward.

⚠️ Common exam mistakes

Treating inquiry alone as sufficient to test operating effectiveness of controls — SA 330 explicitly states inquiry is never sufficient on its own.
Forgetting to test indirect controls when the primary control depends on them.
Assuming that if controls are tested, substantive procedures can be eliminated — SA 330 requires substantive procedures for every material item regardless.
Mechanically carrying forward prior-year evidence without checking all six re-use factors, especially when personnel or IT systems have changed.
Confusing point-in-time testing with period-wide testing — using a single observation (e.g., watching one reconciliation) to conclude the control worked all year.

Bare-Act text SA 330, Para 8 · SA 330 — The Auditor's Responses to Assessed Risks (ICAI) · click to expand

The auditor shall design and perform tests of controls to obtain sufficient appropriate audit evidence as to the operating effectiveness of relevant controls when: (a) the auditor's assessment of risks of material misstatement at the assertion level includes an expectation that the controls are operating effectively; or (b) substantive procedures alone cannot provide sufficient appropriate audit evidence at the assertion level.

Now that you've read this — what's next?

Move from understanding → mastery in 3 clicks. Each option below picks up from this lesson's topic.

🔥 Drill 5 Qs on this → ✍️ Adaptive practice →

Tests of Controls — SA 330

Worked example

⚠️ Common exam mistakes