## Audit Procedures for Obtaining Audit Evidence
All audit procedures fall into a two-level hierarchy.
```
All Audit Procedures
├── Risk Assessment Procedures ← Understand the entity & identify risks
└── Further Audit Procedures ← Respond to assessed risks
├── Tests of Controls ← Does the control operate effectively?
└── Substantive Procedures ← Are the financial statement amounts correct?
├── Tests of Details
│ ├── Test of Transactions (Vouching)
│ └── Test of Balances (Verification)
└── Substantive Analytical Procedures
```
### Risk Assessment Procedures
Performed to understand the entity and its environment and to identify and assess risks of material misstatement. They do not themselves provide sufficient audit evidence.
### Tests of Controls
Performed to evaluate the operating effectiveness of controls in preventing, detecting, and correcting material misstatements. Required when the auditor intends to rely on controls OR when substantive procedures alone cannot provide sufficient appropriate evidence.
### Substantive Procedures
Designed to detect material misstatements at the assertion level.
| Sub-type | Focus |
|---|---|
| Test of Transactions (Vouching) | Trace recorded entries back to source documents |
| Test of Balances (Verification) | Verify closing balances on the balance sheet |
| Substantive Analytical Procedures | Use relationships and trends to identify unusual items |
### Selecting items for testing
- 100% examination — test all items (rare; used for small populations or high-risk items)
- Specific items — target high-value, key, or items above a threshold
- Audit sampling (SA 530) — select a representative sample; conclusions drawn apply to the whole population