Substantive Procedures vs Tests of Controls: Key Differences

1. Different Evidence Requirements: If you're testing whether management performed a control, you need evidence that they actually did it. If you're testing whether a balance is correct, you need evidence about the balance itself. They're completely different pieces of evidence. For example, an approval signature proves a control was performed. A supplier confirmation proves a payables balance is correct. These answer different questions.

2. Different Risk Responses: If you find that a control is not operating effectively, you have to adjust your substantive testing — you'll do more detailed testing of account balances because you can't rely on the control. If you test a balance and find a misstatement, that tells you something about the control environment. The two types of testing work together.

3. Different Standards and Frameworks: Tests of controls are covered in ISA 330 Testing Controls. Substantive procedures are covered in ISA 500 Audit Evidence. CIA Part 2 Sections 2161-2165 cover control testing methodologies. The frameworks are different because the objectives are different.

4. Exam Marks at Stake: Examiners have explicitly stated: "Candidates must ensure that they can distinguish between a substantive procedure and a test of control. Many candidates lose marks in this type of requirement by mixing up these procedures." (MJ24 examiner report). If you write the wrong type, you get zero marks for that procedure, even if it's well-written. There's no partial credit. Getting the type right is foundational.

Sales Cycle — Sales Order Approval:

Test of Control: "Select 10 sales orders over £50,000 from the period; review each order to verify it was approved by a sales manager before goods were dispatched; examine the order file for evidence of manager approval (signature, email approval, or system log showing approval); document the manager name and approval date for each order."

Why this is a test of control: you're examining evidence that the CLIENT performed the approval before goods left the warehouse.

Substantive Procedure: "Obtain the sales invoice listing for the final week of December and first week of January; select 8 sales transactions each month; trace each transaction to the Goods Dispatched Note (GDN) to verify that goods were shipped in the correct accounting period; agree the amount on the invoice to the sales order and GDN; if timing appears incorrect, investigate with management."

Why this is substantive: you're testing whether revenue is recognized in the correct period — you're directly verifying the account balance, not the client's approval control.

Purchases Cycle — Three-Way Matching:

Test of Control: "Select 12 invoices over £30,000 from the purchase ledger; for each invoice, inspect the purchase order file to verify that a three-way match was performed (PO matched to Goods Received Note matched to supplier invoice); document evidence of matching review (initials, approval stamp, or system record); report any invoices without evidence of three-way matching."

Why this is a test of control: you're examining the CLIENT'S evidence of performing the three-way matching control.

Substantive Procedure: "Obtain the trade payables ledger as of year-end; select 15 invoices from the list, stratified to capture high-value items; recalculate invoice amounts using supplier statements and contracts; verify that amounts are recorded in the correct accounting period by examining GRN dates; for any differences, contact the supplier to confirm the outstanding balance and timing."

Why this is substantive: you're directly testing whether payables amounts are correct, not testing whether the matching control was performed.

Payroll Cycle — Authorization of Wage Rate Changes:

Test of Control: "Obtain the payroll system report showing all wage rate changes in the period; select 20 rate changes; for each change, review the supporting documentation (manager authorization, HR approval, signed change form); verify that the change was approved by someone with appropriate authority; document the approver name and date for each change; identify any changes without evidence of authorization."

Why this is a test of control: you're examining evidence that the CLIENT authorized wage changes before they were processed in the system.

Substantive Procedure: "Obtain the payroll expense report for December; select 10 employees with wage rates that changed during the year; recalculate their gross pay for November and December using their wage rate and hours; agree the calculation to the payroll register; verify the wage rate used was accurate as of each period; identify any employees paid at incorrect rates."

Why this is substantive: you're directly testing whether payroll amounts are correct, not testing the authorization control.

1. Understanding Control Objectives: Before you test a control, you need to understand what risk it's designed to mitigate and what the control is supposed to achieve. ISA 315 Identifying and Assessing Risks of Material Misstatement emphasizes this — you identify risks, then identify the controls meant to respond to those risks.

2. Testing Design vs. Operating Effectiveness: CIA Part 2 distinguishes between testing whether a control is designed to mitigate risk (do the documentation and process make sense?) and testing whether it's operating effectively (is the client actually performing it?). Both matter. A control might be well-designed but not performed consistently.

3. Sampling for Control Testing: CIA Part 2 Section 2164 covers sampling methodologies for control testing. You typically sample a smaller number of transactions for control testing than for substantive testing, because you're testing whether the process works consistently, not testing every transaction in an account balance.

Confusion 1: Both involve examining documents and looking for evidence. But the type of evidence is different. When testing controls, you're looking for evidence the client acted. When testing balances, you're looking for evidence the amount is correct. Example: A supplier invoice is evidence that a purchase occurred (substantive). An approval signature on that invoice is evidence that management approved the purchase (control). Same document, different evidence.

Confusion 2: Students test controls when they should test balances, and vice versa. Often this happens because the student focuses on what's in the scenario rather than what the question asks. If the scenario mentions a control weakness, students write about testing that control. But if the question asks "describe substantive procedures for accounts receivable," you're testing the balance, not the control. Read the question requirement carefully, not just the scenario.

Confusion 3: Students use vague language like "check," "review," or "examine" without specifying HOW or WHAT. Examiners want detail. Instead of "review the approval process," write "select 10 invoices over £20,000, examine the purchase order file for each invoice to verify that it was approved by a manager with appropriate spending authority, and document the approval evidence for each transaction." The detail shows you understand what you're testing.

How to Fix It: For each procedure you write, ask yourself: "Am I testing whether the client performed a control, or am I testing whether an account balance is correct?" If the former, it's a test of control. If the latter, it's substantive. Write the answer accordingly. And include specific detail — the document, the population, the evidence, the sample size. This clarity will earn you marks and help you avoid confusion.