To collect sufficient, reliable evidence to support their audit conclusions, internal auditors balance their testing activities between Control Testing (Tests of Controls) and Substantive Testing (Tests of Details).
  ┌────────────────────────────────────────────────────────┐
  │                 AUDIT TESTING FIELDWORK                │
  └───────────────────────────┬────────────────────────────┘
                              ▼
  ┌────────────────────────────────────────────────────────┐
  │   CONTROL TESTING ──► Verifies control operating health│
  │                       (Sampling authorization logs)     │
  │   SUBSTANTIVE TESTING ──► Verifies actual data values  │
  │                           (Recalculating ledger values)│
  └────────────────────────────────────────────────────────┘

Control Testing Methodologies
Control testing evaluates whether an internal control functions reliably in daily practice. The auditor tests a sample of control executions over a given period to verify that the control operated consistently as designed. For example, the auditor may extract a random sample of 25 user access modifications and inspect authorization logs to confirm that each change received appropriate supervisor sign-off before implementation.
Substantive Testing Methodologies
Substantive testing focuses on verifying the accuracy, completeness, and validity of underlying transaction values and financial balances. The auditor looks past the control mechanism to verify the actual data:
Substantive Value Variance = System Stated Financial Balance - Auditor Independently Verified Value

Examples of substantive procedures include performing physical inventory counts to verify asset balances, sending independent confirmation requests to bank counterparties, and recalculating complex interest accruals to confirm ledger accuracy.
 
PreviousNext