Under ISA 330, the auditor shall design and perform further audit procedures whose nature, timing and extent are based on and are responsive to the assessed risks of material misstatement at the assertion level, using a combination of tests of controls and substantive procedures as appropriate.
What Is the Difference Between a Test of Controls and a Substantive Procedure?
- Substantive procedure — An audit procedure designed to detect material misstatements at the assertion level.
- Test of controls — An audit procedure designed to evaluate the operating effectiveness of controls in preventing, or detecting and correcting, material misstatements at the assertion level.
When Must the Auditor Perform Tests of Controls?
The standard states that the auditor shall obtain more persuasive audit evidence the higher the auditor's assessment of risk. If the auditor plans to rely on the operating effectiveness of controls in determining the nature, timing and extent of substantive procedures, the controls must actually be tested rather than merely assumed to be effective.
Can the Auditor Rely on Test-of-Controls Evidence From a Previous Audit?
The standard permits the auditor, in certain circumstances, to use audit evidence about the operating effectiveness of controls obtained in a previous audit, provided the auditor establishes the continuing relevance and reliability of that evidence by obtaining audit evidence about whether significant changes in those controls have occurred subsequent to the previous audit. In that case the standard requires the auditor to test the controls at least once in every third audit, and to test some controls each audit to avoid the possibility of testing all the controls on which the auditor intends to rely in a single audit period with no testing of controls in the subsequent two audit periods.
However, if the auditor intends to rely on controls over a risk the auditor has determined to be a significant risk, the standard requires the auditor to test those controls in the current period.
Are Substantive Procedures Performed Regardless of the Risk Level?
Yes. The standard states explicitly that irrespective of the assessed risks of material misstatement, the auditor shall design and perform substantive procedures for each material class of transactions, account balance, and disclosure. The standard also requires that these substantive procedures specifically address the financial statement closing process.
How Is Continued Control Effectiveness Evaluated During the Audit?
When evaluating the operating effectiveness of controls upon which the auditor intends to rely, the standard requires the auditor to evaluate whether misstatements that have been detected by substantive procedures indicate that controls are not operating effectively.
Must the Auditor Consider External Confirmations?
The standard requires that the auditor shall consider whether external confirmation procedures are to be performed as substantive audit procedures, as part of designing the overall response to the assessed risks.
Legal References
- ISA 330 — The Auditor's Responses to Assessed Risks, Paragraphs 4, 6, 7, 14, 15, 18, 19 and 20.
For questions about your specific situation, you can ask the Private Sector Accounting Helper on Helpers, or consult a licensed chartered accountant.