CPA AUD: Internal Controls - Tests of Controls vs Substantive Procedures - When Each is Required

What Is It?

Tests of Controls (ToC) and Substantive Procedures (SP) are two types of audit procedures used to evaluate the effectiveness of internal controls and ensure the accuracy of financial statements.

In the real world, auditors use these procedures to assess the risk of material misstatement in financial statements, identify control weaknesses, and recommend improvements to internal controls.

Why Does the Exam Ask This?

This topic measures the candidate's ability to apply professional judgment and compliance logic in evaluating internal controls and designing audit procedures. It requires the candidate to understand the purpose and scope of ToC and SP, as well as the risks and limitations associated with each.

What Do I Need to Know First?

1. Internal control framework and components
2. Audit risk assessment and control risk
3. Audit procedures and techniques
4. Financial statement assertions
5. Audit evidence and documentation

Topic Snapshot

Tests of Controls and Substantive Procedures are essential components of the audit process, used to assess the effectiveness of internal controls and ensure the accuracy of financial statements. This topic is critical in CPA exams, particularly in the AUD section, as it requires candidates to demonstrate their understanding of audit procedures and their ability to apply professional judgment in evaluating internal controls.

Exam / Job / Audit Weighting

Frequency: High Difficulty Rating: Intermediate Question Type or Real-World Task Type: Multiple-choice questions, case studies, and audit simulation exercises

Difficulty Level

intermediate

Must-Know Rules, Formulas, Standards, or Principles

1. The auditor's responsibility to design and perform adequate tests of controls to assess the effectiveness of internal controls.
2. The use of substantive procedures to test the accuracy of financial statements when internal controls are deemed ineffective.
3. The risk assessment process, including the identification of control risks and the design of audit procedures to address those risks.

Misconceptions

1. That Tests of Controls and Substantive Procedures are mutually exclusive and that one can be used in place of the other.
2. That Tests of Controls are only used to assess the effectiveness of internal controls, while Substantive Procedures are used to test the accuracy of financial statements.
3. That Tests of Controls are only used in audits of financial statements, while Substantive Procedures are used in audits of other types of statements.
4. That Tests of Controls are only used to identify control weaknesses, while Substantive Procedures are used to identify material misstatements.
5. That Tests of Controls are only used in audits of large companies, while Substantive Procedures are used in audits of small companies.

Common Mistakes

1. Failing to design and perform adequate Tests of Controls to assess the effectiveness of internal controls.
2. Failing to use Substantive Procedures to test the accuracy of financial statements when internal controls are deemed ineffective.
3. Failing to identify control risks and design audit procedures to address those risks.
4. Failing to document audit procedures and evidence.
5. Failing to communicate audit findings and recommendations to management.

The Common Trap

The most common trap is failing to recognize the importance of both Tests of Controls and Substantive Procedures in the audit process and failing to design and perform adequate procedures to assess the effectiveness of internal controls and ensure the accuracy of financial statements.

Terms to Remember

1. Tests of Controls (ToC)
2. Substantive Procedures (SP)
3. Internal controls
4. Audit risk
5. Control risk

Step-by-Step Process

1. Identify the audit objective and scope.
2. Assess the risk of material misstatement in financial statements.
3. Design and perform Tests of Controls to assess the effectiveness of internal controls.
4. Identify control risks and design audit procedures to address those risks.
5. Perform Substantive Procedures to test the accuracy of financial statements.
6. Document audit procedures and evidence.
7. Communicate audit findings and recommendations to management.

Exam Answer Builder

1-mark Question

What is the purpose of Tests of Controls? - To identify control weaknesses - To assess the effectiveness of internal controls - To test the accuracy of financial statements - To identify material misstatements Correct Answer: B Explanation: Tests of Controls are used to assess the effectiveness of internal controls, not to identify control weaknesses or test the accuracy of financial statements.

2-mark Question

What is the difference between Tests of Controls and Substantive Procedures? - Tests of Controls are used to assess the effectiveness of internal controls, while Substantive Procedures are used to test the accuracy of financial statements. - Tests of Controls are used to identify control weaknesses, while Substantive Procedures are used to identify material misstatements. - Tests of Controls are used in audits of large companies, while Substantive Procedures are used in audits of small companies. Correct Answer: A Explanation: Tests of Controls are used to assess the effectiveness of internal controls, while Substantive Procedures are used to test the accuracy of financial statements.

5-mark Question

Describe the steps involved in designing and performing Tests of Controls to assess the effectiveness of internal controls. Correct Answer: Identify the audit objective and scope, assess the risk of material misstatement in financial statements, design and perform Tests of Controls to assess the effectiveness of internal controls, identify control risks and design audit procedures to address those risks, and document audit procedures and evidence. Explanation: The steps involved in designing and performing Tests of Controls to assess the effectiveness of internal controls include identifying the audit objective and scope, assessing the risk of material misstatement in financial statements, designing and performing Tests of Controls to assess the effectiveness of internal controls, identifying control risks and designing audit procedures to address those risks, and documenting audit procedures and evidence.

This vs That

Tests of Controls vs Substantive Procedures: When Each is Required Tests of Controls are used to assess the effectiveness of internal controls, while Substantive Procedures are used to test the accuracy of financial statements. Tests of Controls are required when internal controls are deemed effective, while Substantive Procedures are required when internal controls are deemed ineffective.

Time-Saver Hack

Use the following shortcut to determine when to use Tests of Controls and Substantive Procedures: - If internal controls are deemed effective, use Tests of Controls to assess their effectiveness. - If internal controls are deemed ineffective, use Substantive Procedures to test the accuracy of financial statements.

Mini Scenarios

Basic Scenario

A company has effective internal controls in place. What type of audit procedure should the auditor use to assess the effectiveness of these controls? Answer: Tests of Controls Explanation: Since the company has effective internal controls in place, the auditor should use Tests of Controls to assess their effectiveness.

Applied Scenario

A company has ineffective internal controls in place. What type of audit procedure should the auditor use to test the accuracy of financial statements? Answer: Substantive Procedures Explanation: Since the company has ineffective internal controls in place, the auditor should use Substantive Procedures to test the accuracy of financial statements.

Tricky Scenario

A company has both effective and ineffective internal controls in place. What type of audit procedure should the auditor use to assess the effectiveness of these controls and test the accuracy of financial statements? Answer: Both Tests of Controls and Substantive Procedures Explanation: Since the company has both effective and ineffective internal controls in place, the auditor should use both Tests of Controls and Substantive Procedures to assess the effectiveness of these controls and test the accuracy of financial statements.

Diagnostic MCQ Bank

Question 1

What is the purpose of Tests of Controls? - To identify control weaknesses - To assess the effectiveness of internal controls - To test the accuracy of financial statements - To identify material misstatements Correct Answer: B Explanation: Tests of Controls are used to assess the effectiveness of internal controls, not to identify control weaknesses or test the accuracy of financial statements.

Question 2

What is the difference between Tests of Controls and Substantive Procedures? - Tests of Controls are used to assess the effectiveness of internal controls, while Substantive Procedures are used to test the accuracy of financial statements. - Tests of Controls are used to identify control weaknesses, while Substantive Procedures are used to identify material misstatements. - Tests of Controls are used in audits of large companies, while Substantive Procedures are used in audits of small companies. Correct Answer: A Explanation: Tests of Controls are used to assess the effectiveness of internal controls, while Substantive Procedures are used to test the accuracy of financial statements.

Question 3

What is the most common trap in the audit process? - Failing to design and perform adequate Tests of Controls to assess the effectiveness of internal controls. - Failing to use Substantive Procedures to test the accuracy of financial statements when internal controls are deemed ineffective. - Failing to identify control risks and design audit procedures to address those risks. Correct Answer: A Explanation: The most common trap in the audit process is failing to design and perform adequate Tests of Controls to assess the effectiveness of internal controls.

Question 4

What is the purpose of Substantive Procedures? - To assess the effectiveness of internal controls - To test the accuracy of financial statements - To identify control weaknesses - To identify material misstatements Correct Answer: B Explanation: Substantive Procedures are used to test the accuracy of financial statements, not to assess the effectiveness of internal controls or identify control weaknesses.

Question 5

What is the difference between control risk and audit risk? - Control risk is the risk that internal controls are ineffective, while audit risk is the risk that financial statements are materially misstated. - Control risk is the risk that financial statements are materially misstated, while audit risk is the risk that internal controls are ineffective. - Control risk and audit risk are the same. Correct Answer: A Explanation: Control risk is the risk that internal controls are ineffective, while audit risk is the risk that financial statements are materially misstated.

Real-World Patterns

1. Auditors use Tests of Controls to assess the effectiveness of internal controls in audits of financial statements.
2. Auditors use Substantive Procedures to test the accuracy of financial statements in audits of financial statements.
3. Auditors use both Tests of Controls and Substantive Procedures in audits of financial statements when internal controls are deemed ineffective.

30-Second Cheat Sheet

1. Tests of Controls are used to assess the effectiveness of internal controls.
2. Substantive Procedures are used to test the accuracy of financial statements.
3. Tests of Controls and Substantive Procedures are used in audits of financial statements.
4. Internal controls are deemed effective when they are operating as intended.
5. Internal controls are deemed ineffective when they are not operating as intended.

Related Concepts

1. Internal control framework and components
2. Audit risk assessment and control risk
3. Audit procedures and techniques
4. Financial statement assertions
5. Audit evidence and documentation

Verified Source List

1. AICPA (American Institute of Certified Public Accountants)
2. PCAOB (Public Company Accounting Oversight Board)
3. FASB (Financial Accounting Standards Board)
4. IFRS (International Financial Reporting Standards)
5. COSO (Committee of Sponsoring Organizations)