Related Posts
Visual Storyteller
Visual Storyteller
Bowl Leader
Bowl Leader
No offense 🥲
Additional Posts in Risk Assurance
What makes more money IT Audit or IT GRC?
New to Fishbowl?
Download the Fishbowl app to
unlock all discussions on Fishbowl.
unlock all discussions on Fishbowl.
Substantive testing is were you test that the actual result is as expected rather than testing that the control which is designed to ensure the proper results work (controls testing). Substantive testing can still be done on a sample basis. (Using a non financial example) Let’s say that you want to test that all code changes are authorized. A controls based test would be to verify that the code librarian tool wont allow anyone to check code into production without an approval ticket entered by so one other than the developer that modified the code. A substantive test would be to compare code from Q3 to code in Q1, identify changes and then look for approvals for each of those changes.
Thanks. Makes sense. Perhaps it's the usage of the word substantive that's confusing everyone. Design assessment sounds more objective
A substantive test is basically testing a process and it’s population in it’s entirety, rather than sampling.
For example, let’s say you are testing the appropriateness of privileged accounts, you could do a substantive test and get evidence that each privileged account is appropriate. Rather than sampling privileged accounts.
This is incorrect.
Can you give some context? My understanding is that substantive testing would be a way of describing a test, as opposed to an actual type of testing.
Say you're reviewing/assessing a business process that is being implemented but isn't yet complete. Does substantive testing apply and/or does it make sense?
Testing accuracy of transactions?
Test attributes.
Making sure numbers match
Wow some pretty off-base answers here. Substantive testing is generally what external auditors do to gain “reasonable assurance” over the accuracy of a recorded account balance. Substantive testing of revenue is the classic example.
From your replies is sounds like you want to test a process that hasn’t been implemented yet? Substantive testing is not a good way to do that since nothing will have been recorded. While external auditors are still required to perform substantive test procedures, internal auditors are not and IA is largely moving away from performing tedious test work like that.
Well, probably because the post lacks some context. But I also like your explanation.