What’s the true differentiator between controls testing and substantive testing?

I’m not trying to be mean, but you’re an internal auditor and don’t know the answer to this question?

Substantive testing is to support the balance as of the report date. Control testing is to support the controls in the process that developing that balance over time.

The point of control testing in an audit is to lower control risk and thus lower substantive testing. Unless it’s a SOX audit it’s highly unlikely you’re going to see control testing over a line item that is easily substantively tested. Ie. Cash. You’re going to get the confirmation regardless so there is no need to lower control risk. You’ll never do an analytic over cash.

However a line item like expenditures will have control testing so that we can lower control risk and perform only analytics over the balance as of the report date and not substantively test the detail of expenditures (ie sample the balance and test the selections)

And yes you’re technically sampling when you do test of controls over expenditures but your using attribute sampling so you’re limited to the number of items that need to be selected. Whereas a dollar based sample of the balance to substantively test the detail could result in hundreds of items.

This is how I over simplify this:
- Substantive testing = let ME (as an auditor) check that this number is actually right by looking at support
- Controls testing = how did THEY (the control owner) get comfortably that the number is right (i.e. what is their control?). Let ME (as an auditor) test the control by checking that they did what they were supposed to do.

And to note, for the most part, your test steps for controls shouldn’t feel like a substantive test. If it does, I question if your test steps are actually testing the control as it was designed. (Of course, it all depends on what the control is, how it’s designed, etc)

You don’t look dumb, it was just a surprising question. I guess my short version of the answer is controls testing is yes or no. It either works or it doesn’t work. E.g.: your control is that the controller approves all invoices prior to payment; your support is black and white proof of that review (email saying “approved”, controllers initials on an invoice, etc.).

Substantive involves more of the judgment in my opinion... sometimes an error is not really an error or can be considered isolated, a fat finger entry can be corrected with an adjusting entry, etc. With controls there’s really no judgement, it either operated effectively or it didn’t

A component of testing the review should be ensuring the item reviewed is accurate. The review is more than just a signature it’s an authorization that something is accurate

Thank you for asking this question!!!!!

I maybe completely wrong, lol, but the way I look at it: substantive testing is looking at a balance on a financial statement line item, and looking to verify that the transactions supporting this balance is accurate/complete etc depending on the test that you are conducting...
Here, when you see that an invoice is available for example for a service provided, you are good.

Controls testing does not look to get assurance that the balance is accurate etc, instead they can look to see if the invoice is approved by someone who has the authority to approve, and that the transaction is reasonable. But does not provide any assurance about the balance, it only concludes to say that the control is operating effectively, with a lot of language indicating that this may not be working if people change or the process changes etc.


Controls

Controls testing is about the process and making sure the activities at the entity are running as they should and designed appropriately. They’re generally tested at public companies only due to Sarbanes oxely. Substantive is just checking the numbers are right, and flow through to the financials for the most part.

Valid point but it seems like there is a lot of judgement. Substantive testing, your tracing figures to source documentation. Controls, your testing for review. How can you confirm a true review took place without looking at the source documentation of the numbers ? I think I’m just thinking way to much into this.

I agree for those controls it is very black and white. But what about examples pertaining to say, bank reconciliations. Would you just look at the review/approval sign-off or dig further into the figures to ensure proper support is available for the rec? I really appreciate your feedback- I keep getting conflicting information from the guidelines and research forums

Also, it should be noted if you find an error substantively, you should assess whether the control worked. We have failed controls because we found an error doing substantive work later on after control work was done.

Senior Assurance 1 - since our external auditor relies on our testing, we tend to test controls more substantively because we want to make sure we catch all errors, but it’s turns out to be almost duplicating work. That’s why I trying to find out what should be external auditor responsibilities vs. internal audits responsibilities. That’s everyone so much for the help.

I would argue controls testing is more judgmental than substantive testing. With control testing , unless the design is perfect then there will be room for judgement over what is enough. You’re faced with questions such as whether agreeing the inputs to a calculation is sufficient or if the control owner needs to look at the change in balance over time as well. Or the control owner does the control perfectly, but doesn’t document anything at all. The control fails, even though the control owner ensured the balance (or the substantive side) is appropriately stated.

With substantive, it either agrees or it doesn’t (excluding estimates etc) and as long as you can quantify a difference is immaterial, you’re done. Most firms have aides that explicitly outline what is sufficient from a substantive perspective. There is some judgement here for things like reserves, estimates, or strategy (testing analytically versus detail testing), but the level of judgement and frequency in which it’s exercised is far less.

If you look at PCAOB inspection results, they almost always fail on the control side due to the inherent level of judgement. Sometimes it’s not even the control itself, but whether a control is missing or if a compensating control is insufficient.

Manager 2- yes! That’s what I thought. So then where does the difference between substantive testing and controls testing come into play, especially when you have to verify that calculations are accurate and appropriately reviewed?

@Manager 2, thank you so much! This really helpful!

No problem. And yes as SA1 said. A substantive error=potential control deficiency, but a control error does not mean something is wrong as of the report period

I feel that these comments are not wrong. But they are definitely complicating things. To simply answer your question : the true differentiator is this: substantive testing verifies the monetary balance of a financial statement account. Control testing validates the operating effectiveness of controls... aka to conclude that the control activities in place at the organization are effective at preventing or detecting & correcting material misstatements in the FS. Simple as that

One more thing, sometimes the design of the control isn't that great which creates more gray in the process. In a perfectly desigmed control environment, every attribute tested would be Y/N capable.

Manager 2 should be a CPA instructor. I learned more from this post than I did in hours of Becker studying