Internal Controls vs Substantive Procedures: Key Differences
By SimplyCPA · 11 October 2026
On this page (7)
- Tests of controls: Check whether a control operated effectively throughout the period — e.g. inspecting evidence that invoices were approved.
- Substantive procedures: Look directly for material misstatements — tests of details and substantive analytical procedures.
- When controls must be tested: When the auditor plans to rely on them, or when substantive procedures alone can't give enough evidence (common with highly automated systems).
- Always required: Substantive procedures for every relevant assertion of every material account — whatever the control assessment.
- Trade-off: Effective controls lower control risk, which allows less substantive testing.
Two different questions
- A test of controls asks: did this control work, every time, all year? The auditor's conclusion is about the control, not the balance.
- A substantive procedure asks: is this number right? The conclusion is about the account balance, transaction class or disclosure.
Procedures used for each
| Tests of controls | Substantive procedures | |
|---|---|---|
| Typical procedures | Inquiry plus observation, inspection of documents for evidence of performance, re-performance | Tests of details (confirmation, vouching, recalculation) and substantive analytical procedures |
| Inquiry alone | Never sufficient | Never sufficient |
| Typical sampling | Attribute sampling (deviation rate) | Variables or monetary-unit sampling (dollar misstatement) |
| Required? | Only when relying on controls, or when substantive procedures alone are insufficient | Always, for each relevant assertion of each material item |
Choosing an approach: controls reliance vs substantive
| Controls-reliance (combined) approach | Substantive approach | |
|---|---|---|
| When it fits | Large volumes of routine transactions processed by reliable systems (sales, purchases, payroll in a large company) | Small entities, few transactions, weak or undocumented controls, or where testing controls would cost more than it saves |
| Control risk | Assessed below maximum, supported by tests of controls | Assessed at maximum |
| Substantive work | Reduced in nature, timing or extent | Extensive, often at year-end |
Example: A retailer processes 2 million card transactions a year through an automated point-of-sale system. Vouching enough of them substantively would be impractical, so the auditor tests the automated controls and IT general controls, then performs targeted substantive analytics on revenue. A small family business with 300 invoices a year is audited substantively instead.
Relying on prior-year testing
Under AICPA standards, if a control hasn't changed, the auditor may rely on evidence from earlier audits but must test it at least once every third audit. That shortcut is not available for controls that address a significant risk — those must be tested in the current period.
Dual-purpose tests
A single procedure can do both jobs. Examining a sample of sales invoices for evidence of credit approval (a control) while also checking that each invoice's amount agrees to the shipping document and the ledger (a substantive check) is a dual-purpose test. The auditor must design it to meet both objectives and evaluate each result separately.
Exam trap: Walkthroughs — following one transaction through the system — help the auditor understand a process and confirm controls have been implemented. On their own they aren't enough to conclude that a control operated effectively throughout the period.
Public company audits
For larger public companies, the PCAOB's AS 2201 requires an integrated audit: an opinion on internal control over financial reporting alongside the financial statement opinion. Controls testing there is extensive, because the auditor must opine on the controls themselves.
Continue with responding to assessed risks and understanding the entity and its internal control.