An auditor plans control reliance to cut substantive work in half. Two months in, three of the seven tested controls fail. The exam will not ask whether you "caught" the failure. It will ask what happens to the substantive plan now that the reliance assumption is gone.
HIGH-FREQUENCY: ToC are performed when the auditor's strategy depends on operating effectiveness to support a lower assessed risk of material misstatement, or when substantive procedures alone cannot provide sufficient appropriate evidence.
For issuers, ToC are mandatory. PCAOB AS 2201 requires an integrated audit: the auditor opines on internal control over financial reporting alongside the financial statements, so the analysis of exceptions must identify deficiencies in both.
For nonissuers, ToC are required when the auditor adopts a control-reliance strategy (control risk below maximum), or when the population is so automated and paperless that substantive testing alone cannot deliver sufficient evidence.
KEY: The exam often hides the trigger in language like "the auditor planned to set control risk at low"; that planning step is what obligates ToC.
Common mistakes
- Treating inquiry as sufficient ToC evidence. AU-C 330 requires inquiry combined with inspection, observation, or reperformance. "Inquired of the controller" is never a complete ToC.
- Skipping ToD on areas with strong controls. Strong ToC reduces ToD extent; it never eliminates ToD for material items. "No further substantive work was performed because controls are strong" fails AU-C 330.
- Confusing dual-purpose with combined sampling. A dual-purpose test uses one sample for two objectives, with size set to the larger requirement. It is not "averaging," and the design must be set in advance.
Bottom line
- Tests of controls evaluate operating effectiveness; required for issuers (PCAOB AS 2201 integrated audit) and any nonissuer audit using a control-reliance strategy.
- ToC procedures are inquiry, observation, inspection, and reperformance; inquiry alone is never sufficient.
- Reperformance is the strongest operating-effectiveness evidence because the auditor independently re-executes the control.
- ToC sample size rises with control frequency, expected deviation rate, and desired confidence, and falls as the tolerable rate rises.
Exam shortcut
When a question describes a single ToC procedure, scan for inquiry alone: it is the trap. The correct answer pairs inquiry with inspection, observation, or reperformance. If only inquiry is offered, the correct answer is "the procedure is insufficient." When a question describes a control failure mid-engagement, the correct response is to expand ToD or revert to a no-reliance strategy, never "perform additional inquiry," never "increase reliance on analytics for...
The full lesson (about 4,040 words, 27 min read) adds 8 worked examples, all 5 common mistakes, a self-check, free in the app.
Learning objectives
- III.D1
Browse all free CPA AUD lessons or jump into free CPA AUD practice questions.