Internal Audit / Insight
Controls Approach vs. Substantive Approach
Choose a risk-based combination of control testing and substantive work, with clear limits on what each procedure proves.
Return to your library resultsControls and substantive work answer different questions
Audit strategy starts with the risk and the conclusion needed. Tests of controls examine whether a relevant control was designed appropriately and operated as intended. Substantive procedures examine transactions, balances or disclosures directly, through tests of details, analytical procedures, or both.
Follow the evidence, not a preference
If the strategy relies on a control, identify its purpose, owner, frequency and expected evidence. Test design and operation across the intended reliance period. A written policy or a walkthrough alone should not be mistaken for evidence of sustained operation.
If the control is ineffective, or the evidence is insufficient, revisit the risk assessment and the planned response. More substantive work may be needed; testing another relevant control may also be appropriate. In some circumstances, substantive procedures alone cannot provide sufficient appropriate evidence, so control testing is still necessary. Conversely, finding no error in transaction testing does not establish that the control operated effectively.
Two questions in a hypothetical purchase process
An auditor examines whether purchase approvals were performed by authorized people before commitment. That addresses a control question. The auditor also checks selected payments against invoices, receipts and contractual terms. That addresses what happened in the transactions. A clean payment sample does not prove all approvals worked, and an approval sign-off does not prove every invoice is accurate.
Apply the right framework
These terms are commonly used in financial-statement audits. Under PCAOB AS 2301, substantive procedures remain required for relevant assertions of significant accounts and disclosures regardless of assessed control risk. That US framework is an explanatory reference here, not a claim of a universal Indonesian requirement.
For internal audit, define engagement objectives and criteria first. Decide what combination of control testing and direct verification answers those objectives, then document the link from risk to procedure, evidence and conclusion.
Beyond the numbers. Inside the business.
Put the perspective to work.
Use these questions to connect the resource to your own business context.
Which objective and exposure need assurance?
Where could the process or control fail?
What evidence supports the conclusion and its limits?
What response addresses the cause and can be followed up?
References & context.
PCAOB AS 2301 — Responses to Risks — https://pcaobus.org/oversight/standards/auditing-standards/details/AS2301
PCAOB AS 1105 — Audit Evidence — https://pcaobus.org/oversight/standards/auditing-standards/details/AS1105
Use the framework and jurisdiction applicable to your work. Original examples and templates do not imply endorsement by the referenced organisations.
A question, correction or missing source?
The resource link will be included in your message form.