How Auditors Test Controls

A control can look sound on paper and still fail in practice. The question for an auditor is not only whether a rule exists, but whether it operated as intended when it mattered. Four familiar methods— inquiry, observation, inspection and reperformance—offer different windows into that question.

Consider an illustrative control: purchase orders above an approval threshold must be approved by an authorized person before release. The audit objective is to assess whether that approval control operated during the period under review. The examples below are illustrative, not results from a real audit.

Inquiry: ask the process owner and the people who release orders how approvals work, which authority matrix applies, and what happens when an approver is absent. Their answers help identify the prescribed process and potential exceptions. Inquiry alone cannot establish that approvals actually happened.

Observation: watch an order pass through the approval and release steps. This can show how the control operates while the auditor is present, including whether the system blocks an unapproved release. Observation is limited to the moment observed; people may also behave differently when watched. It cannot, by itself, represent months of activity.

Inspection: select relevant orders and examine the original approval trail, approver identity, effective delegation matrix and system timestamps. Compare the approval time with the order-release time. A signature or screenshot without a reliable chronology may be weak evidence of approval before release. The auditor also needs to consider whether the underlying records and population are complete and reliable.

Reperformance: independently apply the approval rule and the matrix effective on the transaction date to selected orders. Compare the expected approver or routing with what actually occurred. This directly tests whether the rule produces the right decision for those items, but it does not alone show who performed the original control, when they did so, or whether the control operated throughout the period.

The methods are complementary rather than a fixed checklist. Select the combination and coverage that fit the control objective, risk, frequency, available evidence and period being assessed. A daily automated rule, for example, raises different questions about system configuration and change access than a monthly manual review. Deviations need investigation: was the rule unclear, the execution inconsistent, the record incomplete, or the exception legitimate?

The most useful conclusion names the control, the period and the evidence tested. “The team says approvals happen” is a starting point. It is not the same as evidence that the control operated when each purchase order was released.

Inside Assurance · Beyond the numbers. Inside the business.