Test of Controls vs Test of Details in Compliance Audits

Tests of controls and tests of details in compliance audits are complementary tools. Control reliability governs the scope of substantive work, while standards set requirements that reliance cannot remove. A defensible audit designs both around the same assertions, using each for the evidence it can provide rather than asking either to substitute for the other.

What each test is actually doing and why the difference matters

A test of controls asks whether a control worked. It examines how the control was applied, whether it operated consistently throughout the period, and who performed it. PCAOB standards make those features central to evaluating operating effectiveness. The output is a conclusion about process execution, including a deviation rate where applicable, rather than a direct conclusion about a reported amount. Reperformance, inspection, and observation provide evidence for that conclusion.

A substantive test asks whether an amount is right. More precisely, it obtains evidence about assertions underlying account balances, transactions, and disclosures, such as accuracy, completeness, or existence. The International Standards on Auditing and PCAOB standards divide substantive testing into substantive analytical procedures and tests of details. Tests of details inspect individual transactions, balances, and disclosures through source documents, third-party confirmations, recalculation, vouching, and tracing.

Substantive analytical procedures compare financial data with data from prior periods, forecasts, budgets, or the industry to find anomalies. They are typically efficient for large, predictable populations. Inspection of a document can support a conclusion about control execution or a conclusion about a transaction, depending on what the auditor examines. Because those conclusions answer different questions, the relationship between the tests is structural.

How the inverse relationship between control reliability and substantive scope works in practice

Effective controls allow auditors to tailor the extent of substantive procedures to the reliance those controls support. Weak or untested controls require more extensive substantive work because the auditor cannot place the same reliance on the process that produced the records. Risk shifts to the substantive evidence burden. AU-C 330 requires tests of controls when the assertion-level risk assessment includes an expectation that controls operate effectively, or when substantive procedures alone cannot provide sufficient appropriate evidence at that level.

PCAOB AS 2201 requires an assessment of design before testing operating effectiveness. Auditors first assess whether the control is structured to prevent or detect its targeted risk. A well-designed control that is not performed consistently cannot support the same reliance as one that operates effectively.

This relationship is especially pronounced in high-volume, system-driven environments, where automated control testing can provide coverage across a full population. Without reliance, auditors must increase substantive sampling across that dataset. The period covered by control evidence also limits the conclusion. AICPA AT-C Section 205 requires practitioners in SOC 2 Type II examinations to show that controls worked effectively throughout the examination period. Evidence from a single point in time cannot show that controls worked throughout that period.

Where standards impose a mandatory floor that control testing cannot remove

PCAOB AS 2301.36 requires substantive procedures for each relevant assertion of each significant account and disclosure, regardless of assessed control risk. Strong controls can change the extent of that work but cannot eliminate it. An auditor can support reduced substantive scope through control reliance, but cannot treat reliance as evidence that every relevant financial statement assertion has already been addressed.

Significant risks impose a more specific requirement. Tests of details are required in response, so analytical procedures alone are insufficient. A complex estimate identified as a significant risk requires detailed testing, as does a fraud risk. Stronger analytical procedures do not remove that obligation. Substantive work must respond to risks identified during planning and detect errors in the accounting records themselves, rather than merely corroborate the control assessment.

An absence of detected misstatements is not evidence that the related controls operated effectively. Substantive procedures address assertions including existence or occurrence, completeness, accuracy or valuation, rights and obligations, cutoff, and presentation or disclosure. A clean result covers only the assertions tested by those procedures. It does not establish how consistently a control operated, who performed it, or whether its design was adequate.

How integrated audits require both tests to operate as a system, not a sequence

Integrated audits require control testing even where the auditor has no initial expectation of reliance. The framework requires both management’s assessment of internal control over financial reporting and auditor attestation. These obligations, together with required control testing where substantive procedures alone provide insufficient appropriate assertion-level evidence, make the control program part of audit design from the outset.

Findings then reshape the work in both directions. A deficiency in a revenue recognition control requires an expansion of substantive testing of revenue balances. Conversely, patterns of misstatement in substantive testing indicate that a related control may not be operating effectively. The auditor must reconsider the control conclusion in light of that evidence.

Control testing usually takes place during interim periods, and roll-forward procedures then extend coverage to year-end. Substantive testing is generally concentrated at or near year-end. The work therefore has a sequence in the calendar, but not a one-way logic. The substantive program cannot be finalized before control conclusions are available, while later substantive findings can require those conclusions to be revisited. Resourcing depends on that interaction.

What PCAOB inspection findings reveal about where the system breaks down

PCAOB inspection findings at Grant Thornton identified deficiencies primarily in controls over and/or substantive testing of revenue, inventory, and investment securities. The most common Part I.A deficiencies concerned data or reports used in substantive testing and the testing of an estimate. The inspection findings at BDO USA were mainly in revenue and related accounts, goodwill and intangible assets, and long-lived assets. One engagement also involved a financial statement restatement. The firm revised and reissued its report, and the issuer revised its ICFR report to express an adverse opinion.

The PCAOB’s 2024 findings at KPMG most commonly concerned the design or operating effectiveness of selected controls and controls over the accuracy and completeness of data or reports used in control operation. The findings at Ernst & Young identified the same most common Part I.A categories. Data quality sits inside the evidence chain. Testing a control’s execution does not resolve whether the information used by that control is accurate and complete.

The PCAOB’s 2023 inspection found that a Forvis engagement team did not test controls over how the client rated loan risk. The team therefore did not have enough evidence to support its conclusion on the allowance for loan losses. This illustrates a control gap leaving a substantive conclusion unsupported. Across the findings, the recurring problem is not choosing controls instead of details, but leaving an assertion insufficiently supported. Revenue is particularly exposed because significant risk can require both bodies of work to be executed fully.

What the research record says about which test failures actually predict future misstatements

Patience Constance and Clive Lennox’s peer-reviewed 2025 study in Contemporary Accounting Research found that inadequate substantive testing was the PCAOB deficiency reported most often, followed by inadequate internal control testing. Yet frequency did not translate into the same predictive relationship. The study found four deficiency categories that had a positive and significant association with future misstatements. These were a failure to understand accounting procedures, analytical procedures that were inadequate, substantive testing that was inadequate, and going-concern assessments that were inadequate. Inadequate internal control testing was not among them.

Heavy investment in control testing at the expense of substantive work may protect a firm against inspection citations without materially reducing misstatement risk. Substantive procedures test the accounting results where errors show up, while control testing also meets the needs of the integrated audit and attestation framework. The two evidence burdens therefore have different purposes. Inspection exposure and future misstatement risk cannot simply be treated as interchangeable measures of audit quality.

Integrated audit requirements remain, and AS 2301.36 separately preserves the substantive floor regardless of assessed control risk. Nor does an association establish that control testing has no value in preventing unsupported reliance decisions. An engagement must satisfy its control obligations without allowing that work to displace the substantive procedures most directly connected to detecting misstatements. The research sharpens the unresolved trade-off.

How AI in the close process is straining the conceptual boundary between the two tests

Finance teams spent 2026 deploying AI agents to match reconciliations, draft journal entries, suggest accrual estimates, and write variance commentary. These functions bring AI into processes that produce both financial information and evidence about its reliability. The boundary is becoming harder to draw in practice. An AI system that reviews the full journal-entry population for anomalies or automatically reconciles intercompany balances triggers integrated audit obligations, including design documentation, operating effectiveness testing, management assessment, and auditor attestation.

The governance problem goes beyond population size alone. The same prompt can produce different outputs, so a sample tells an auditor relatively little about how the system treated the rest of the population. Evidence strategy consequently needs to shift toward enforced boundaries and continuous evaluation. Current standards were designed around controls carried out by people and populations sampled statistically, so they do not fully cover that approach. Full-population coverage does not, by itself, resolve the question of what the evidence proves.

The PCAOB’s amendments on auditors’ use of technology-assisted analysis apply to fiscal years beginning on or after December 15, 2025. Calendar-year companies therefore first face them in the 2026 audit. A PCAOB board member raised the unresolved possibility that an inspector could recognize AI-enabled full-population testing as an enhancement or penalize a methodology lacking clear standards. No PCAOB guidance resolves that scenario. Audit firms using AI for full-population substantive testing, and the companies they audit, therefore face a compliance grey zone, with no settled basis for using it in place of the standard evidence framework.

How auditors and compliance teams should think about designing the two tests together going forward

Planning begins with assertion-level risk. For each significant assertion, teams should establish whether control testing is required, whether controls exist and can be documented, and whether their design can support reliance before investing in operating effectiveness testing. Significant risks require tests of details from the outset. The results of control testing should then guide substantive sample sizes, procedures, and coverage while meeting the requirements that apply.

SOX program costs have been rising while automation adoption has been stalling. Improving automated controls can reduce substantive workload through the reliance those controls support, but only where testing establishes adequate design and effective operation. The research cautions against pursuing that reduction at the expense of sufficient substantive evidence. Efficiency comes from allocating work to the conclusion it supports.

For AI-assisted procedures, teams should treat control functions as controls that must meet all AS 2201 requirements for documentation and testing. AI-assisted full-population testing should supplement the standard evidence framework until standards resolve the grey zone. Mapping each procedure to a specific assertion, then establishing that the combined control and substantive evidence fully addresses it, connects reliance decisions, mandatory detailed testing, and AI governance. That discipline makes the audit defensible even when the tools used to obtain evidence change.