Audit Testing: Compliance vs. Substantive

Two questions an auditor can ask

Imagine you’re checking whether a bank’s vault is safe. You could:

• watch the guards: are they checking ID, locking the door, logging every visitor?
• open the vault and count the money: is it all there?

Auditors do both. Checking the guards is a compliance test. Counting the money is a substantive test.

Compliance tests (tests of controls)

A compliance test checks whether a control exists and works as designed throughout the period, not just on the day the auditor looks.

Simple example. Company policy says every change to the payroll system needs a manager’s approval before it goes live. The auditor picks 25 changes from the year and checks that each one was approved, by the right person, before it went live. That’s a compliance test.

Substantive tests

A substantive test checks the data itself: are the transactions, balances and records complete, accurate and valid?

Simple example. The auditor recalculates the interest on 40 customer loans and compares it with what the system charged. That’s a substantive test. It doesn’t care whether there was a good control; it checks the answer directly.

	Compliance test	Substantive test
Question	Does the control work?	Is the data right?
Looks at	Approvals, logs, settings, re-performing a control	Transactions, balances, calculations
Sampling	Attribute sampling (yes / no)	Variable sampling (amounts)
Result	Control reliable, or not	Data correct, or misstated

Which comes first?

1. Understand the controls: interviews, documents and a walkthrough show how the process is meant to work.
2. Pick the key controls: the ones that would stop or catch big errors.
3. Compliance test them over the period.
4. Decide: if they work, the auditor can rely on them and do less substantive testing. If they don’t, the auditor must do more.

Substantive testing is reduced but never eliminated. Even good controls can be overridden or fail, and important balances always need some direct evidence.

Example. In one division, pay rate changes need HR approval in the system, and testing shows it works every time. The auditor does a small analytical review of payroll costs. In another division, anyone in payroll can change a rate without approval. There, the auditor recalculates pay for a much larger sample of employees.

Telling them apart

The trick question: a procedure that looks at data but is really checking a control.

• Reviewing user accounts against approved access requests: compliance (checking the access control works).
• Running test data through an application to see if invalid input is rejected: compliance (the edit check is a control).
• Recalculating invoices: substantive.
• Matching inventory records to a physical count: substantive.
• Using data analytics to find duplicate supplier payments: substantive.

When a control fails

A failed compliance test doesn’t prove the data is wrong. It means the auditor can’t rely on the control to have kept it right. So the auditor:

• treats control risk as high and stops relying on that control
• looks for a compensating control that covers the same risk
• extends substantive testing in that area
• reports the weakness

How the exam asks about it

If the question asks…	The answer is usually…
Purpose of compliance testing	Determine whether controls operate as designed
Purpose of substantive testing	Determine the accuracy and integrity of data
Controls tested and effective: what next?	Reduce (not eliminate) substantive testing
A key control isn’t working	Increase substantive testing in that area
Which sampling suits a compliance test?	Attribute sampling
Which test comes first?	Compliance testing, after understanding the controls

In short

• A compliance test (test of controls) checks whether a control exists and works as designed throughout the period.
• A substantive test checks whether the data itself (transactions, balances, records) is complete, accurate and valid.
• Compliance testing comes first. Controls that work mean less substantive testing; controls that fail mean more.
• Substantive testing is reduced, never eliminated, even when controls are excellent.
• Compliance tests use attribute sampling (yes/no); substantive tests use variable sampling (amounts).
• A failed control doesn't prove the data is wrong. It means the auditor can't rely on the control and must check the data directly.

Exam traps

• Checking that changes were approved is a compliance test, even though you're looking at change records.
• Recalculating interest or confirming balances with customers is substantive.
• Weak controls mean MORE substantive testing, not stopping the audit.
• Strong controls let the auditor reduce substantive testing, not skip it.
• Running test data to see if an edit check rejects bad input is a compliance test: the edit check is a control.

Slides

Click the slide and use the arrow keys. F toggles full screen.