An auditor must give an opinion on a trial balance with 400 accounts and thousands of transactions. She cannot test everything. She starts with what could be wrong, which assertions the directors are making, and then picks the right test for each, from the right starting point. A test that begins in the wrong place can run for hours and still prove nothing.
Substantive procedures are where the audit gets most of its evidence about the figures, and getting the direction right is one of the most examined skills in the paper.
This topic covers the nature of substantive procedures under ISA 330, the financial statement assertions, a method for devising tests of detail, computer-assisted audit techniques for substantive testing (audit software and embedded audit facilities), the seven methods of gathering evidence, the reliability of evidence, directional testing, and why the auditor stresses the statement of financial position.
The next topic covers analytical procedures, and the later topics apply all this to each balance.
In 30 seconds
Substantive procedures are tests of details and analytical procedures that detect material misstatement. Always required (ISA 330): agree the financial statements to the records, examine material journal entries and examine other adjustments. Assertions: transactions (occurrence, completeness, accuracy, cut-off, classification); balances (existence, rights and obligations, completeness, valuation); presentation and disclosure. Methods: inspection, observation, enquiry, confirmation, recalculation, reperformance and analytical procedures.
Direction: test overstatement from the accounting records outward; test understatement from outside the records inward. Emphasis: assets for existence, ownership and valuation; liabilities for completeness, cut-off and accuracy.
Key terms in plain English
| Term | What it means |
|---|---|
| Substantive procedure | A test to detect material misstatement in figures or disclosures |
| Assertion | A claim made by the directors in the financial statements |
| Audit software | Programs used by the auditor to analyse client data |
| Embedded audit facility | Audit software built into the client system |
| Directional testing | Choosing the start point by the misstatement sought |
| Reciprocal population | An outside source used to test completeness |
Syllabus check
This topic is in syllabus area C, audit evidence and substantive procedures (25% of marks). It covers:
- the nature and role of substantive procedures
- the financial statement assertions
- tests of details, analytical procedures and computer-assisted audit techniques
- directional testing
CAMA 2020 and substantive procedures
The Companies and Allied Matters Act 2020 (CAMA 2020) is the company law of Nigeria. The sections below apply to this topic.
| Section | What it says | Link to this topic |
|---|---|---|
| s. 404(2) | The auditor reports on whether the accounts give a true and fair view and whether proper books were kept | The tests give the evidence for the report |
| s. 407(3) | Right of access to books, accounts and vouchers and to information and explanations | Enables inspection, enquiry and confirmation |
| s. 405 | Corporate responsibility for financial reports | The assertions are the directors' claims |
The rules in more depth
The nature of substantive procedures
The earlier topics dealt with planning and with understanding, evaluating and testing the control systems. In accordance with ISA 330, the auditor also does substantive testing. As a result of the risk assessment, the auditor may choose a systems-based approach, or a transactions-based approach that is wholly substantive. Either way, some substantive testing is done.
Substantive procedures are audit procedures performed to detect material misstatements in the figures, presentation and disclosures in the financial statements. They are designed to produce evidence about the financial statement assertions in ISA 315. They are of two kinds: tests of details on transactions, account balances and disclosures; and analytical procedures.
Whatever level of substantive testing the auditor plans, ISA 330 requires the auditor to:
- (a) agree or reconcile the financial statements to the underlying accounting records
- (b) examine material journal entries
- (c) examine other adjustments made while preparing the financial statements
These three tests deal with the risk of management override and of misstatement introduced at the final stage, after the transaction systems have done their work.
| Control risk assessment | Effect on substantive procedures |
|---|---|
| Low: controls tested and effective | Less extensive; more at an interim date; smaller samples |
| High: controls weak or untested | More extensive; at or after the year end; larger samples; more external evidence |
Financial statement assertions
The auditor must obtain evidence to support the assertions made by the directors in the financial statements. The assertions fall into three groups.
| Classes of transactions and events (income statement) | Account balances (statement of financial position) | Presentation and disclosure |
|---|---|---|
| Occurrence | Existence | Occurrence and rights and obligations |
| Completeness | Rights and obligations | Completeness |
| Accuracy | Completeness | Classification and understandability |
| Cut-off | Valuation (and allocation) | Accuracy and valuation |
| Classification |
- Completeness. No assets, liabilities, equity, transactions or events have been left out that should be included. It is an assertion that there is no understatement. It also applies to disclosure, for example for provisions, where all required disclosures must be made.
- Occurrence. Transactions and disclosures included in the statements did take place in the period. It relates to transactions and disclosures, not assets and liabilities, and is an assertion that there is no overstatement.
- Existence. The equivalent of occurrence for assets, liabilities and equity: they existed at the end of the reporting period. It is an assertion of no overstatement and is extremely important, since a large part of an audit is aimed at it.
- Accuracy and valuation. Items are recorded at appropriate amounts. Accuracy relates to transactions in the income statement, especially the measurement of revenue, purchases and other expenses. Valuation relates to assets, liabilities and equity. There is also an accuracy and valuation assertion for disclosures: that information is disclosed fairly and at appropriate amounts.
- Rights and obligations. The entity has the rights to the assets shown, which is often legal ownership but may be other rights. A lessee has economic rights over a leased asset it does not legally own. Inventory held on sale or return may still belong to the supplier. The entity also has obligations for the liabilities shown.
- Cut-off. Transactions are recorded in the right period. This matters particularly where revenue is received in advance or expenses are paid in advance or arrears.
- Classification and understandability. Transactions are recorded in the proper accounts, for example goods for resale in purchases and stationery in stationery and postage, and are presented in the right place in the statements, for example cost of sales and administrative expenses. Disclosures must be clear.
Devising tests of detail in the exam
Each business and system is different, so the exam asks you to apply general principles. A useful approach:
- What am I testing? Usually any misstatement, but sometimes only overstatement (occurrence or existence), understatement (completeness) or one aspect, such as valuation. Choose the assertions involved.
- How does the system work, and what documents exist? Think about the system in the question and note ideas.
- Are there special tests for this area? A year-end inventory count for inventory that the auditor can attend, direct confirmation for receivables, and so on.
- Which methods give the evidence? Inspection, observation, enquiry, confirmation, recalculation, reperformance, analytical procedures and, for IT systems, audit software.
Computer-assisted audit techniques: audit software
Of the two kinds of computer-assisted audit technique, test data is used mostly for tests of controls and audit software mostly for substantive testing. Audit software is computer programs used by the auditor to extract information from a computer-based system for use in the audit. The main types are:
- Interrogation programs to access the client's files and extract data for audit;
- Interactive software for interrogating online systems; and
- Resident code or embedded software that monitors and reviews transactions while the client's programs process them, called embedded audit facilities.
Uses include account analysis, such as extracting from the general ledger every item above ₦5,000 in the repairs account, and calculating ratios and making comparisons for analytical procedures.
Example: receivables. Where the client has a computerised sales and receivables system, the software can: total the balances on the ledger accounts and compare the total with the control account; compare each customer's balance with its credit limit; apply a reasonableness check that looks for unusually high or low balances given the volume and value of transactions; prepare an aged list of receivables if the client does not produce one, to help judge which may be irrecoverable; select the sample of balances for testing; and calculate ratios, such as average days to pay and changes in it over time, which help judge irrecoverable debts and perhaps going concern.
Example: Kitchen Magic. A wholesaler keeps a permanent inventory record on its system and lists year-end inventory by product with date of last purchase, date of last sale, cost, selling price, quantity and valuation.
Audit software tests:
- (a) cast the schedule
- (b) list all items over a set amount, at least the materiality threshold, for physical verification
- (c) multiply the lower of cost and selling price by quantity for each item and list those that do not agree to the year-end valuation
- (d) compare prices with the current sales price master file
- (e) list items with a last purchase more than, say, a month ago, which may be obsolete or damaged
- (f) list items with a last sale more than, say, a month ago, for the same reason
- (g) list items that do not appear on the post year-end sales listing for the first month, which may show that a provision is needed
If done manually only a sample would be checked, but with software all items can be tested.
Embedded audit facilities
Embedded audit facilities, also called resident audit software or an integrated audit module, are audit software built into the client's system, temporarily or permanently. They let the auditor test while transactions are being processed, in real time. They are useful for online systems where data is continually processed and master files continually updated, or where the system cannot give a satisfactory audit trail.
The facility may print or copy the transactions it monitors so the auditor can study them.
Problems with audit software
Audit software may need to be written to fit the client's IT system, so can be expensive, especially:
- when used for the first time for a client, because of set-up cost
- when the client changes its accounting system, so new software is needed
- when the client has an old purpose-written system with incomplete documentation
If the auditor uses copies of the client's files, the client may give a file that is not a copy of the live file, so the auditor should insist on being present to observe the copying.
Auditing around the computer
An alternative is to audit around the computer. The client's software is not audited. The auditor checks the inputs and compares the actual output with the expected output.
This has greater audit risk, because with no testing of files or programs there is no evidence that the programs work as documented, and when the auditor finds a difference between input and output, there is no way to see how it occurred. That increases the risk that the auditor cannot give an unmodified opinion.
Methods of obtaining audit evidence
| Method | Meaning | Example (Kitchen Magic inventory) |
|---|---|---|
| Inspection | Looking at the item or document | Trace items on the year-end inventory schedule to the actual goods |
| Observation | Watching a procedure being done | Observe the counting of inventory during the year to judge the accuracy of the records |
| Enquiry | Asking questions | Ask management whether a year-end inventory provision is needed |
| Confirmation | A specific enquiry of an outside party | Write to third parties that hold goods for the client to confirm existence and condition |
| Recalculation | Checking arithmetic | Use software to cast the inventory schedule |
| Reperformance | Doing again a check the client did | Use software to re-perform the ageing of the inventory schedule |
| Analytical procedures | Evaluating relationships in the data | Compare inventory days to prior year and to budget (covered in the next topic) |
How reliable is audit evidence?
Where inherent risk and control risk are high, the auditor needs more evidence from substantive testing, to reduce detection risk. The guidelines of ISA 500 on reliability are:
- Evidence from external sources is more reliable than evidence from the client's own records. A customer's written confirmation of a balance beats a copy of the invoice in the client's file.
- Evidence from the client's own records is more reliable when its controls operate effectively.
- Evidence obtained directly by the auditor, through inspection and analytical procedures, is more reliable than evidence obtained from the client's staff or records.
- Documentary evidence is more reliable than oral evidence, such as answers to questions.
These are guidelines and not rules. The auditor uses judgement to decide whether the evidence is sufficient and appropriate, and if it is not, looks for more, or the opinion will be affected.
Reliability of documents. The least reliable are documents created and held within the client, such as sales invoices. More reliable are documents created by an outsider but held by the client, such as supplier invoices and bank statements. The most reliable is a document obtained from an outsider and held by the auditor, such as a customer's written confirmation of its balance.
Directional testing
The auditor is mainly concerned with errors, which may overstate or understate, and omissions, which understate.
Overstatement (existence or occurrence). The worry is assets or liabilities that do not exist, or income or expenses that did not occur. A fraudster may record fictitious inventory (a debit) to improve the statement of financial position and offset it with fictitious sales (a credit) to boost profit. The first golden rule: to detect overstatement, start with the figures in the accounting records and trace back to supporting evidence.
For receivables, take the list of balances at the year end and either write to the customers to confirm or trace a sample back from the receivables ledger to the sales day book to the invoice.
Understatement (completeness). The worry is items missing. To boost profit a company might leave out purchases, so purchases (debits) are understated and trade payables (credits) are missing. The second golden rule: to detect understatement, start with a source outside the accounting records, a "reciprocal population", and trace into the accounts.
For payables, the list of payables is no use as a starting point, because it may be incomplete and completeness is what is being tested. Instead write to regular suppliers who would be expected to be creditors at the year end, or take a sample of goods received notes, supplier statements, unpaid invoices or subsequent payments and trace each through from purchase invoice to purchases day book to payables ledger.
| Testing for | Assertion | Start at | Trace to |
|---|---|---|---|
| Overstatement | Existence, occurrence | The accounting records | Supporting evidence |
| Understatement | Completeness | Evidence outside the records | The accounting records |
Understatement is much harder to detect, because the auditor is trying to audit something that is not there. With overstatement the auditor checks that what is there is valid.
Double entry logic. Directional testing rests on double entry. If the trial balance balances, one error implies another. An overstated debit implies an understated debit elsewhere or an overstated credit. An understated credit implies an overstated credit or an understated debit. A mechanical approach follows: test debits (assets and expenses) for overstatement only and credits (liabilities, income and equity) for understatement only.
But many scandals and money-laundering frauds involve overstated income, which is a credit. So the auditor must follow risk-based principles and focus on the higher-risk areas, whatever they are, and not apply the rule mechanically.
Why the statement of financial position is emphasised
The auditor usually pays more attention to the statement of financial position than to the income statement. If the closing statement of financial position is right and the opening one was right, the profit that links them must be right. The emphasis is on assets and liabilities more than equity, since if both are correct, equity (assets less liabilities) is correct.
The emphasis is a matter of degree. The income statement and equity are not ignored, but they get less audit time. The focus is:
- Assets: existence, rights and obligations (ownership) and valuation;
- Liabilities: completeness, cut-off and accuracy.
Planning substantive procedures: nature, timing and extent
The auditor plans three things. Nature is the type of test, such as a test of detail or an analytical procedure, and the method. Timing is when it is done, at an interim date or at the year end; if done at an interim date, the auditor adds procedures to cover the remaining period. Extent is how much is done, such as the sample size.
Higher assessed risk means more reliable evidence, a later date and a larger extent. For significant risks, such as revenue recognition, the auditor must perform tests of detail, because analytical procedures alone are not enough. For management override, the three tests ISA 330 requires in every audit apply, and the auditor looks for entries made at unusual times, by unusual people or with round amounts.
Documentation of the tests
Each test is recorded in the working papers with its objective and the assertion tested, what was done, the sample and how it was selected, the results, the exceptions found and the conclusion. A misstatement found is carried forward to the schedule of misstatements. The result of each test feeds the overall conclusion on whether the evidence is sufficient and appropriate.
Matching tests to assertions
For each assertion the auditor asks what evidence would show that it is true. The table gives typical tests. It is a guide, and the actual tests depend on the client's system and the risks found.
| Assertion | Typical test of detail | Direction and evidence |
|---|---|---|
| Occurrence of sales | Select entries in the sales ledger and agree to dispatch notes, customer orders and signed delivery notes | From the records to documents; internal and external documents |
| Completeness of sales | Select dispatch notes and trace to invoices and the sales ledger; review credit notes after the year end | From outside the records into them |
| Accuracy of expenses | Recalculate a sample of invoices; agree prices to price lists and contracts | Recalculation and inspection |
| Cut-off | Examine documents for the last few days before and the first few days after the year end and see that each is in the right period | Inspection of dates on dispatch notes, goods received notes and invoices |
| Classification | Review a sample of postings to the expense accounts and check the nature of each | Inspection of invoices and ledger analysis |
| Existence of assets | Inspect assets; attend the inventory count; confirm receivables and bank balances | Inspection, observation and confirmation |
| Rights and obligations | Inspect title deeds, vehicle documents, lease agreements and supplier terms such as sale or return | Inspection of documents |
| Completeness of liabilities | Search for unrecorded liabilities: examine payments after the year end, supplier statements and goods received notes near the year end | From outside the records into them |
| Valuation | Check the cost of inventory to invoices; compare cost to net realisable value; test depreciation and impairment; review the allowance for doubtful debts | Recalculation, inspection and enquiry |
| Presentation and disclosure | Compare the statements to the checklist of disclosures required by the applicable standards and the Companies and Allied Matters Act 2020 | Inspection against a checklist |
Sufficient and appropriate evidence
ISA 500 requires the auditor to obtain sufficient appropriate evidence. Sufficiency is the quantity of evidence, and it is affected by the risk of misstatement: higher risk needs more evidence. Appropriateness is the quality of evidence, its relevance and its reliability. The two go together, because a large quantity of weak evidence does not make up for poor quality.
For example, many internally created invoices do not give the assurance that one bank confirmation does. When information used as evidence was produced by the client, the auditor must test that it is accurate and complete enough for the audit purpose, for example by testing the report from which a sample is drawn.
Interim and year-end testing
Substantive tests can be done at an interim date, before the year end, to spread the workload. If so, the auditor must cover the gap between the interim date and the year end with further substantive procedures, or with tests of controls plus substantive tests, so that the remaining period is covered.
The risk of misstatement in the remaining period rises when controls are weak, so the auditor should avoid interim testing in high-risk areas. Examples that suit interim testing are tests of fixed asset additions and of payroll, while cut-off and valuation tests need to be done at or after the year end.
Substantive procedures for fraud and for estimates
For the risk of fraud in revenue recognition, which ISA 240 presumes, the auditor must do tests of details that respond to it, such as testing of sales near the year end, confirmation of unusual contracts and review of credit notes issued after the year end.
For accounting estimates such as allowances and provisions, ISA 540 requires the auditor to review the method and assumptions, compare with previous estimates and later events and decide whether management's point estimate is reasonable. The auditor does not accept management's estimate unchallenged.
A checklist for an exam answer on any balance
- Objective. State the assertion, for example existence of inventory.
- Population. Say what the starting list is, and how complete it is.
- Direction. From the records to the evidence for overstatement, from the evidence to the records for understatement.
- Method. Name inspection, confirmation, observation, recalculation, reperformance, enquiry or analytical procedure, and say why it suits.
- Reliability. Prefer external, direct and documentary evidence.
- Result. Say how an exception is followed up: extend the sample, ask management, propose an adjustment and carry the amount to the schedule of misstatements.
For example, to test the existence of trade receivables of ₦240 million: take the receivables list at the year end, select a sample using a method that covers large balances and a random selection of small ones, send confirmation requests directly from the auditor and receive replies directly, follow up non-replies by inspecting later cash receipts and dispatch documents, and investigate every difference.
To test the completeness of the same population, the auditor takes a sample of dispatch notes in the last week of the year and traces them to invoices recorded in that year, and reviews credit notes issued after the year end.
Tests of details compared with analytical procedures
| Feature | Tests of details | Analytical procedures |
|---|---|---|
| Basis | Individual items in a population | Relationships in the whole account |
| Strength | Direct, specific evidence | Quick, cheap, covers the whole population |
| Weakness | Time-consuming; covers only a sample unless software is used | Less precise; relies on stable relationships and reliable data |
| Best for | High-risk areas, existence, ownership, valuation | Large volumes of regular transactions, such as payroll and rent |
Worked examples
Example 1: choosing the starting point. The auditor wants to know whether all goods dispatched in the last week of the year were invoiced in that year.
- This is completeness of sales, which is a test for understatement.
- The starting point should be outside the sales records: a sample of dispatch notes from the last week, traced to the sales invoices and the sales day book.
Example 2: overstatement of assets. The auditor wants to know whether the machines in the non-current asset register exist.
- This is existence, a test for overstatement.
- Start with the register and inspect a sample of machines on the factory floor.
- To test completeness of the register the direction is reversed: pick machines on the floor and trace them to the register.
Example 3: reliability. The auditor has a customer's letter confirming a balance of ₦2.4 million, the client's copy of the invoice and a statement by the credit controller that the customer will pay.
- The most reliable evidence is the customer's letter: external, in writing and held by the auditor.
- The invoice is weaker, being created and held by the client, and the credit controller's statement is oral and from the client.
Example 4: audit software. A client has 12,000 receivables accounts. The auditor wants to find accounts over credit limit and old balances.
- Software can compare each balance with its credit limit, and age every unpaid invoice, in minutes.
- A manual test would be limited to a sample. Software tests the whole population.
How to score full marks
- State the assertion being tested before the test.
- Choose the direction of the test: records to evidence for overstatement, evidence to records for understatement.
- Match the method of evidence to the assertion and rate its reliability.
- Use audit software for large populations in IT systems and say why.
Common mistakes in the exam
- Testing completeness by starting from the ledger list.
- Giving tests of controls where tests of detail were asked for.
- Listing methods without linking them to an assertion.
- Applying the debit and credit rule mechanically and ignoring risk.
Quick revision
- Substantive: tests of details and analytical procedures.
- ISA 330 always: agree to records, journals, adjustments.
- Overstatement from the records; understatement from outside.
- External, direct, documentary evidence is most reliable.
- Audit software tests whole populations; embedded facilities test in real time.
Practice questions
Questions 1 to 10 are multiple choice. Questions 11 to 13 are written. Try each before opening the answer.
Question 1. Substantive procedures include tests of details and:
- Analytical procedures
- Tests of controls
- Walk-through tests
- Engagement letters
Show the answer
A. The two kinds.
Question 2. Which is always required by ISA 330?
- Examining material journal entries
- Confirming every balance
- Attending every count
- Testing all controls
Show the answer
A. Also agreeing to records and other adjustments.
Question 3. The assertion of occurrence relates to:
- Transactions
- Assets only
- Liabilities only
- Equity only
Show the answer
A. And disclosures.
Question 4. Existence is the equivalent of occurrence for:
- Assets, liabilities and equity
- Revenue
- Expenses
- Cash flow
Show the answer
A. Balances.
Question 5. To test understatement, the starting point is:
- A source outside the accounting records
- The ledger balance
- The trial balance
- The income statement
Show the answer
A. A reciprocal population.
Question 6. To test overstatement, the starting point is:
- The figures in the accounting records
- An outside source
- Nothing
- The audit report
Show the answer
A. Trace back to evidence.
Question 7. The most reliable documentary evidence is a document:
- From an outside party held by the auditor
- Created and held by the client
- Held by the client from outside
- Oral
Show the answer
A. Such as a confirmation.
Question 8. Embedded audit facilities allow tests:
- In real time while transactions are processed
- Only after year end
- Only on paper
- Only on test data
Show the answer
A. Built into the client's system.
Question 9. Auditing around the computer has greater audit risk because:
- The programs are not tested
- The auditor tests too much
- Software is free
- It is paperless
Show the answer
A. No evidence programs work.
Question 10. Recalculation means:
- Checking arithmetical accuracy
- Asking questions
- Looking at assets
- Watching a process
Show the answer
A. One of the seven methods.
Question 11 (10 marks). Explain the nature of substantive procedures and the financial statement assertions that they are designed to test. (8 marks)
Question 12 (10 marks). Explain directional testing, using trade receivables and trade payables as examples. (7 marks)
Question 13 (10 marks). Describe how audit software may be used in the audit of inventory and the problems in using it. (5 marks)
Model answers
Show the model answer to Question 11
Substantive procedures detect material misstatement and comprise tests of details and analytical procedures; ISA 330 requires agreement to records, examination of material journals and other adjustments. (3) Assertions: occurrence, completeness, accuracy, cut-off, classification for transactions; existence, rights and obligations, completeness, valuation for balances; and presentation and disclosure assertions, with brief meanings. (5)
Show the model answer to Question 12
To detect overstatement start with the figures in the records and trace to evidence; to detect understatement start outside the records and trace in. (2) Receivables: confirm balances or trace a sample from ledger to day book to invoice, for existence.
(2.5) Payables: write to regular suppliers or use goods received notes, statements, unpaid invoices or subsequent payments and trace to the ledger, for completeness; the payables list is not a suitable starting point. (2.5)
Show the model answer to Question 13
Uses: cast the schedule; list large items for verification; recalculate lower of cost and net realisable value; compare prices with master file; list items with no recent purchase or sale; compare with post year-end sales. (3) Problems: cost for first use, a change of system, old systems with poor documentation, and the need to observe copying of client files. (2)
Spotted a mistake? Tell us and we will check it.
