Tests of Controls

What are Tests of Controls (TOC)?

TOC are audit procedures performed to check whether a company’s internal controls are:

1. properly designed, and
2. operating effectively (working consistently as intended).

If the controls are effective, the auditor may reduce some substantive testing (detailed testing of transactions/balances). If not effective, the auditor increases substantive procedures.

---

Simple example

Control: Every supplier payment must be approved by the Finance Manager.

TOC: The auditor selects a sample of payment vouchers and checks whether:

• the Finance Manager’s approval/signature is present,
• the approval was done before the payment date, and
• the supporting documents are attached (invoice, PO, GRN).

---

How auditors perform TOC (common methods)

• Inquiry: ask staff how the control is done
• Observation: watch the control being performed
• Inspection: check documents/records for evidence of the control
• Reperformance: auditor repeats the control (strong evidence)

---

Difference: TOC vs Substantive testing

• TOC = “Did the control work?”
• Substantive testing = “Is the account balance/transaction amount correct?”

If you tell me the topic (cash, revenue, purchases, inventory, payroll), I can give you 3–5 TOC examples specifically for that area.