CPA AUD: Tests of Controls vs Substantive Procedures (2027 Prep)

The same payroll record can supply information for a control test and a substantive procedure, depending on what the auditor checks and why. Name the objective first.

Inspecting a supervisor's approval addresses a different issue from recalculating recorded pay, even when the auditor has the same timesheet open for both tasks. PCAOB's AS 1105, paragraphs .13-.15 classifies a procedure by its purpose and requires each objective to be achieved when a procedure serves multiple purposes. This tutorial assumes that framework. It uses fictional payroll records to show how an approval exception and a calculation discrepancy can arise independently, with no claim that either record establishes an audit conclusion.

Use the worked payroll observations (CSV) to follow four invented records and the evidence-purpose map (CSV) to compare their proposed evidence purposes. The blank procedure explanation record (CSV) gives you space to explain your own study example. Keep confidential payroll details and exam questions out of that record.

Describe the payroll control before inspecting a signature

Suppose fictional Cedar Studio requires a supervisor to check hours against authorized schedules before payroll processing. Record that requirement. A useful control explanation identifies who performs the review, what they compare and when the review must occur, so a mark beside a name does not silently stand in for all three requirements.

PCAOB AS 2301, paragraphs .19-.24 distinguishes control design from operation, including whether the control functions as designed and the performer has the necessary authority and competence. Inquiry alone is insufficient. A procedure intended to evaluate operation therefore needs evidence relevant to the actual review, rather than only a manager's statement that reviews normally happen. The records leave the approver's authority, review timing and work performed unverified, and those missing facts prevent a simple approval-present entry from becoming a conclusion that the control operated effectively.

In our invented records, the approval field reports whether an approval mark is supplied. Its meaning remains limited.

Recalculate an amount with the supplied inputs

Record T1 supplies eight hours, a rate of 25 dollars per hour and recorded gross pay of 200 dollars. Multiply the inputs. Eight times 25 equals 200 dollars, so the recorded amount agrees with this limited arithmetic check, while the approval field separately reports that a mark is present. This agreement does not establish that eight hours were actually worked or that 25 dollars was the authorized rate.

The inputs are assumptions for teaching. An auditor would need appropriate evidence for the relevant assertions, and arithmetic agreement cannot authenticate the employee or settle whether the underlying payroll information is complete.

T2 supplies six hours at the same rate and recorded gross pay of 150 dollars, with no approval mark supplied. Its multiplication also agrees. The missing approval and the agreement on amount are separate observations that need their own evaluation, rather than a reason to treat one observation as erasing the other.

Keep an approval mark separate from an amount discrepancy

T3 includes an approval mark, seven supplied hours and a supplied rate of 25 dollars, but recorded gross pay is 195 dollars. Recalculate it. Seven times 25 equals 175 dollars, leaving recorded pay 20 dollars above the amount produced by those inputs.

That difference needs investigation. It is a discrepancy against the supplied inputs, with no explanation about additional pay, input errors or other relevant terms, so the record does not label the 20 dollars a proven financial statement misstatement. The approval mark cannot resolve the discrepancy by itself.

T4 includes an approval mark and a rate of 30 dollars, but the hours field is blank and recorded pay is 120 dollars. Stop before filling the gap. Dividing 120 by 30 would produce four hours, but that would reconstruct an input from the amount being checked rather than supply independent evidence that four hours were worked.

Leave T4 unresolved. Its record has no calculated gross pay or discrepancy amount, and a later source or appropriate investigation is needed before the amount can be recalculated using supported inputs.

Design both purposes when one procedure serves two aims

Under PCAOB AS 2301, paragraph .47, a concurrent control and substantive test must be designed to achieve both objectives, with the results evaluated for both. Keep separate result fields. A payroll record can be inspected for evidence of the required review and recalculated for a relevant amount, but completing one step does not complete the other. The evidence-purpose map calls these proposed checks, with actual procedures and results blank.

It does not approve an audit approach. For T3, the map keeps the approval inquiry distinct from the arithmetic discrepancy, while T4 records the missing input that prevents completion of the proposed recalculation.

You can see why classifying a procedure only by the verb inspect is unreliable. State what is being inspected. An inspection of review evidence addresses the control objective, while inspecting source support for a recorded amount can serve a substantive objective if it is designed to address the relevant assertion.

Use the exception to identify the next evidence need

PCAOB AS 2301, paragraph .23 explains that control effectiveness cannot be inferred merely because substantive procedures found no misstatements. Test the control directly. T2 illustrates the reasoning error: arithmetic agreement on a fictional gross-pay amount does not supply the missing evidence that the required review occurred.

The reverse shortcut also fails in T3, where an approval mark appears beside an amount that does not agree with the supplied multiplication. Investigate the difference. Keep the observed exception, proposed follow-up and eventual result in separate fields so a planned investigation cannot be mistaken for completed evidence.

PCAOB AS 2301, paragraph .36 requires substantive procedures for relevant assertions of significant accounts and disclosures regardless of assessed control risk. Our four-row illustration does not set that scope. It supplies no population, sampling method or evidence sufficient to prescribe a sample size, conclude on the payroll balance or determine an audit opinion.

Write a study explanation that preserves the purpose

For your own notes, describe the control requirement or assertion, then name the evidence the proposed procedure is intended to obtain. Add the source reference. If the result is unresolved, record the missing fact instead of inventing an amount or converting an approval mark into proof of effectiveness. Return to AICPA's exam-content page for the blueprint appropriate to your intended testing date and check current authorized AUD instruction.

Keep frameworks visible. This article uses PCAOB terminology and has not inspected the linked blueprint PDFs or verified a detailed exam-task crosswalk, so it does not establish the requirements for every engagement or predict which topic you will see on an exam.

2027 preparation edition. Official public HTML checked October 12, 2026. Cedar Studio, payroll records and proposed checks are invented teaching material, not an actual payroll audit. Supplied approval marks do not establish authorized or timely review. Hours and rates are not verified work or authorized-pay evidence. T3 difference requires investigation and T4 remains unresolved. No sampling prescription, reporting conclusion or professional advice. PCAOB framework only. Blueprint PDFs, worksheets and assessment destinations not inspected. Qualified CPA review, matching AUD hub and current-source/live checks required before publication.