I’m quite confused about forming the answer for audit responses. When to write substantive testing or test of controls or both
So I wonder if I can think of the answer in this way: For inherent risk I will think of substantive testing For control risk I will think of test of controls, to see how controls fail
You can only deal with control weaknesses if the question has described them. However, if a control is missing (eg purchase incoices not matched to orders) you cannot test that control: it simply isn’t there. If a control is missing you have to perform more substantive tests, which will usually relate to inherent risks ie invoices are paid for goods that haven’t been ordered.
If a control is supposed to be present then you must test that to ensure it is operating.