If you are asked to test the operation of an internal control system, you can only use ToC.
If you are asked to test, for example, the wages figure you can use both. For example, insoect time sheets to ensure they have been authorised (ToC) and pay rise notifications similarly. You would also use substantive tests such as analytical procedures and recalculation of some wages.