If internal control is poor the auditors have to increase their substantive tests. For example, if paid supplier invoices are not cancelled there is a risk that the absence of this control (= control risk) invoices could be paid more than once. In response, the auditors would have to inspect supplier invoice and payments to see if multiple payments had occurred.