Non routine transactions

Non-routine transactions (eg perhaps sales of old non-current assets) probably have no controls, or else poor controls. However, they are (by definition) low volume so can be subjected to substantive testing fairly easily.

Debit and credit notes would probably not be classified as non-routine and should have good controls (after all, issuing a credit note is just like letting someone not pay). However, if these are rare and there are no controls, the notes (or a large proportion of them by value) need to be inspected during the audit to ensure they are backed up by documentation.