What Is Substantive Testing and How Does It Work?

Substantive testing in auditing is the set of procedures an auditor performs to gather direct evidence that the numbers reported in a company’s financial statements are accurate and complete. The goal is to detect material misstatements: errors or omissions large enough to change the decisions of someone relying on the reports. For audits of public companies, substantive procedures are required for every relevant assertion of every significant account, no matter how well internal controls appear to be working.¹

The Two Categories of Substantive Procedures

Substantive work splits into analytical procedures and tests of details. Auditors typically use both, because each answers a different question about the numbers.

Analytical Procedures

Analytical procedures look at the big picture. The auditor builds an expectation of what a number should be, then compares that expectation to what the company actually reported. If the two diverge beyond a reasonable threshold, the auditor investigates.

Trend analysis is the most common approach: comparing a current-year balance to prior years or to industry benchmarks. If a retailer’s cost of goods sold jumped 18% while revenue grew only 4%, the auditor wants to know why. Ratio analysis works the same way, using relationships between accounts that should move together — debt-to-equity, inventory turnover, gross margin. Non-financial data can sharpen the expectation further. Headcount can be used to estimate what payroll should be. Production square footage can be compared against utility costs. If a factory’s electricity bill doubled while output stayed flat, the gap needs an explanation before the auditor signs off.

The strength of an analytical procedure depends on how tightly the expectation is defined and how reliable the underlying data is. A vague estimate catches less than a precise one.

Tests of Details

Tests of details drill into specific transactions and balances rather than trends. An auditor might pull a sample of recorded sales and verify each one against shipping documents, customer purchase orders, and payment records. This transaction-level work is the backbone of most audits because it produces concrete evidence about individual amounts.

Tests of details fall into two groups. Testing ending balances means verifying the final number in a ledger account, such as confirming that reported cash matches what the bank says is there. Testing transactions means examining the individual entries that built the balance over the year: each deposit, withdrawal, invoice, or transfer.

The Assertions Behind Every Test

Every substantive procedure is designed to verify one or more assertions: the specific claims a company implicitly makes when it publishes financial statements. Understanding these assertions explains why the auditor picks one method over another.

Existence or occurrence: assets and liabilities actually exist, and recorded transactions actually happened. Counting inventory tests existence.
Completeness: everything that should be recorded has been recorded. Instead of asking “is this real?” the auditor asks “is anything missing?”
Accuracy, valuation, and allocation: amounts are recorded at appropriate values. A building on the books at $2 million should reflect its actual worth under applicable accounting standards, including proper depreciation.²
Rights and obligations: the company actually owns or controls the assets it reports and is genuinely obligated on the liabilities it discloses.²
Cutoff: transactions are recorded in the correct accounting period. A sale completed on December 28 should appear in the current year, not the next.
Classification and presentation: items appear in the right accounts and are properly described in the disclosures.

Which assertion matters most depends on the account. For inventory, existence and valuation dominate. For accounts payable, completeness is usually the bigger risk, because companies are more likely to leave debts off the books than to invent ones that don’t exist.

Common Testing Methods

Auditors draw from a familiar toolkit, and each procedure suits certain assertions better than others.

Physical Inspection

When an auditor needs to verify that inventory or equipment exists, they observe it firsthand. For inventory counts, auditors are ordinarily expected to be present during the physical count, testing the company’s counting methods and spot-checking quantities against records.³ Physical inspection gives strong evidence for existence but reveals almost nothing about valuation or rights. A warehouse full of goods doesn’t show whether the company owns them or whether they’re worth what the books say.

External Confirmation

Rather than relying on the company’s own records, the auditor contacts an independent third party directly. A bank confirms cash balances. A customer confirms how much they owe. A lender confirms outstanding principal and terms.⁴ Because the information comes from outside the company, confirmations are considered highly reliable. When third parties don’t respond, the auditor performs alternative procedures.

Recalculation and Reperformance

Recalculation means the auditor independently redoes the math on items like depreciation schedules, interest expense, or tax provisions. Reperformance goes further: the auditor executes the same internal procedure the company’s staff originally performed, using the same inputs, to see whether the output matches. Both produce high-quality evidence because they don’t depend on anyone’s say-so.

Vouching and Tracing

These two procedures move in opposite directions, and the direction is the point. Vouching starts with an entry already in the financial records and works backward to the source document: an auditor sees a $50,000 sale in the ledger and hunts for the corresponding invoice, shipping receipt, and customer order. Vouching primarily tests existence, because it asks whether recorded transactions really happened.

Tracing works the other way. The auditor starts with a source document, such as a shipping receipt, and follows it forward into the accounting records to confirm it was captured. Tracing primarily tests completeness, because it reveals transactions that occurred but never made it into the books. An auditor who only vouches could miss unrecorded liabilities entirely, because those liabilities never appear in the ledger to be tested in the first place.

Cutoff Testing

Transactions near the boundary between accounting periods are prime candidates for misstatement. Cutoff testing checks whether sales, purchases, and other transactions recorded in the final days of one period and the first days of the next are assigned to the correct period. A common approach is to pull the last several shipping documents before year-end and the first several after, then check that each corresponding sale was booked in the right period. Revenue recognized a few days early can inflate current-year performance. Expenses pushed into the next period can make the current year look more profitable than it was.

What Determines the Scope of Testing

Not every account gets the same scrutiny. Auditors calibrate the volume, nature, and timing of their procedures based on several factors.

Risk of Material Misstatement

The higher the risk that an account contains a significant error, the more testing it gets. The auditor weighs both the likelihood of misstatement and its potential size. Complex estimates like loan loss reserves or goodwill impairment carry inherently higher risk than straightforward accounts like prepaid rent, so they attract more intensive procedures.¹

Materiality

Materiality is the dollar threshold above which an error would likely influence the decisions of someone relying on the financial statements. Auditors set a materiality level during planning, often calculated as a percentage of revenue, total assets, or net income, and then set a lower “performance materiality” as a cushion. The lower the threshold, the smaller the errors the auditor must detect, which pushes sample sizes up and procedures deeper.

Strength of Internal Controls

When a company has strong internal controls, such as proper segregation of duties, effective supervisory review, and reliable automated systems, the auditor can often reduce sample sizes because the system itself is catching errors. When controls are weak or untested, substantive testing expands to compensate. Even with strong controls, though, auditors must still perform some substantive procedures on every significant account.¹

Sample Size

The relationship between risk tolerance and sample size is direct. An auditor targeting 95% confidence needs roughly 59 items in a sample when tolerating a 5% error rate, but that number jumps to about 99 if the tolerance drops to 3%.⁵ Auditors also use judgmental sampling to target specific high-risk items: transactions just above approval thresholds, entries posted by a single individual, or amounts recorded on unusual dates.

Timing: Interim Versus Year-End

Auditors don’t have to wait until after the fiscal year closes to begin substantive work. Performing procedures at an interim date, say nine months into a twelve-month year, spreads the workload and can surface problems earlier. Interim testing creates a gap, though. The period between the interim date and the balance sheet date still needs coverage, usually through analytical procedures comparing interim balances to year-end balances or targeted tests of transactions during the uncovered months. If the control environment is weak during the remaining period, or if business conditions are shifting fast, testing as of the balance sheet date is often the safer approach.

Documenting the Work

Audit documentation is the primary evidence that the work actually happened. Every substantive procedure must be documented in enough detail that an experienced auditor with no connection to the engagement could understand what was done, what evidence was gathered, and what conclusions were reached.⁶

Documentation takes many forms: memos explaining the rationale behind an analytical procedure, copies of bank confirmations, schedules showing recalculated depreciation, signed inventory count sheets. Each piece must link clearly to the assertion being tested and the conclusion reached. When evidence contradicts the auditor’s final conclusion, that contradictory evidence must also be documented, along with an explanation of how it was resolved.⁶

For public company audits, the Sarbanes-Oxley Act requires that all audit workpapers be retained for at least five years from the end of the fiscal period in which the audit concluded.⁷ Regulators, courts, and successor auditors may need to review the work long after the engagement ends.

How the Results Shape the Audit Opinion

Substantive testing exists to give the auditor enough evidence to form an opinion on the financial statements. The results feed into one of four outcomes.

Unqualified (clean) opinion: the financial statements are fairly presented in all material respects. Substantive testing turned up no material misstatements.
Qualified opinion: the auditor found a material misstatement or couldn’t get enough evidence on a specific area, but the issue isn’t pervasive enough to undermine the statements as a whole.⁸
Adverse opinion: the misstatements are both material and pervasive, and the financial statements as a whole do not present a fair picture.⁸
Disclaimer of opinion: the auditor couldn’t get enough evidence to form any opinion, and the potential impact of the missing information is pervasive.

A qualified or adverse opinion doesn’t always mean fraud. It can result from a legitimate disagreement over accounting treatment or from inadequate records. But the market reaction is usually quick and negative, with pressure from investors, lenders, and regulators arriving fast.

Consequences When Substantive Testing Falls Short

Auditors who skip or inadequately perform substantive procedures face serious professional and legal consequences. The PCAOB, which oversees audits of public companies, has authority to censure auditors, impose civil money penalties, and bar individuals from the profession. In a 2024 enforcement action, the PCAOB sanctioned two former audit partners for failing to obtain sufficient evidence to support their audit opinions, imposing penalties of $55,000 and $45,000 and barring both from public company audit work for at least two years.⁹

Companies face SEC enforcement when material misstatements go undetected or are deliberately concealed. In fiscal year 2024, the SEC obtained $8.2 billion in financial remedies across all enforcement actions and barred 124 individuals from serving as officers or directors of public companies.¹⁰ Self-reporting and cooperation can reduce penalties, but the reputational damage can be lasting.

Auditors also face civil liability for professional negligence. A plaintiff generally must show the auditor owed a duty of care, breached it by departing from professional standards, and caused financial harm. A material departure from fundamental duties, such as failing to evaluate fraud risk or failing to adjust procedures when red flags appeared, is typically strong evidence of a breach, and judgments in such cases can dwarf the original audit fees.

1
PCAOB. AS 2301: The Auditor’s Responses to the Risks of Material Misstatement
2
ACCA Global. The Audit of Assertions
3
PCAOB. AS 2510: Auditing Inventories
4
PCAOB. AS 2310: The Auditor’s Use of Confirmation
5
Office of the Comptroller of the Currency (OCC). Sampling Methodologies Comptroller’s Handbook
6
PCAOB. Auditing Standard No. 3: Audit Documentation
7
U.S. Securities & Exchange Commission. Retention of Records Relevant to Audits and Reviews
8
PCAOB. AS 3105: Departures from Unqualified Opinions and Other Reporting Circumstances
9
Public Company Accounting Oversight Board. PCAOB Sanctions Three Auditors for Failures Relating to Audit Evidence, Skepticism, and Other Violations
10
U.S. Securities and Exchange Commission. SEC Announces Enforcement Results for Fiscal Year 2024