What is the BEST sequence of testing

The most logical and efficient sequence in an assurance or audit process is to first perform tests of controls. The results of these tests determine the auditor's level of reliance on the organization's internal control system. If controls are deemed effective, the auditor can justify reducing the nature, timing, and extent of substantive testing. This risk-based approach, which is central to GRC principles, ensures that assurance resources are focused on areas of higher risk and optimizes the overall efficiency of the evaluation.

B. Substantive testing and then control testing: This sequence is inefficient and contrary to the principles of a risk-based audit. It may lead to performing excessive substantive work that could have been reduced if effective controls were identified first.

1. OCEG GRC Capability Model ("Red Book"), Version 3.0. Section 4.4, "MONITOR & AUDIT," emphasizes that evaluations are conducted "to provide assurance that objectives are achieved and controls are operating effectively." This establishes the principle of evaluating controls as a primary step in providing assurance, which then informs the overall conclusion on the achievement of objectives.

2. International Standard on Auditing (ISA) 330, The Auditor’s Responses to Assessed Risks. This standard, foundational to auditing education and practice, outlines the required sequence. Paragraph 8 states that an auditor designs and performs tests of controls to obtain evidence about their operating effectiveness when the auditor's risk assessment includes an expectation of the controls operating effectively. Paragraph 18 then requires the auditor to design and perform substantive procedures based on that risk assessment. This clearly places control testing before the final determination of the scope of substantive testing.

3. University of Florida, Warrington College of Business, ACG 4632 - Auditing 1 Course Material. Auditing curricula at reputable universities consistently teach that the audit process involves assessing control risk (which includes testing controls) to determine the appropriate level of detection risk and, consequently, the necessary scope of substantive procedures. This sequence is a fundamental concept of modern risk-based auditing.