How are substantive procedures different from control tests?

A test of controls asks whether a control is designed or operating effectively. A substantive procedure asks whether the underlying transaction, amount, disclosure, or condition is supported.

Example:

• Control test: inspect whether the purchasing manager approved vendor master changes before payment setup.
• Substantive procedure: test payments to new vendors to determine whether the vendors and invoices were valid.

Both may use similar evidence, but they answer different questions. If the control failed, you may need more substantive work because you can no longer rely on that control to reduce risk. If substantive testing finds errors, you may need to revisit whether the related controls are designed or operating well.

The exam trap is assuming all testing is the same. Always ask: am I testing the process control, or am I testing the actual record or result?