SA 330 states that auditor shall design and perform tests of controls to obtain sufficient appropriate audit evidence as to operating effectiveness…

The auditor shall design and perform tests of controls to obtain sufficient appropriate audit evidence as to the operating effectiveness of relevant controls when: (i) The auditor's assessment of risks of material misstatement at the assertion level includes an expectation that the controls are operating effectively (i.e., the auditor intends to rely on the operating effectiveness of controls in determining the nature, timing and extent of substantive procedures) or (ii) Substantive procedures alone cannot provide sufficient appropriate audit evidence at the assertion level. In designing and performing tests of controls, the auditor shall obtain more persuasive audit evidence, the greater the reliance the auditor places on the effectiveness of a control. A higher level of assurance may be sought about the operating effectiveness of controls when the approach adopted consists primarily of tests of controls, in particular, where it is not possible or practicable to obtain sufficient appropriate audit evidence only from substantive procedures.