The integrity of reference data is an important element in testing credit policy controls.
A correctly functioning computer application cannot successfully apply credit policy
if customer credit limits are excessively high or can be changed by unauthorized
personnel. The auditor needs to verify that authority for making line-of-credit changes
is limited to authorized credit department personnel. Performing substantive tests of detail
to identify customers with excessive credit limits can do this. Substantive tests traditionally
follow tests of controls because the results of tests of controls are used to
determine the nature, timing, and extent of the substantive tests. In this case, however,substantive tests may be the most efficient way to verify if credit policy is being properly
applied.