If controls over systems development and maintenance are weak, however, the
auditor may decide that testing the data editing controls would be more efficient
than performing extensive substantive tests of details. In such a case, ITF or the
test data approach would enable the auditor to perform explicit tests of the logic.
This type of testing would require the auditor to gain a familiarity with all of the
validation procedures in place. The auditor would need to create a comprehensive
set of test transactions that include both valid and erroneous data values that fall
within and outside of the test parameters. An analysis of the test results will show
the auditor which types of errors, if any, can pass undetected by the validation program.
This evidence will help the auditor determine the nature, timing, and extent of
subsequent substantive tests.