1. Obtain an understanding of the entity, it's business/environment/ industry, internal control.(generally used for assessing RMM)
2. Test of Controls, procedures used to obtain evidence needed to assess Control Risk(CR).(generally used for assessing RMM)
Simply put- you understand what controls organization has/ believes it has in place,and then you assess whether those controls are actually working as they are supposed to. For example, the accounts payable manual states that, different people are assigned to -
1. Post vendor bills.
2. Approve expense.
3. Approve payment
4. Prepares check.
5. Signs the check.
But on examination you notice that expenses are missing approvals, or the AP Person , is both posting the expenses as well as approving the wire payments, suggesting weak Internal controls, or that the internal controls are not working as they ought to-Suggesting that there's a higher control risk.
3.Substantive test of transaction, procedures to test for the dollar amount misstatement in Financial statements.(generally used for assessing RMM)
5.Analytical Procedures, as an audit test are used to indicate possible misstatement.(generally used for DR)
Note that Analytical procedures are used-
a. For planning the nature, extent, and timing of other auditing procedures (mandatory);
b. As substantive tests to obtain audit evidence (optional);
c. As an overall review in the final review stage of the audit (mandatory).