When should an auditor rely on controls?
An auditor should plan to rely on controls when the controls are relevant to the assessed risk, are suitably designed and implemented, and testing their operating effectiveness is expected to produce an effective audit response.
Reliance may be necessary where substantive procedures alone cannot provide sufficient appropriate evidence. It may also be efficient where strong, repeatable controls reduce the amount or nature of substantive work required. The decision depends on the client, the risk, the control and the firm's methodology; it should not be driven by a blanket preference for either controls or substantive testing.
The economics matter in practice. Firms sometimes avoid control reliance because documenting and testing controls takes too long. That can create a cycle in which the work needed to rely on controls is never efficient enough to perform, so substantive testing remains the default.
Technology can change that calculation by reducing the manual cost of process understanding, control assessment and evidence handling. It does not make weak controls reliable. It makes it more practical to identify and test good controls where reliance is appropriate.
References: ISA 315 risk assessment resources · PCAOB AS 2201