What Is Reperformance in Auditing? Independently Redoing Controls and Calculations

Reperformance sits near the top of the audit evidence hierarchy. ISA 500 lists the procedures for obtaining evidence — inspection, observation, external confirmation, recalculation, reperformance, analytical procedures, inquiry — and ranks them implicitly by independence from the preparer. Reperformance wins on that ranking: the auditor does the work. When the auditor re-ages the receivables ledger from raw invoice data and the aging matches the client's, the evidence is not 'the client says so, and it looks right' — it is 'I did it, and it agrees'.

The procedure serves two masters. As a test of controls, reperformance shows a control operated effectively: re-running the automated three-way match, re-performing the monthly bank reconciliation, re-executing the credit-approval workflow. As a substantive procedure, it verifies amounts: recalculating depreciation, interest, gratuity, tax — the arithmetic heart of the financial statements.

Reperformance's power comes with a boundary: it tests operation, not design. A control can be re-performed flawlessly all year and still be the wrong control for the risk. Design evaluation — through inquiry, inspection and walkthrough — must come first; reperformance then proves the well-designed control actually ran.

Effective reperformance follows a disciplined pattern.

Define exactly what is being re-performed. The control as documented, or the calculation as specified — not an approximation. For an automated credit-limit check, that means re-running the system's actual logic, not a spreadsheet proxy that assumes the logic.

Use independent data and tools. Re-aging receivables means extracting invoice and receipt data independently and building the aging from scratch — not re-sorting the client's aging report. Independence of source is what gives the procedure its strength.

Cover the period. For manual controls, re-perform across the audit period (sampling months), not just year-end. A control that operated in December but not in June is not operating effectively for the period.

Handle IT properly. For automated controls, reperformance often means using computer-assisted techniques: re-processing transactions through a test environment, or extracting and re-applying programmed logic. This requires IT competence on the team — or an IT specialist under ISA 620.

Evaluate exceptions fully. A reperformance that disagrees with the client is a finding, not a curiosity. Investigate the cause, assess whether it indicates a control deficiency or misstatement, and extend procedures if the cause is systematic.

UAE audits use reperformance intensively, for structural reasons. Weak control environments in many SMEs mean auditors cannot rely on controls — but reperformance still serves substantively: re-aging receivables, recalculating provisions, re-performing tax computations. The procedure does not need the client's controls to be good; it needs the underlying data to exist.

WPS payroll testing is a UAE signature application. Auditors re-perform the payroll-to-WPS reconciliation: independently footing payroll registers, tracing to WPS files and bank debits. It tests completeness of salary expense, compliance with wage-protection rules, and — increasingly — the payroll data feeding Corporate Tax deductions.

Corporate Tax computations are now routinely re-performed: from trial balance through adjustments to taxable income, the auditor independently rebuilds the computation rather than checking the client's. Given the law's youth and the FTA's scrutiny, reperformance is the only procedure that gives real comfort over a novel tax position.

ECL and gratuity models in UAE companies are often spreadsheet-based and formula-fragile. Re-building the model independently — not just checking the client's formulas — catches the hardcoded overrides and broken links that spreadsheet models accumulate. Every UAE auditor has a story about a reperformance that found a formula error the client had carried for years.

Oasis Facilities Management LLC runs monthly bank reconciliations for 12 accounts. The auditor plans to rely on this control for cash. Design evaluation (walkthrough, inspection of the reconciliation template and approval signatures) suggests the control is well designed.

Reperformance: for four sampled months, the auditor independently re-performs the reconciliation — extracting bank statements directly (via online read-only access), footing the cash book from the system, and re-building the reconciling-items schedule. Three months agree to the dirham. April shows a AED 45,000 difference: the client's reconciliation carries an 'outstanding cheque' that the auditor's reperformance shows cleared in March — a stale reconciling item masking a book-to-bank difference.

Investigation: the item relates to a duplicate supplier payment, now identified and provided for. The control is not operating effectively (a material reconciling item was invalid), so reliance is withdrawn for cash; substantive procedures are extended (all reconciling items over AED 10,000 tested). The reperformance did not merely find AED 45,000 — it changed the audit strategy for the entire cash balance. That leverage is why the procedure is prized.

Re-sorting instead of re-doing. Sorting the client's aging report differently and calling it reperformance. True reperformance builds from source data independently.

Testing design and calling it operation. A walkthrough in October does not prove the control ran in March. Reperformance must cover the period.

Ignoring IT general controls. Re-performing an automated control while change management is broken — the logic tested may not be the logic that ran all year. Test the IT environment too.

Filing without workings. 'Re-performed, no exceptions' with no evidence of what was done. An experienced reviewer must be able to understand and repeat the work.

Stopping at agreement. When reperformance agrees, concluding without considering whether the underlying data was complete. Reperformance verifies processing of the data provided — completeness of the population is a separate assertion needing separate evidence. The independence-of-execution point: reperformance must be genuinely independent — re-running the client's spreadsheet with the client's formulas is inspection, not reperformance. The auditor's version should be built separately (even if simply), so that a formula error in the client's model doesn't replicate into the 'independent' check. Document what was re-performed, the inputs used, and the result — the working paper should let a reviewer see the procedure was truly re-done, not just re-read.

Recalculation is reperformance's arithmetic subset — independently re-doing calculations. Test of controls is the ISA 330 procedure family reperformance most often serves. Walkthrough traces a transaction through the system to evaluate design — the precursor to reperformance testing operation. CAATs (computer-assisted audit techniques) are the tools for re-performing automated controls at scale. Bank reconciliation is the classic monthly control UAE auditors re-perform. And observation is reperformance's weaker cousin — watching someone perform a control proves less than doing it yourself.