--- title: A simple analogy to explain the difference between controls and substantive testing description: Understanding the difference between controls and substantive testing through a home insurance analogy for better algorithm reviews. image: https://riskinsights.com.au/hubfs/60.png --- [Skip to content](https://riskinsights.com.au/blog/a-simple-analogy-to-explain-the-difference-between-controls-and-substantive-testing#main-content) [![Risk Insights - Logo - (RGB, Horizontal, Small)](https://riskinsights.com.au/hs-fs/hubfs/Risk%20Insights%20-%20Logo%20-%20(RGB%2c%20Horizontal%2c%20Small).png?width=200&height=40&name=Risk%20Insights%20-%20Logo%20-%20(RGB%2c%20Horizontal%2c%20Small).png)](https://riskinsights.com.au) - [Articles](https://riskinsights.com.au/blog) - [Approach](https://riskinsights.com.au/approach) Show submenu for Approach - [Commissions (Accuracy)](https://riskinsights.com.au/broker-partner-commission-accuracy-reviews) - [Claims Fraud (Fairness)](https://riskinsights.com.au/claims-fraud-fairness-reviews) - [Fees and Charges (Accuracy)](https://riskinsights.com.au/fee-and-charge-accuracy-reviews-risk-insights) - [About](https://riskinsights.com.au/about) - [Contact](https://riskinsights.com.au/contact) Open main navigation Close main navigation - [Articles](https://riskinsights.com.au/blog) - [Approach](https://riskinsights.com.au/approach) Show submenu for Approach - [Commissions (Accuracy)](https://riskinsights.com.au/broker-partner-commission-accuracy-reviews) - [Claims Fraud (Fairness)](https://riskinsights.com.au/claims-fraud-fairness-reviews) - [Fees and Charges (Accuracy)](https://riskinsights.com.au/fee-and-charge-accuracy-reviews-risk-insights) - [About](https://riskinsights.com.au/about) - [Contact](https://riskinsights.com.au/contact) --- 30 Oct 2025 # A simple analogy to explain the difference between controls and substantive testing ![Picture of Yusuf Moolla](https://riskinsights.com.au/hs-fs/hubfs/Yusuf_Moolla_Headshot-transformed.png?width=50&name=Yusuf_Moolla_Headshot-transformed.png) [Yusuf Moolla](https://riskinsights.com.au/blog/author/yusuf) Share: [linkedin-in icon](http://www.linkedin.com/shareArticle?mini=true&url=https://riskinsights.com.au/blog/a-simple-analogy-to-explain-the-difference-between-controls-and-substantive-testing) [envelope icon](mailto:?body=https://riskinsights.com.au/blog/a-simple-analogy-to-explain-the-difference-between-controls-and-substantive-testing) **TL;DR** • In this analogy, controls testing = building insurance, substantive testing = contents insurance. • You usually need both, for peace of mind. • If you only pick one, understand the gap that this leaves.   In a previous article we explained [the difference between controls testing and substantive testing](https://riskinsights.com.au/blog/substantive-vs-controls-testing) when reviewing algorithmic systems. The concept is important to know when you’re thinking about a point-in-time internal review, commissioning an external review, or for your ongoing quality checks. This article provides an easy way to explain it to others. The analogy is not a perfect match, but it works well enough. Think about home insurance and the difference between building/structure and contents coverage. We know that building insurance covers the foundation, walls, roof etc. Contents insurance covers belongings, the day-to-day stuff. If you only have contents insurance and your house collapses due to foundation failure, you’re out of luck. Your contents coverage won't help with restoring the structure. If you only have building insurance and thieves steal your TV, you get nothing either. **Controls testing** is similar to building insurance. It checks whether the framework is in place. Do you have proper change management? Monitoring systems? Do you track what your algorithms are doing? **Substantive testing** is like contents insurance. It looks at what’s going on inside the algorithmic process. Directly looking at models and flows to check if they’re fair (often on a sample basis). Or recalculating the expected outputs and comparing that to the actual outputs, to find errors. Just like with home insurance, you need both, in most cases. A solid governance framework that misses certain scenarios won’t help you. Neither will great detective work that ignores systemic process failures. If you only have one, you won’t get the full picture. The analogy breaks down in places (many analogies do), but the essence is similar. You need to look both outside and inside. The foundation needs to be right, and you need to catch the possible day-to-day problems too. Most algorithmic reviews benefit from combining both types of testing. Sometimes you only need one, but then know which gaps you're accepting when you make that choice.   --- Disclaimer: The info in this article is not legal advice. It may not be relevant to your circumstances. It was written for specific contexts within banks and insurers, may not apply to other contexts, and may not be relevant to other types of organisations. ---     ## Related posts [![Do we trust systems that advise more than those that act?](https://riskinsights.com.au/hs-fs/hubfs/Do%20we%20trust%20systems%20that%20advise%20more%20than%20those%20that%20act.png?height=200&name=Do%20we%20trust%20systems%20that%20advise%20more%20than%20those%20that%20act.png)](https://riskinsights.com.au/blog/do-we-trust-systems-that-advise-more-than-those-that-act) ## [Do we trust systems that advise more than those that act?](https://riskinsights.com.au/blog/do-we-trust-systems-that-advise-more-than-those-that-act) 03 Sep 2026 Lately we’ve become accustomed to thinking "LLM" when we hear “AI”. And who can blame us when... [Read more](https://riskinsights.com.au/blog/do-we-trust-systems-that-advise-more-than-those-that-act) [![Sometimes the error is logic, not system](https://riskinsights.com.au/hs-fs/hubfs/Sometimes%20the%20error%20is%20logic%2c%20not%20system.png?height=200&name=Sometimes%20the%20error%20is%20logic%2c%20not%20system.png)](https://riskinsights.com.au/blog/sometimes-the-error-is-logic-not-system) ## [Sometimes the error is logic, not system](https://riskinsights.com.au/blog/sometimes-the-error-is-logic-not-system) 05 Feb 2026 TL;DR • Many significant system errors aren't technical failures; they're business rules that were... [Read more](https://riskinsights.com.au/blog/sometimes-the-error-is-logic-not-system) [![A businessman in doubt, having to choose between three different choices indicated by arrows pointing in opposite direction concept](https://riskinsights.com.au/hs-fs/hubfs/A%20businessman%20in%20doubt%2c%20having%20to%20choose%20between%20three%20different%20choices%20indicated%20by%20arrows%20pointing%20in%20opposite%20direction%20concept.jpeg?height=200&name=A%20businessman%20in%20doubt%2c%20having%20to%20choose%20between%20three%20different%20choices%20indicated%20by%20arrows%20pointing%20in%20opposite%20direction%20concept.jpeg)](https://riskinsights.com.au/blog/substantive-vs-controls-testing) ## [Algorithm Reviews: Substantive vs. Controls Testing](https://riskinsights.com.au/blog/substantive-vs-controls-testing) 18 Dec 2024 TL;DR • Knowing the basics of substantive testing vs. controls testing can help you determine if... [Read more](https://riskinsights.com.au/blog/substantive-vs-controls-testing) We acknowledge Aboriginal and Torres Strait Islander peoples as the Traditional Custodians of the lands on which we live and work. We pay our respects to Elders past and present, and honour the rich diversity of the world's oldest living cultures. [View our LinkedIn page](https://www.linkedin.com/company/riskinsightsap) [email us](mailto:info@riskinsights.com.au) [Call us](tel:+61408946143) 2026 Risk Insights Pty. Ltd. | [Privacy](https://riskinsights.com.au/privacy-policy) | [Disclaimer](https://riskinsights.com.au/disclaimer) ```json { "@context" : "https://schema.org", "@type" : "BlogPosting", "author" : { "@type" : "Person", "name" : "Yusuf Moolla", "url" : "https://riskinsights.com.au/blog/author/yusuf" }, "dateModified" : "2025-11-17T04:19:53.702Z", "datePublished" : "2025-10-29T20:30:00.000Z", "headline" : "A simple analogy to explain the difference between controls and substantive testing", "image" : [ "https://riskinsights.com.au/hubfs/60.png" ], "mainEntityOfPage" : { "@id" : "https://riskinsights.com.au/blog/a-simple-analogy-to-explain-the-difference-between-controls-and-substantive-testing", "@type" : "WebPage" }, "publisher" : { "@type" : "Organization", "logo" : { "@type" : "ImageObject", "url" : "https://riskinsights.com.au/hubfs/Risk%20Insights%20-%20Logo%20-%20(RGB%2c%20Horizontal%2c%20Small).png" }, "name" : "Risk Insights Pty. Ltd." } } ```