The correct answer is: Tests of controls are performed when the auditor's assessment of risk includes an expectation that controls are operating effectively.

Tests of controls never enable the auditor to dispense with the need for substantive procedures, they only enable the auditor to reduce the level of substantive procedures. Tests of controls are often performed before substantive procedures are performed, because the level of substantive procedures can be dependent on the results of tests of controls. Many small businesses have control systems in place that can be relied on by auditors and tests of controls are not therefore restricted to very large listed audit clients.