What is Control risk
That material misstatement could take place and not be detected, or prevented on a timely basis, by accounting and internal control systems.
All audits at their core are substantive.Effective internal controls (which is when CR is low) will reduce (not eliminate) substantive work. However should consider benefit/cost of audit approach.
Tests of control must be performed by auditor at the planning stage. This is to obtain audit evidence about effective operation of the accounting and internal control system and assess level of control risk. An appropriate audit plan can be produced based on this assessment.