Test of controls are done during risk assessment procedure or during Further audit procedures?

Risk assessment procedures are basically to understand the control environment and not the controls. they are just over all understanding of what entity is doing, how is the control environment, whether there is any monitoring over the control, if they need some analytical procedure etc.
however test of controls is done so that we can decide on how much test of details is to be performed