A retailer has 40,000 sales invoices for the year. The audit team has four days. Checking every invoice is impossible, so the senior picks 60. If 59 are perfect and one has no despatch note, what can the auditor say about the other 39,940? The answer depends on how the 60 were chosen, how large the sample is and how the result is projected.
Sampling is how auditors reach a conclusion about a whole population from a part of it, and the exam tests both the ideas and the arithmetic.
This topic covers the nature of sampling, when it is not suitable, sampling risk, statistical and non-statistical sampling, the design of a sample under International Standard on Auditing (ISA) 530, the methods of selection, tolerable and expected misstatement, performing the tests, anomalies and the projection of misstatements. The previous topics covered evidence and documentation. The next group covers internal control.
In 30 seconds
Sampling: applying audit procedures to less than 100% of a population to reach a conclusion on the whole. Sampling risk: the risk that the conclusion from the sample differs from the conclusion on the whole population. Selection: every item has an equal chance: random, systematic or haphazard (haphazard is not scientific). Size rises as tolerable misstatement falls, as expected misstatement rises and as risk rises.
Treat an item that cannot be tested as an error. Project errors to the population and compare them with tolerable misstatement.
Key terms in plain English
| Term | What it means |
|---|---|
| Population | The whole set of items about which the auditor concludes |
| Sampling unit | One item in the population |
| Sampling risk | Risk that the sample gives a different conclusion from the whole |
| Tolerable misstatement | The amount of error the auditor will accept |
| Anomaly | An error that is not representative of the population |
| Stratification | Dividing a population into groups before sampling |
Syllabus check
This topic is in syllabus area B, the nature and use of internal control (20% of marks). It covers:
- the techniques for evaluating internal controls, including compliance tests and substantive tests with sampling (ISA 530)
- the selection of sufficient and appropriate audit evidence
- the evaluation of results
CAMA 2020 and sampling
The Companies and Allied Matters Act 2020 (CAMA 2020) is the company law of Nigeria. The sections below apply to this topic.
| Section | What it says | Link to this topic |
|---|---|---|
| s. 404(2) | The auditors state whether they obtained all information and explanations needed for the audit | Sampling is a way to obtain enough evidence without testing every item |
| s. 407(3) | Right of access to books, accounts and vouchers | The population is drawn from the records the auditor may access |
| s. 405 | Corporate responsibility for financial reports | Errors found in samples are corrected by management |
The rules in more depth
The nature of sampling
Auditors do not normally check 100% of transactions and balances. They do not count every item of inventory or confirm every customer balance. They select a sample, test it, and use the result to conclude on the whole population, which is the entire set of data from which the sample is drawn and about which the auditor wants to conclude.
The auditor is not interested in the sample for its own sake. If the auditor tests 500 of 1,000 invoices, the purpose is to conclude on all 1,000. So the sample must be representative of the population. A larger sample is more likely to be representative, but costs more time. The auditor therefore wants the smallest sample consistent with the required level of detection risk and the acceptable audit risk.
Sampling is applying procedures to less than the entire population. If 999 of 1,000 invoices are tested, that is still sampling, although a very large sample.
When sampling is not suitable
- If the population is a small number of large items, it may be right to test all of them. A company owns three large machines that serve different purposes. Testing all three is better than testing one or two as a "sample".
- Sampling is appropriate only where the population is homogeneous, meaning the items share common characteristics. If it is not, the auditor may have to test the whole population, or divide it into homogeneous parts.
- Where the risk is high and every item matters, such as the few journal entries made by the managing director, the auditor tests every item.
Sampling and the audit risk model
Detection risk is the risk that insufficient testing fails to detect a material misstatement. It has two parts.
- Sampling risk is the risk that the auditor's conclusion from a sample may differ from the conclusion had the whole population been tested. It happens when the sample is not representative. A larger sample lowers sampling risk.
- Non-sampling risk is the risk of reaching a wrong conclusion for reasons other than sampling, such as mistakes by the team, incompetence or tight deadlines. In practice it is assumed to be zero for planning, and it is controlled by training, supervision and review.
To control detection risk the auditor must control sampling risk. The size and method of selection of the sample are therefore central to a risk-based audit.
Sampling risk and the two wrong conclusions
ISA 530, Audit Sampling, sets the objective of providing a reasonable basis for conclusions about the population, by designing and selecting the sample and evaluating the results so that sampling risk is kept to the desired level. The auditor can never be sure a sample is fully representative. Even if 999 of 1,000 invoices are clean, the last may hold a material error. Sampling risk can lead to two wrong conclusions.
| Type | Tests of controls | Tests of details |
|---|---|---|
| First type: the dangerous one | Controls are more effective than they really are | No material misstatement exists when one does |
| Second type: costly but safer | Controls are less effective than they really are | A material misstatement exists when none does |
The first type matters more because it can lead to an inappropriate opinion. The second type leads only to extra work.
Statistical and non-statistical sampling
The usual way to get a representative sample is random selection, meaning that each item has an equal chance of selection, so there is no bias. ISA 530 distinguishes:
- Statistical sampling: any approach that uses random selection and applies probability theory to evaluate the results and measure sampling risk.
- Non-statistical (judgemental) sampling: any approach not based on probability theory; the auditor judges the results.
| Statistical sampling: advantages | Statistical sampling: disadvantages |
|---|---|
| An objective, mathematically precise basis | Needs training and technical expertise, and so an investment in staff training |
| The sample size can be calculated precisely | Sample sizes may be larger than under judgement, raising time and cost |
| Sometimes the only efficient way to audit very large populations | Some auditors prefer to rely on skill, experience and judgement |
Designing the sample
ISA 530 requires the auditor to consider the purpose of the procedure and the population, to decide a sample size large enough to reduce sampling risk to an acceptably low level and to select items so that every sampling unit has an equal chance of selection. The key decisions are:
- the sampling approach, statistical or not;
- the characteristics of the population;
- the selection method;
- what counts as a misstatement or deviation;
- the tolerable misstatement or deviation rate; and
- the expected misstatement or deviation rate.
The population and the sampling unit
The population must suit the audit objective and be complete. To confirm the accuracy of trade receivables, the population is all receivables balances at the year end. If the objective is narrower, for example balances above ₦2 million, the population is those balances. Each item in the population is a sampling unit, and the units should be homogeneous.
If the receivables were processed through two systems, one computerised and one manual, the auditor can divide the population into two segments, called strata, and sample from each. That is stratified sampling. Stratifying by value, so that the large balances are tested more heavily, is common.
Methods of selection
| Method | How it works | Comment |
|---|---|---|
| Random | Every item has an equal chance; usually by random numbers | Unbiased; suits statistical sampling |
| Systematic | A random starting point, then every nth item, for example every 10th from a list of invoices in number order for a 10% sample | Simple; risky if the population has a pattern that matches the interval |
| Haphazard | The auditor picks items arbitrarily, for example any 100 invoices from a file | Not scientific and may be biased; not for statistical sampling |
| Monetary unit sampling | Each naira in the population is a unit, so larger items are more likely to be picked | A statistical method that targets overstatement and big items |
What is a misstatement or deviation
The auditor needs a clear idea of what counts as an error for the purpose of the test. If the purpose is to test the accuracy of the receivables total, an invoice posted to the wrong customer account does not change the total and does not matter for that objective, although it matters for the objective of accuracy of individual balances.
A deviation is a departure from a prescribed control procedure, such as a payment without authorisation.
Tolerable and expected misstatement
- Tolerable misstatement is a monetary amount set by the auditor to address the risk that individually immaterial misstatements add up to a material total. It applies performance materiality to a particular sample. An error above it is treated as material. The tolerable rate of deviation is the rate of departures from controls the auditor will accept and still conclude the statements are materially correct.
- Expected misstatement or deviation rate is the auditor's judgement of the error that will probably be found, based on previous audits and on the current audit. If the auditor has found weaknesses in sales invoicing, the expected misstatement in receivables will be high.
| Factor | Effect on sample size |
|---|---|
| Smaller tolerable misstatement or deviation rate | Larger sample |
| Higher expected misstatement or deviation rate | Larger sample |
| Higher assessed risk of material misstatement | Larger sample |
| Larger population | Little effect once the population is large |
| Greater reliance wanted from the test | Larger sample |
In the extreme, if the auditor will accept no error at all in receivables, all the balances must be tested.
Performing the procedures on the sample
- Perform appropriate procedures on each item selected.
- If the procedure cannot be applied to a selected item, use a replacement. For example, a properly cancelled cheque selected for an authorisation test may be replaced by another cheque.
- If the procedure, or a suitable alternative, cannot be done on an item, for example because the document is lost, treat the item as a misstatement or deviation.
- Investigate the nature and cause of each misstatement or deviation and evaluate its possible effect. The cause may point to a time period, a type of transaction or a location, such as a period when a temporary clerk was employed. The auditor may extend testing there.
- If an error is thought to be an anomaly, which ISA 530 defines as a misstatement or deviation that is demonstrably not representative of those in the population, the auditor must obtain a high degree of certainty that it is. Must do extra work to show that it does not affect the rest of the population.
Projecting misstatements and evaluating the results
For tests of details the auditor projects the misstatements found in the sample to the whole population, by extrapolation. For tests of controls, the sample deviation rate is the projected deviation rate for the population. An unexpectedly high rate may lead the auditor to revise the risk assessment and to extend the substantive tests.
The auditor also evaluates whether the sample gave a reasonable basis for conclusions on the population. If not, further procedures are needed.
Illustration. A sample of receivables recorded at ₦2,000,000 is found, on testing, to be worth ₦1,950,000. The total recorded for the population is ₦10,000,000.
- Error in the sample.
₦2,000,000 − ₦1,950,000 = ₦50,000, which is 2.5% of the sample. - Projected misstatement in the population.
2.5% × ₦10,000,000 = ₦250,000 overstatement. - Compare with tolerable misstatement. If it is, say, ₦300,000, the projection is within it, though the auditor must still think about the risk that the true error is larger. If it is ₦200,000, the projection exceeds it and the auditor must extend testing or ask management to adjust.
Sampling in tests of controls and in tests of details compared
| Point | Tests of controls | Tests of details |
|---|---|---|
| Purpose | Whether a control operated effectively | Whether a balance or class of transactions is materially misstated |
| Unit tested | An occurrence of the control, such as one invoice approval | An item or a naira in a balance |
| What is an error | A deviation from the control | A misstatement of an amount |
| Tolerable limit | Tolerable rate of deviation | Tolerable misstatement in naira |
| Projection | The sample deviation rate is the projected rate | Sample errors are extrapolated to the whole population |
| If results are poor | Raise the assessed control risk and extend substantive tests | Extend testing or ask management to adjust the balance |
Computer-assisted selection
Audit software can select random numbers, select every nth item, stratify a ledger by value, and pick monetary units. It can also test the whole population for particular conditions, such as payments over a limit, duplicate invoice numbers, entries on weekends or round-sum journal entries.
Where the auditor can test every item by software, sampling is not needed for that test, and the auditor concentrates manual effort on the exceptions the software finds. The auditor must still be sure that the data given to the software is complete and accurate.
Documenting the sample
The working paper records the objective of the test, the population and how its completeness was checked, the sampling unit, the approach and method of selection, the sample size and how it was set, the tolerable and expected errors, the items tested and results, errors found and their causes, the projection and the conclusion.
If a selection is repeated in later years, the auditor varies it, so that management cannot predict which items will be tested. This documentation shows an experienced stranger why the sample was reasonable and how the conclusion was reached.
Choosing between sampling and other ways of testing
The auditor chooses the most efficient way to obtain sufficient appropriate evidence. Sampling suits large homogeneous populations of routine items. Testing all items suits small populations of large items and high-risk items. Analytical procedures can replace much detailed testing where relationships are stable and predictable.
Selecting specific items, such as all items above a certain value or all unusual items, is not sampling under ISA 530, because the results cannot be projected to the rest of the population. The auditor must therefore be clear about what each test can and cannot support.
Worked examples
Example 1: systematic selection. A population of 5,000 invoices is listed in number order. The auditor wants a sample of 100.
- The interval is 5,000 ÷ 100 = 50.
- Choose a random start between 1 and 50, say 17.
- Select invoice 17, 67, 117, 167 and so on to the end.
Example 2: sample size factors. The auditor sets a smaller tolerable misstatement because risk is high and expects more errors than last year.
- Both a smaller tolerable misstatement and a higher expected error increase the sample size.
- The auditor should plan more time for testing.
Example 3: lost document. A selected purchase invoice cannot be found and no alternative evidence exists.
- The procedure cannot be applied to the item.
- The item is treated as a misstatement or deviation.
Example 4: control test. In a test of 80 payments, 6 had no approval. The tolerable deviation rate is 5%.
- Sample deviation rate.
6 ÷ 80 = 7.5%. - It exceeds the tolerable rate, so the control cannot be relied on.
- The auditor revises the risk assessment upward and extends substantive tests.
Example 5: stratified sampling. A population of 400 receivables includes 20 balances above ₦5 million that make up 60% of the value.
- Test all 20 large items.
- Sample the remaining 380 balances.
- This covers most of the value with a small amount of work.
How to score full marks
- Define sampling, population and sampling risk.
- Show the calculation: error rate in the sample, projected error, comparison with tolerable.
- State the direction of the effect of each factor on sample size.
- Say that haphazard selection is not scientific.
Common mistakes in the exam
- Concluding on the sample only, without projecting.
- Saying a larger tolerable misstatement needs a larger sample.
- Treating a lost document as a clean item.
- Sampling a population that is not homogeneous.
Quick revision
- Sample to conclude on the population; must be representative.
- Sampling risk (controlled) and non-sampling risk (assumed zero).
- Random, systematic, haphazard, monetary unit.
- Tolerable and expected misstatement drive size.
- Project errors and compare with tolerable.
Practice questions
Questions 1 to 10 are multiple choice. Questions 11 to 13 are written. Try each before opening the answer.
Question 1. The purpose of sampling is to:
- Reach a conclusion on the whole population
- Prove the sample is correct
- Save the audit fee
- Avoid all risk
Show the answer
A. The sample is used to conclude on the population.
Question 2. Sampling risk is the risk that:
- The conclusion from the sample differs from the conclusion on the whole population
- The team is incompetent
- The client lies
- Materiality is wrong
Show the answer
A. As defined in ISA 530.
Question 3. Non-sampling risk arises from:
- Auditor error or incompetence
- A small sample
- A large population
- Random selection
Show the answer
A. Factors other than sampling.
Question 4. Which selection method is not scientific?
- Haphazard
- Random
- Systematic
- Monetary unit
Show the answer
A. It may contain bias.
Question 5. A systematic sample of 10% from a list selects:
- A random start then every 10th item
- Items at random
- Only the largest items
- Only the first items
Show the answer
A. A random start and a fixed interval.
Question 6. A higher tolerable misstatement requires a:
- Smaller sample
- Larger sample
- No sample
- The same sample
Show the answer
A. More error can be accepted.
Question 7. A higher expected misstatement requires a:
- Larger sample
- Smaller sample
- No sample
- Haphazard sample
Show the answer
A. More error is expected.
Question 8. An error shown to be not representative of the population is an:
- Anomaly
- Deviation
- Control
- Assertion
Show the answer
A. As ISA 530 defines it.
Question 9. If a selected document is lost and no alternative exists, the auditor:
- Treats it as a misstatement or deviation
- Ignores it
- Replaces it silently
- Stops the audit
Show the answer
A. It cannot be tested.
Question 10. Dividing a non-homogeneous population into parts and sampling each is:
- Stratified sampling
- Haphazard sampling
- Random selection only
- Non-sampling
Show the answer
A. Stratified sampling.
Question 11 (10 marks). Explain sampling risk and non-sampling risk and how each is controlled. (6 marks)
Question 12 (10 marks). Describe the factors that affect the size of an audit sample and the methods of selecting items. (8 marks)
Question 13 (10 marks). A sample of receivables recorded at ₦3 million is found to be worth ₦2.91 million. The population recorded total is ₦20 million and tolerable misstatement is ₦400,000. Project the misstatement and comment. (6 marks)
Model answers
Show the model answer to Question 11
Sampling risk: conclusion from the sample differs from the conclusion on the population; controlled by larger and well-designed, representative samples. (3) Non-sampling risk: wrong conclusion from other causes such as errors, incompetence or time pressure; controlled by training, supervision and review, and is assumed to be zero. (3)
Show the model answer to Question 12
Size is increased by smaller tolerable misstatement, higher expected misstatement, higher risk, and wider reliance. (4) Methods: random (equal chance), systematic (random start, fixed interval), haphazard (not scientific), monetary unit sampling. (4)
Show the model answer to Question 13
Sample error = ₦3,000,000 − ₦2,910,000 = ₦90,000, which is 3%. (2) Projected = 3% × ₦20,000,000 = ₦600,000. (2) It exceeds tolerable misstatement of ₦400,000, so the auditor should extend testing or ask management to correct the balances. (2)
Spotted a mistake? Tell us and we will check it.
