Audit Sampling

Audit sampling

applying an audit procedure to less than 100% of items to evaluate a characteristic

achieving sufficiency is not just a matter of choosing a large sample size; it is also heavily dependent on the…

design of the sample

The sufficiency of evidential matter is related to…

design and size of an audit sample, among other factors.

The size of a sample necessary to provide sufficient evidential matter depends on…

both the objectives and the efficiency of the sample.

What are the two general approaches to audit sampling?

• statistical

• non-statistical

The Efficiency Rule

If two different sample designs can achieve the exact same audit objective, the design that achieves it with a smaller sample size is the more efficient one

An efficient sample design…

saves time and reduces audit costs while still delivering the necessary level of assurance

Sampling risk

the danger that your sample doesn't look like the rest of the pile.

Because you are testing less than 100% of the population, there is always a chance that the items you pick will lead you to a different conclusion than if you had examined every single item

Nonsampling risk

includes all the aspects of audit risk that are not due to sampling

Nonsampling risk includes the possibility…

of selecting audit procedures that are not appropriate to achieve the specific objective.

Sampling risk arises from the possibility that..

when a test of controls or a substantive test is restricted to a sample, the auditor's conclusions may be different from the conclusions he would reach if the test were applied in the same way to all items in the account balance or class of transactions

For a sample of a specific design, sampling risk…

varies inversely with sample size

ex: The smaller the sample size, the greater the sampling risk.

Nonsampling risk can be reduced to a negligible level through such factors as…

adequate planning and supervision and proper conduct of a firm's audit practice

When performing substantive tests of details the auditor is concerned with what risk?

• The risk of incorrect acceptance

• The risk of incorrect rejection

• The risk of assessing control risk too low

• The risk of assessing control risk too high

risk of incorrect acceptance

risk that the sample supports the conclusion that the recorded account balance is not materially misstated when it is materially misstated.

risk of incorrect rejection

risk that the sample supports the conclusion that the recorded account balance is materially misstated when it is not materially misstated.

The risk of assessing control risk too low

Based on your sample, you conclude that the control is working beautifully, so you assess control risk as low. In reality, the control is not operating effectively (the true control risk is high).

The risk of assessing control risk too high

Based on your sample, you conclude that the control is broken, so you assess control risk as high. In reality, the control is highly effective and working perfectly overall (the true control risk is low).

What sampling risks relates to efficiency of the audit …

• risk of incorrect rejection

• risk of assessing control risk too high

Because you incorrectly believe the controls are broken, you will significantly expand your substantive testing of transaction details

What sampling risks relates to effectiveness of the audit …

• risk of incorrect acceptance

• risk of assessing control risk too low

Because your sample made you believe the controls are strong, you will reduce your direct testing of balances. Since you are doing less testing on a system with broken controls, you are highly likely to miss an existing material misstatement

Tolerable misstatement

maximum dollar error you can accept in a specific account balance before it starts threatening the accuracy of the entire financial statements

Tolerable misstatement for the population to be sampled ordinarily should be…

less than tolerable misstatement for the account balance or transaction class to allow for the possibility that misstatement in the portion of the account or transaction class not subject to audit sampling, individually or in combination with other misstatements, would cause the financial statements to be materially misstated.

Inherent Control

natural danger of a major mistake or fraud existing in a financial statement account, assuming the company has absolutely zero internal controls in place to prevent or catch it

 After assessing and considering the levels of inherent and control risks, the auditor performs…

substantive tests to restrict detection risk to an acceptable level.

Control Risk

This is the risk that the company's internal safety nets (like passwords, locks, or manager signatures) fail to prevent or catch a mistake

Detection Risk

This is the risk that your own audit tests fail to find a mistake that already snuck past the company's controls

What is the formula for Client risk?

Inherent risk + Control risk

What is the formula for audit risk?

$$\text{Audit Risk} = \text{Inherent Risk} \times \text{Control Risk} \times \text{Detection Risk}$$

You can afford to test a smaller sample size if you have three safety cushions already in place:

• Cushion 1 (Low Inherent Risk): The account is naturally very simple and hard to mess up.

• Cushion 2 (Low Control Risk): The client's internal security systems and controls are highly reliable.

• Cushion 3 (Other Substantive Tests): You have already done separate, high-level backup tests (like analyzing big-picture trends) that suggest the numbers are correct.

If you cant afford to take any chances because you have high risk you will have to test…

a larger sample size

The auditor may be able to reduce the required sample size by

separating items subject to sampling into relatively homogeneous groups on the basis of some characteristic related to the specific audit objective

To determine the number of items to be selected in a sample for a particular substantive test of details, the auditor should take into account…

• Tolerable misstatement for the population

• Allowable risk of incorrect acceptance (based on the assessments of inherent risk, control risk, and the detection risk related to the substantive analytical procedures or other relevant substantive tests)

• 
  

• Characteristics of the population, including the expected size and frequency of misstatements.

When circumstances are similar, the effect on sample size of those factors should be…

similar regardless of whether a statistical or non statistical approach is used.

If inherent risk goes up, or if your tolerable misstatement limit shrinks, your sample size must…

increase

when a non statistical sampling approach is applied properly, the resulting sample size ordinarily will be

comparable to, or larger than, the sample size resulting from an efficient and effectively designed statistical sample.

Auditing procedures that are appropriate to the particular audit objective should be applied to

each sample item

The auditor's treatment of unexamined items will depend on…

their effect on his evaluation of the sample

The auditor also should evaluate whether the reasons for his or her inability to examine the items have…

• (a) implications in relation to his or her risk assessments (including the assessment of fraud risk)

• (b) implications regarding the integrity of management or employees

• (c) possible effects on other aspects of the audit.

When planning a particular audit sample for a test of controls, the auditor should consider

• The relationship of the sample to the objective of the test of controls.

• The maximum rate of deviations from prescribed controls that would support his planned assessed level of control risk.

• The auditor's allowable risk of assessing control risk too low.

• Characteristics of the population, that is, the items comprising the account balance or class of transactions of interest.

Sampling generally is not applicable to tests of controls that depend primarily on…

appropriate segregation of duties or that otherwise provide no documentary evidence of performance.

Tolerable rate

maximum percentage of failures you are willing to accept in a company's safety systems (internal controls) before you stop trusting them

10% or more tolerable rate

means you are highly relaxed. You are saying: "I don't mind if this safety system fails 1 out of 10 times." Because your tolerance for mistakes is high, the math allows you to test a much smaller sample size (less work for you!).

5% or less tolerable rate

A 5% tolerable rate means you are keeping the company on a very tight leash. You are saying: "This system must be almost perfect. If it fails more than 1 out of 20 times, I won't trust it." This is a much higher safety standard, but it requires you to test a larger sample size to prove the system is that reliable.

To determine the number of items to be selected for a particular sample for a test of controls, the auditor should consider the…

tolerable rate of deviation from the controls being tested, the likely rate of deviations, and the allowable risk of assessing control risk too low.

Deviation

a failure in the control system

misstatement

dollar error in the financial statements

The deviation rate in the sample is the auditor's…

best estimate of the deviation rate in the population from which it was selected.

If the estimated deviation rate is less than the tolerable rate for the population, the auditor should consider

the risk that such a result might be obtained even though the true deviation rate for the population exceeds the tolerable rate for the population.

Statistical sampling helps the auditor

(a) to design an efficient sample

(b) to measure the sufficiency of the evidential matter obtained

(c) to evaluate the sample results.