Audit sampling

1 Introduction

Unless an audit client is very small almost all audit 'testing' relies on sampling. This is because there simply isn’t time to examine all documents, transactions and balances and it wouldn’t be economically viable to do so. If, however, valid statistical conclusions are to be drawn about a population based on a sample, then the sample must be free from bias. In other words every document, transaction or balance in the population has an equal chance of being included in the sample. This is known as audit sampling.

2 Audit sampling

The process involves:

• Sample design – includes specifying the population (is it complete?)
  

• Sample size – must be sufficient to reduce sampling risk (as explained in section 5.2)
  

• Sample selection – choose a selection method (see below)
  

• Performing audit procedures – test the selected items. This will be either a test of controls or a test of details (a substantive procedure).
  

• Evaluate sample results – investigate all ‘errors’ (see later) and conclude on the population.
  

In statistical sampling:

• Sample selection must be regarded as random, and
  

• Probability theory must be used to evaluate sample results including measurement of sampling risk (which will determine the sample size).
  

If either of these conditions is not met, sampling is non-statistical.

3 Selection methods

• Random selection. The best way to remove bias and to obtain a representative sample is to adopt what’s called random selection. Let’s say we wanted to look at purchase invoices throughout the year. There might be 20,000 purchase invoices and we want to inspect 20 of them. What you would do is to number the 20,000 invoices consecutively and then use a random number generator to produce 20 numbers and you would then go and look at the corresponding invoices. The difficulty with this approach is that very often the population is not pre-numbered and to set out initially numbering all 20,000 invoices would be very time-consuming.
  

• Systematic ('interval') selection. This is an approximation to pure random selection. Again, if with 20,000 invoices you wanted to look at about 20 invoices you could do that by looking at every 1,000th invoice. So what you would do is that near the beginning of the population you would choose an invoice at random and then count through selecting every 1,000th one. Provided there isn’t some weird correspondence of every 1,000th invoice being from exactly the same supplier, you are going to get pretty close to random selection.
  

• Haphazard selection. This is frequently used because it is convenient. For example, the auditor opening a file at random and picking the invoice at which the file is opened. There can be obvious problems with this. The file might always open at a slightly thicker invoice or a slightly larger invoice and that invoice could be from the same small group of suppliers. There might be a relatively small chance of the physically small invoice being chosen. There is also a risk of bias. The auditor may, consciously or unconsciously pick out invoices which appear to be correct (so quickly dealt with) or 'more interesting' (perhaps more likely to have an error). The sample is therefore unlikely to be representative, so cannot be used in statistical sampling.
  

• Block selection. For example choosing 20 invoices all in a sequence. Depending on how they are filed, they could all be from the same supplier or may be from different suppliers, but all with the same date. This is not a representative sample. (Clearly it would not be possible in a test of control to conclude on the effectiveness of controls throughout the period.)
  

• Stratification. If we know that there are 20,000 invoices, 10 of those are above $100,000 then it might make sense to make sure we choose at least all of those 10 invoices plus another 10 chosen randomly. Stratification means dividing your population into different sub-populations ('layers') with similar characteristics (usually monetary amount). The results of testing each layer must be separately evaluated.
  

• Value-weighted selection. This is used in monetary unit sampling and is rather more complex as described on the next page.

4 Monetary unit sampling

Monetary unit sampling is value-weighted selection: larger recorded values have a greater chance of selection. This background explains how testing can focus on higher-value items. The FAU selection methods you need to identify are random, systematic and haphazard selection; a worked monetary-unit algorithm is not required.

5 Audit risk revisited

5.1 Introduction

You should remember from a previous chapter that audit risk is the risk that the auditor comes to the wrong conclusion about the financial statements and gives an inappropriate opinion. One of the contributors to audit risk was detection risk – the auditor failing to spot a misstatement.

Detection risk has two causes: sampling risk and non-sampling risk.

5.2 Sampling risk

This can be described as ‘bad luck’. For example, a population contains 10% of documents that have not been properly approved. If a sample of 10 items were randomly chosen there is approximately a 35% chance (0.9¹⁰) that no non-approved items have been chosen. If the auditor only happens to pick 10 good invoices the auditor will conclude that the internal control is working well when, in fact, 10% of invoices are not approved.

Sampling risk is reduced by increasing the sample size. If 30 were chosen then the chance of not finding a bad invoice is reduced to 4%.

Sample size should be large enough to reduce sampling risk to an acceptably low level.

For tests of controls sample size is affected by:

• The extent to which the auditor relies on the control
  

• The desired level of assurance
  

• The expected rate of deviation. The higher the rate of deviation the greater the sample size needs to be to draw conclusions.
  

For tests of details sample size is affected by:

• The risk of material misstatement (the greater the risk, the larger the sample)
  

• What other audit work can be done to address the same assertion
  

• The desired level of assurance
  

• Stratification (generally reduces total sample size for the population).
  

5.3 Non-sampling risk

Non-sampling detection risk is defined as any risk not arising from sampling. For example, if transactions were very complex and the auditor lacked the right knowledge to examine the documents properly, it wouldn’t matter if 100% were selected as the auditor would not be capable of finding any errors. The auditor simply doesn’t know what to look for.

Non-sampling risk is reduced by:

• Assigning more experienced staff to the audit
  

• Proper direction and supervision
  

• Careful review
  

• Training