Topics in this domain
- ISACA Code of Professional Ethics
- ITAF: The Standards Framework
- Standards vs. Guidelines vs. Tools
- Auditor Independence and Objectivity
- Audit Charter: Purpose and Contents
- Audit Testing: Compliance vs. Substantive
- Financial vs. Operational vs. Integrated Audits
- Forensic and Specialized Audits
- Risk-Based Audit Approach
- Inherent, Control, Detection, and Audit Risk
- Audit Universe and Annual Audit Plan
- Audit Objectives, Scope, and the Audit Program
- Types and Reliability of Audit Evidence
- Sampling: Statistical vs. Non-Statistical
- Sampling Terms: Confidence Level, Tolerable Error and Friends
- Interviews, Observation, and Walkthroughs
- CAATs and Data Analytics
- Continuous Auditing and Monitoring
- Preventive, Detective, Corrective Controls
- General vs. Application Controls
- Compensating Controls and Segregation of Duties
- Materiality and Evaluating Findings
- Audit Report Structure and Communication
- Follow-Up and Management Action Plans
- Control Self-Assessment (CSA)
- Audit Quality and Using Other Experts' Work
Sampling: Statistical vs. Non-Statistical
Why sample at all?
A company processes 400,000 payments a year. Checking every one by hand would take months, so auditors test a sample (maybe 60) and use it to judge the whole population.
Think of a chef tasting soup. One spoonful tells you about the whole pot, as long as it’s been stirred. Sampling works the same way: the trick is making sure the sample is representative, and knowing how far you can trust it.
When data is electronic and the test can be automated, testing everything with data analytics is often better still. More on that at the end.
Two ways to pick a sample
Statistical sampling uses random selection and probability maths to decide how many items to test and to evaluate the results. Its big advantage: the auditor can measure sampling risk, the chance that the sample gives a different answer than testing everything would. That makes the conclusion objective and defensible.
Judgement (non-statistical) sampling uses the auditor’s experience to decide how many and which items. It’s useful for aiming at known risks (the biggest payments, transactions just before year end, changes by one suspicious user), but the results can’t be projected to the whole population with a stated level of confidence.
| Use statistical sampling when… | Use judgement sampling when… |
|---|---|
| The conclusion must cover the whole population | The aim is to look at specific high-risk items |
| Sampling risk needs to be measured | The population is small or very mixed |
| The result might be challenged | Experience gives a solid basis for choosing |
How often, or how much?
Attribute sampling: how often?
Attribute sampling counts how often something happens, usually a control failing. Each item is a simple yes or no: approved or not approved. The result is a rate: “about 3% of changes lacked approval”. It’s used for compliance tests.
Variants:
- Fixed-sample-size attribute sampling: the standard form, estimating the failure rate.
- Stop-or-go (sequential) sampling: test a small sample first; if it’s clean, stop. If not, test more. It prevents excessive sampling when few errors are expected.
- Discovery sampling: designed to find at least one example if the problem exists above a certain rate. Used when even one case matters, such as fraud.
Variable sampling: how much?
Variable sampling estimates a money amount or quantity: “the total is probably overstated by about 40,000”. It’s used for substantive tests.
| Technique | How it works |
|---|---|
| Unstratified mean per unit | The sample’s average value is projected to the whole population |
| Stratified mean per unit | The population is split into groups first; each group sampled separately |
| Difference estimation | The average difference between the audited and recorded values is projected |
| Monetary unit sampling | Each currency unit is a sampling unit, so bigger items are more likely to be picked |
Choosing the items
- Random selection: every item has an equal chance, using a random number generator. Statistical.
- Systematic selection: every nth item from a random start, such as every 50th invoice starting at number 17. Statistical, as long as the list doesn’t have a hidden pattern that matches the interval.
- Cell selection: one random item from each interval. Statistical.
- Stratification: split the population into groups of similar items (for example by value) before sampling. Each group is less varied, so the same confidence needs a smaller total sample. It also lets the auditor test every very large item and sample the rest.
- Haphazard selection: picked without a method. Not statistical.
- Block selection: one consecutive chunk, like “all of March”. Not statistical and rarely representative.
Example. To test change approvals, the auditor uses attribute sampling at 95% confidence, picking changes at random from the deployment log. Separately, they deliberately pick every change made with the emergency admin account, because that’s a known risk. The first is statistical; the second is judgemental. Both are useful.
Sample or test everything?
When data is electronic, the auditor can often test the whole population with data analytics, which removes sampling risk completely.
Example. To find duplicate supplier payments, a script compares all 400,000 payments in seconds. A sample of 60 would almost certainly miss the handful of duplicates.
How the exam asks about it
| If the question asks… | The answer is usually… |
|---|---|
| Main advantage of statistical sampling | Sampling risk can be quantified; objective conclusions |
| Sampling to test compliance with a control | Attribute sampling |
| Sampling to estimate a monetary misstatement | Variable sampling |
| Fraud is suspected and one instance matters | Discovery sampling |
| Method that avoids excessive sampling | Stop-or-go sampling |
| How to reduce sample size for a very varied population | Stratification |
In short
- Sampling means testing part of a population to draw a conclusion about all of it.
- Statistical sampling uses random selection and maths to set the sample size and evaluate results, so the risk of a wrong conclusion can be measured.
- Judgement (non-statistical) sampling uses the auditor's experience to pick items; it can target known risks but can't state a measured confidence.
- Attribute sampling asks 'how often?' (a rate of control failures) and suits compliance tests.
- Variable sampling asks 'how much?' (an amount of misstatement) and suits substantive tests.
- Stop-or-go sampling avoids over-testing when few errors are expected; discovery sampling is used when finding even one case (like fraud) matters.
- Stratification splits a varied population into similar groups, which shrinks the sample needed.
Exam traps
- Discovery sampling is for rare events like fraud, not for estimating an error rate.
- Stop-or-go sampling exists to prevent excessive sampling, not to find fraud.
- Judgement sampling isn't wrong; it just can't quantify sampling risk.
- Attribute sampling gives a rate, not an amount of money.
- Haphazard selection isn't random selection, so it doesn't support statistical conclusions.
- If the data is electronic and the test can be automated, testing 100% with analytics is often better than sampling.
Slides
Click the slide and use the arrow keys. F toggles full screen.
Two ways to pick a sample
The variants the exam names
Choosing the items