Chapter 18

Audit Sampling for

Tests of Controls
 Tests of Controls
Based on the auditor’s understanding of the
accounting and internal control system, the auditor
identifies the characteristics or attributes that
indicate performance of a control, as well as
possible deviation conditions which indicate
departures from adequate performance.
Audit sampling for tests of
control is generally
appropriate when
application of the control
leaves evidence of
performance.
 Steps in the Application of
Sampling in Test of Control
1. Determine the control to be tested or audit objective
of the test.

If the auditor is
interested in testing
the effectiveness of
internal control in the
receiving process,
he/she will check
tine clerical accuracy
by comparing the
purchase invoice
and the receiving
report in which the
data should match.
 Steps in the Application of
Sampling in Test of Control
2. Define the attributes and deviation conditions.

The auditors define the

deviation conditions on the ff:
a. Any purchase invoice not
supported by a receiving
document.
b. Any invoice supported by
a receiving document that
is applicable to another
invoice.
c. Any difference between
the invoice and the
receiving document as to
quantities shipped.
 Steps in the Application of
Sampling in Test of Control
3. Define the population to be sampled and the
sampling unit.

• From the previous example,

the receiving report and
purchase invoice were
attached to each voucher that
represents the sampling unit.
• If the auditor will conduct
sampling on those vouchers,
he/she must assure that the
testing will be done to samples
that would fairly represent each
month of the year.
 Steps in the Application of
Sampling in Test of Control
4. Specify the risk of assessing control risk too low
and the tolerable deviation rate.

The lower the planned assessed level of control risk (or more assurance
desired from the sample), the lower the tolerable deviation rate.
 Steps in the Application of
Sampling in Test of Control
4. Specify the risk of assessing control risk too low
and the tolerable deviation rate.

If based on the previous example, the auditor plan to assess the control risk at a
low level for the assertions of existence, occurrence, and valuation of purchases,
inventories, and accounts payable, he/she may decide upon tolerable deviation
rate of 7% with a 5% risk of assessing control risk too low.
 Steps in the Application of
Sampling in Test of Control
5. Estimate the expected population deviation rate.
 Steps in the Application of
Sampling in Test of Control
5. Estimate the expected population deviation rate.

In estimating the expected

population rate, the auditors
may either:
a. Use sample results from
prior years as
documented in the
working papers;
b. Estimate the rate based
on their experience with
similar tests on other
audit engagements;
c. By examining a small
pilot sample.
 Steps in the Application of
Sampling in Test of Control
5. Estimate the expected population deviation rate.
 Steps in the Application of
Sampling in Test of Control
6. Determine the initial sample size.
Factors Smaller Sample Size Larger Sample Size
1. Planned reliance on Lower reliance on internal Higher reliance on internal
internal control (a) control control

2. Allowable rate of deviation Higher acceptable rate of Lower acceptable rate of

(tolerable error) deviation for planned reliance on deviation for planned reliance
internal control on internal control

3. Likely rate of population Lower expected rate of deviation Higher expected rate of
deviation (b) in population deviation in population
4. Required confidence level Decrease in required confidence Increase in required
level confidence level
5. Number of items in Virtually no effect on sample size unless population is small.
population
(a) Compliance tests are not performed when no reliance on internal controls is planned.
(b) Larger samples are necessary when deviations occur, in order to obtain more precise
conclusions. However, high deviation rate normally warrant little, if any, reliance on
internal controls and, therefore, compliance testing might be omitted.
 Steps in the Application of
Sampling in Test of Control
6. Determine the initial sample size.

Application: Since the

stipulated risk of assessing
control risk too low is 5%,
this figure is applicable. AT
the intersection of the
column for a tolerable
deviation rate of 7% and the
row for a 1.5% expected
deviation rate, the sample
size is found to be 66 items.
The allowable number of
deviations in the sample is
one.
 Steps in the Application of
Sampling in Test of Control
7. Select the sample.

Random samples may be

selected using:
a. Random number tables
b. Random number generators
c. Systematic sampling
 Steps in the Application of
Sampling in Test of Control
7. Select the sample.

A random number table is a table of

A random number generator is a
digits. The digit given in each position in
program will generate a random
the table was originally chosen
number between two numbers of
randomly from the digits
your choice. Just enter a lower limit
1,2,3,4,5,6,7,8,9,0 by a random
and an upper limit and click
process in which each digit is equally
ENTER.
likely to be chosen.
 Steps in the Application of
Sampling in Test of Control
7. Select the sample.
Systematic sampling is a type of probability sampling method in
which sample members from a larger population are selected
according to a random starting point and a fixed periodic interval. This
interval, called the sampling interval, is calculated by dividing the
population size by the desired sample size.
• For example, if your population is 100 and your sample size is 10, then:
100 / 10 = 10
This is your “nth” sampling digit (i.e. you’ll choose every 10th item)
1 2 3 4 5 6 7 8 9 10
11 12 13 14 15 16 17 18 19 20
21 22 23 24 25 26 27 28 29 30
31 32 33 34 35 36 37 38 39 40
41 42 43 44 45 46 47 48 49 50
51 52 53 54 55 56 57 58 59 60
61 62 63 64 65 66 67 68 69 70
71 72 73 74 75 76 77 78 79 80
81 82 83 84 85 86 87 88 89 90
91 92 93 94 95 96 97 98 99 100
That’s how to perform systematic sampling!
 Steps in the Application of
Sampling in Test of Control
7. Select the sample.
Sampling with replacement:
Consider a population of vouchers within a
folder, each of which has either 12, 13, 14,
15, 16, 17, or 18 vouchers, and all the
values are equally likely. Suppose that, in
this population, there is exactly one folder
with each number. So the whole population
has seven folders. If I sample two with
replacement, then I first pick one (say 14). I
had a 1/7 probability of choosing that one.
Then I replace it. Then I pick another.
Every one of them still has 1/7 probability
of being chosen. And there are exactly 49
different possibilities here (assuming we
distinguish between the first and second.)
They are: (12,12), (12,13), (12, 14),
(12,15), (12,16), (12,17), (12,18), (13,12),
(13,13), (13,14), etc.
Sampling without replacement:
Consider the same population of vouchers
within a folder, each of which has either 12,
13, 14, 15, 16, 17, or 18 vouchers, and all
the values are equally likely. Suppose that,
in this population, there is exactly one
folder with each number. So the whole
population has seven folders. If I sample
two without replacement, then I first pick
one (say 14). I had a 1/7 probability of
choosing that one. Then I pick another. At
this point, there are only six possibilities:
12, 13, 15, 16, 17, and 18. So there are
only 42 different possibilities here (again
assuming that we distinguish between the
first and the second.) They are: (12,13),
(12,14), (12,15), (12,16), (12,17), (12,18),
(13,12), (13,14), (13,15), etc.
 Steps in the Application of
Sampling in Test of Control
8. Perform the tests of control procedures on sampling
items.

Compliance Test Relevant Internal Control is in fact:

Risk Matrix

Compliance test Adequate for Inadequate for

indicates reliance Planned Reliance Planned Reliance
on relevant internal
control should be:
Accepted Correct Decision Risk of
Overreliance

Rejected Risk of Correct Decision

Underreliance
 Steps in the Application of
Sampling in Test of Control
9. Evaluate the sample results.
•
 Steps in the Application of
Sampling in Test of Control
9. Evaluate the sample results.
3. Compare the upper deviation rate and the tolerable rate of deviation
and evaluate the effectiveness of a control accordingly.
STATISTICAL SAMPLING

This suggests that the control is not effective.

 Steps in the Application of
Sampling in Test of Control
9. Evaluate the sample results.
3. Compare the upper deviation rate and the tolerable rate of deviation
and evaluate the effectiveness of a control accordingly.
NONSTATISTICAL SAMPLING

Sampling Tolerable rate or

Expected
Deviation population
Rate (5%) deviation rate (7%)

The auditor must place reliance on the control.

This suggests that the control is effective.

 Steps in the Application of
Sampling in Test of Control
9. Evaluate the sample results.
4. Consider qualitative information such as evidence of deliberate
manipulation or circumvention of internal control.

5. Research an overall conclusion. The auditor must relate the

assessed control risk to detection risk for each financial statement
assertion.
Sample Problem on Statistical Sampling
Lenter Supply Corp. is a medium sized distributor of wholesale
hardware supplies in southern Manitoba. It has been a client of yours for
several years and has instituted excellent internal control for the control of
sales, at your recommendation.
In providing control over shipments, the client has prenumbered
“warehouse removal slips” that are used for every sale. It is company policy
never to remove goods from the warehouse without an authorized warehouse
removal slip. After shipment, two copies of the warehouse removal slip are sent
to billing for the computerized preparation of a sales invoice. One copy is
stapled to the duplicate copy of the prenumbered sales invoice, and the other
copy is filed numerically. In some cases more than one warehouse removal slip
is used for billing one sales invoice. The smallest warehouse removal slip
number for the year is 14682 and the largest is 37521. The smallest invoice
number is 47821 and the largest is 68507.
In the audit of sales, one of the major concerns is the effectiveness of
the control in making sure all shipments are billed. The auditor has decided to
use attribute sampling in testing internal control.
NOTE: There is only one deviation observed in the samples.
 (a) State an effective audit procedure for testing whether
shipments have been billed. What is the sampling unit for the
audit procedure?
– A random selection of warehouse removal slips should be made
– Examined to see if they have the proper sales invoice attached
– The sampling unit will be the warehouse removal slip

(b) Assuming the auditor expects no deviations in the sample but

is willing to accept a TDR of 3%, at a 10% ARACR, what is
the appropriate sample size?

– Tolerable Deviation Rate = 3%

– Acceptable risk of assessing control risk too low (ARACR) = 10%
– EPDR (Expected Population Deviation Rate) = 0
• As auditor expects no deviations

ARACR. Definition. (Acceptable risk of assessing control risk too low) The risk that the
auditor is willing to take of accepting a control as effective or a rate of monetary
misstatements as tolerable when the true population exception rate is greater than the
tolerable exception rate
EXPECTED TOLERABLE DEVIATION RATE
POPULATION
(IN PERCENTAGE)
DEVIATION RATE (IN
PERCENTAGE) 2 3 4 5 6 7 8 9 10 15 20
5 PERCENT RISK OF OVER RELIANCE (ARACR)
0.00 149 99 74 59 49 42 36 32 29 19 14
0.25 236 157 117 93 78 66 58 51 46 30 22
0.50 . 157 117 93 78 66 58 51 46 30 22
0.75 . 208 117 93 78 66 58 51 46 30 22
1.00 . . 156 93 78 66 58 51 46 30 22
1.25 . . 156 124 78 66 58 51 46 30 22
1.50 . . 192 124 103 66 58 51 46 30 22
1.75 . . 227 153 103 88 77 51 46 30 22
2.00 . . . 181 127 88 77 68 46 30 22
2.25 . . . 208 127 88 77 68 61 30 22
2.50 . . . . 150 109 77 68 61 30 22
2.75 . . . . 173 109 95 68 61 30 22
3.00 . . . . 195 129 95 84 61 30 22
3.25 . . . . . 148 112 84 61 30 22
3.50 . . . . . 167 112 84 76 40 22
3.75 . . . . . 185 129 100 76 40 22
4.00 . . . . . . 146 100 89 40 22
5.00 . . . . . . . 158 116 40 30
6.00 . . . . . . . . 179 50 30
7.00 . . . . . . . . . 68 37
 2 3 4 5 6 7 8 9 10 15 20
EPDR 10 PERCENT RISK OF OVER RELIANCE (ARACR)
0.00 114 76 57 45 38 32 28 25 22 15 11
0.25 194 129 96 77 64 55 48 42 38 25 18
0.50 194 129 96 77 64 55 48 42 38 25 18
0.75 265 129 96 77 64 55 48 42 38 25 18
1.00 . 176 96 77 64 55 48 42 38 25 18
1.25 . 221 132 77 64 55 48 42 38 25 18
1.50 . . 132 105 64 55 48 42 38 25 18
1.75 . . 166 105 88 55 48 42 38 25 18
2.00 . . 198 132 88 75 48 42 38 25 18
2.25 . . . 132 88 75 65 42 38 25 18
2.50 Sample size . . . 158 110 75 65 58 38 25 18
2.75 . . . 209 132 94 65 58 52 25 18
3.00 . . . . 132 94 65 58 52 25 18
3.25 . . . . 153 113 82 58 52 25 18
3.50 . . . . 194 113 82 73 52 25 18
3.75 . . . . . 131 98 73 52 25 18
4.00 . . . . . 149 98 73 65 25 18
4.50 . . . . . 218 130 87 65 34 18
5.00 . . . . . . 160 115 78 34 18
5.50 . . . . . . . 142 103 34 18
6.00 . . . . . . . 182 116 45 25
7.00 . . . . . . . . 199 52 25
7.50 . . . . . . . . . 52 25
8.00 . . . . . . . . . 60 25
8.50 . . . . . . . . . 68 32
 Effect of population size

-Initial sample size only

-Possible to make adjustment to initial sample size based

on overall population size

-Finite correction factor

n = revised sample size

n = n’
1 + n’/N n’ = initial sample size
N = population size
From the problem 12-24

Population is 37521 – 14682 + 1 = 22840

n’ = 76/1+(76/22840) = 75.75

Thus revised sample size is still 76

the population has very little effect
c) Use of a random number table

– A one-to-one correspondence between

warehouse removal slip

– How is this correspondence achieved?

• Random stab in the random number table
 37039 97547 64673 31546 99314 66854 97855

25145 84834 23009 51584 66754 77785 52357

98433 54725 18864 65866 76918 78825 58210
97965 68548 81545 82933 93545 85959 63282
78049 67830 14624 17563 25697 07734 48243 Population of
50203 25658 91478 08509 23308 48130 65047

Random Stab 40059 67825 18934 64998 49807 71126 77818

Warehouse
84350
30954
67241
51637
54031
91500
34535
48722
04093
60988
35062
60029
58163
60873
Removal Slips
86723 36464 98305 08009 00666 29255 18514
50188 22554 86160 92250 14021 65859 16237 14,682 – 37,521
50014 00463 13906 35936 71761 95755 87002
66023 21428 14742 94874 23308 58533 26507
Random 04458 61862 63119 09541 01715 87901 91260
57510 36314 30452 09712 37714 95482 30507
Number 43373 58939 95848 28288 60341 52174 11879

Table 61500 12763 64433 02268 57905 72347 49498

78938 71312 99705 71546 42274 23915 38405
64257 93218 35793 43671 64055 88729 11168
56864 21554 70445 24841 04779 56774 96129
35314 29631 06937 54545 04470 75463 77112

40704 48823 65963 39359 12717 56201 22811

07318 44623 02843 33299 59872 86774 06926
94550 23299 45557 07923 75126 00808 01312
34348 81191 21027 77087 10909 03676 97723
92277 57115 50789 68111 75305 53289 39751

56093 58302 52236 65756 50273 61566 61962

16623 17849 96701 94971 94758 08845 32260
50848 93982 66451 32143 05441 10399 17775
48006 58200 58367 66577 68583 21108 41361
56640 27890 28825 96509 21363 53657 60119
Computed Upper
Deviation Rate
• Sample size = 100
• Tolerable Deviation Rate = 3%
• Acceptable risk of assessing control risk too low
(ARACR) = 10%
• Number of deviations observed = 1

• Using the following tables:

• Computed Upper Deviation Rate (CUDR) = 3.8%

• Upper Deviation Rate = Sample Deviation Rate + Allowance for Sampling Risk*

• Are the controls working? No, CUDR > TDR

 ACTUAL NUMBER OF DEVIATIONS FOUND
SAMPLE SIZE
0 1 2 3 4 5 6 7 8 9 10
5 PERCENT RISK OF OVER RELIANCE
25 11.3 17.6 . . . . . . . . .
30 9.5 14.9 19.5 . . . . . . . .
35 8.2 12.9 16.9 . . . . . . . .
40 7.2 11.3 14.9 18.3 . . . . . . .
45 6.4 10.1 13.3 16.3 19.2 . . . . . .
50 5.8 9.1 12.1 14.8 17.4 19.9 . . . . .
55 5.3 8.3 11.0 13.5 15.9 18.1 . . . . .
60 4.9 7.7 10.1 12.4 14.6 16.7 18.8 . . . .
65 4.5 7.1 9.4 11.5 13.5 15.5 17.4 19.3 . . .
70 4.2 6.6 8.7 10.7 12.6 14.4 16.2 18.0 19.7 . .
75 3.9 6.2 8.2 10.0 11.8 13.5 15.2 16.9 18.4 20.0 .
80 3.7 5.8 7.7 9.4 11.1 12.7 14.3 15.8 17.3 18.8 .
90 3.3 5.2 6.8 8.4 9.9 11.3 12.7 14.1 15.5 16.8 18.1
100 3.0 4.7 6.2 7.6 8.9 10.2 11.5 12.7 14.0 15.2 16.4
125 2.4 3.7 4.9 6.1 7.2 8.2 9.3 10.3 11.3 12.2 13.2
150 2.0 3.1 4.1 5.1 6.0 6.9 7.7 8.6 9.4 10.2 11.0
200 1.5 2.3 3.1 3.8 4.5 5.2 5.8 6.5 7.1 7.7 8.3
Sample size ACTUAL NUMBER OF DEVIATIONS FOUND

0 1 2 3 4 5 6 7 8 9 10
10 PERCENT RISK OF OVER RELIANCE
20 10.9 18.1 . . . . . . . . .
25 8.8 14.7 19.9 . . . . . . . .
30 7.4 12.4 16.8 . . . . . . . .
35 6.4 10.7 14.5 18.1 . . . . . . .
40 5.6 9.4 12.8 15.9 19.0 . . . . . .
45 5.0 8.4 11.4 14.2 17.0 19.6 . . . . .
50 4.5 7.6 10.3 12.9 15.4 17.8 . . . . .
55 4.1 6.9 9.4 11.7 14.0 16.2 18.4 . . . .
60 3.8 6.3 8.6 10.8 12.9 14.9 16.9 18.8 . . .
70 3.2 5.4 7.4 9.3 11.1 12.8 14.6 16.2 17.9 19.5 .
80 2.8 4.8 6.5 8.3 9.7 11.3 12.8 14.3 15.7 17.2 18.6
90 2.5 4.3 5.8 7.3 8.7 10.1 11.4 12.7 14.0 15.3 16.6
100 2.3 3.8 5.2 6.6 7.8 9.1 10.3 11.5 12.7 13.8 15.0
120 1.9 3.2 4.4 5.5 6.6 7.6 8.6 9.6 10.6 11.6 12.5
160 1.4 2.4 3.3 4.1 4.9 5.7 6.5 7.2 8.0 8.7 9.5
200 1.1 1.9 2.6 3.3 4.0 4.6 5.2 5.8 6.4 7.0 7.6

Computed Upper Deviation Rate (CUDR) = 3.8%

 (3%) (3.8%)

This suggests that the control is not effective.

Are the controls working? No, CUDR > TDR

 Steps in the Application of
Sampling in Test of Control
10.Document the sampling procedures.
Finally, the auditors will document the significant aspects of the prior
nine steps in the working papers.