AUDITING: A RISK

ANALYSIS APPROACH
5th edition

Larry F. Konrath

Electronic Presentation
by Harold
O. Wilson 1
 Chapter 9

N = 19,500
n = 195
2
KEY CONCEPTS OVERVIEW

• Statistical sampling
• Non-statistical sampling
• Attribute sampling
• Control risk assessment
• Audit risk quantification
• Sampling techniques
3
LEARNING
OBJECTIVES
• Identify audit areas appropriate for
sampling
• Differentiate between statistical and
nonstatistical sampling
• Define expected vs. tolerable occurrence
rates, risk of underassessment, and upper
occurrence limit
• Apply attribute sampling to control risk;
quantify it for use in substantive testing
4
 SAMPLING
1. State the objectives.
2. Define the population, the
periods, and the sample unit.
3. Define “the attribute” and define
“deviation.”
4. Select the sampling method.
5. Determine the sample size, n.
6. Select samples
7. Evaluate the results. Repeat? 5
 A note on sampling
Sampling allows the reaching of conclusions
from less-than-100%-surveyed data. It saves
time and money, may be just as useful since
it may avoid some human errors in data
processing. The larger and more homo-
geneous a population, the more practical
sampling may become (whenever reasonable
assurance of conclusions is needed).
6
 ATTRIBUTE SAMPLING
• Sampling: Inferring characteristics
about a population [universe] of data
with less-than-complete information.
• Auditing example: What percentage of
Accounts Receivable debits (sales
invoices) are fictitious?
• Attribute sampling has been used to
estimate “error rates,” as a test of
internal controls for about fifty years!
7
 FAQ? n=?
Technically, what number of
items constitutes a “sample?”
• “1 item” is a sample. n = 1
• “All but 1 item” is also a sample. n=N - 1
• The term “100% sample” is an oxymoron; that
would be a “census;” all data known. n = N
• Taking a census is unnecessary and very
uneconomical in audit practice.
8
 “Statistical Sampling”
(Scientific Sampling)
Random sample: A sample selected in such
a manner that there is no evidence of an
unequal probability of selection of items.

“Random,” “scientific,” or “statistical”

sampling is in contrast to a sample which is
considered representative because of expert
judgment & experience. Both approaches
have their merits and demerits!
9
 “Attribute” Concepts
• Reprocessing and tracing of transaction data
may discover “errors.” A percentage will
be processed improperly in some way.
• The lower the error rate, the more reliable the
process! That is, the process may be “in
control,” or “out of control,” given a pre-
sample statement of an “intolerable rate.
• The exact sample sizes needed in attribute
sampling can be calculated
10
“Attribute” Concepts
& Auditing
The auditor’s tolerable rate of
occurrence of deviations from
prescribed internal controls =
The rate at which an auditor will
NOT revise CR upward NOR
expand planned substantive
testing. Intolerable rates may
prompt both actions.
11
 Examples: Y/N “attributes”
•Are non-cash credits to accounts
receivable properly approved?
•Are there approvals for voucher coding?
•Are there receiving reports for each
purchase invoice for inventory?
•Are labor rates based on personnel files?
•Are sales invoices supported by shipping
tickets?
•Do sales prices agree to catalogs?
12
 Examples of
SAMPLING PLANS
1. Random sampling (patternless and based
on random number tables/programs).
2. Systematic random sampling (e.g., selection of
every tenth Credit Memo).
3. Random sampling with population
stratified (e.g., larger items, smaller items).
4. From the above, but applied to every 50th
dollar used is known as Dollar Unit Sampling.

13
 Sampling Plans (con’t)

5. Choosing what “looks good,”

i.e., “representative” by an
expert that’s wise & experienced.

14
Non-statistical (Judgmental)
Vs. Statistical SAMPLING?
• Non-statistical sampling relies on expert subjective
judgment to determine what is to be considered
adequate sampling, to interpret results, and
reach conclusions.
• Non-statistical [judgmental] sampling can be
stated in terms of subjective probabilities, i.e., but
is often challenging to interpret.
• Sometimes, only judgmental sampling is
practical, e.g., an inventory of scrap piled into
large stacks over several acres.
15
• Statistical Samplings’ conclusions are
always stated in terms of probabilities,
risks, and confidence levels, based on
respected classic statistical techniques
and mathematics.

Both approaches are permitted under GAAS.

Many models exist to integrate the
approaches.
16
 SAMPLING PLANS:
COMMON OBJECTIVES
Sampling is often used to make
inferences [in audits] about either
1. Attributes (e.g., error or occurrence
rates)
2. Variables (e.g., mean dollar error in
auditors’ substantive tests of an
inventory valuation at FYE).

Objectives must be specified in advance! 17

 An additional objective…
• 3. Discovery sampling is used if just one
example of a particular event is
needed. “Needle in the haystack!”
• Example: “We need to find just one case
of a false expense account voucher to
show that the controls failed and need
improvement!” [There must have
been a clue—or hunch-- someplace!]
• Discovery sampling mathematics will not
be included in this presentation. 18
 AUDIT JUDGMENT &
STATISTICAL SAMPLING
• Mathematical statistics do not replace an
auditor’s experience & judgment!
• The statement of a tolerable error rate is a
judgment call, as is tolerable AR.
• To make AJES based on sample results, while
virtually dependant on such, is still the
In-Charge Auditor’s call.
• Statistical sampling, however, may be the best
support in court if an audit is questioned
and statisticians review it. 19
 FAQ?

Random sampling and haphazard

sampling are about the same
thing. Right?
NO! Randomness allows unbiased
probabilistic conclusions. Haphazard
“rules of thumb” and hunches do not,
but the “auditor’s sixth sense”
may! 20
 DETERMINING
n=? SAMPLE SIZE
• The initial sample size, n, is a
function of …
– Population size (if small, say if
N < 1,000 items)
– Expected occurrence rate (or
“anticipated error rate”), p.
– The actual occurrence rate, ,
which is unknown!
– The tolerable error rate! 21
 Observation
• Most accounting data populations have
small error rates, often less than 1%--
most bookkeepers, and computers, would
be fired if they made a mistake on
1% or more of their work!
• We shall assume a tolerable error rate is
6% today, just to make our math easy
to follow. [Likely, 2%-3% in practice
would be clearly intolerable.]
22
 Precision Defined
• Precision refers to the range around the
sample result, p, within which the true
population error rate should be contained.
• The sample’s error rate, p, is a random
variable; the population mean, , is
fixed! Theory: p, plus/minus a few points
= a range that contains the truth—with
expressed odds.
23
 DETERMINING
n=? SAMPLE SIZE
• What is an acceptable risk level, i.e.,
the probability of an incorrect
inference? (Let’s say 5% or less).
• Note: Reliability would be
R = (1 - 5%) = 95%.
• The true, but unknown, population
error rate , = ???
24
 DETERMINING
n=? SAMPLE SIZE
• What is the auditor’s tolerable error
rate for the population under audit?
(Let’s say, 6% for today.)
• Note: The sample’s result, p, becomes
a default surrogate for .

In financial data processing practice, error

rates are likely smaller than our illustrations.
25
 DETERMINING
n=? SAMPLE SIZE
SUMMARY before sampling:
The larger the a priori expected error rate,
or the larger the universe size, the larger the
initial sample should be.

The larger the tolerable error rate, or the

larger the tolerable precision, or the larger
the risk the auditor is willing to take, the
smaller the initial sample size can be. 26
 SAMPLING RISK VS.
NONSAMPLING RISK

• Sampling Risk: uncertainties related to

having less than complete universe data,
e.g., an unrepresentative sample result
and/or insufficient sampling; as, n = 3!
• Non-sampling Risk: uncertainties NOT
related to incompleteness of data, e.g.,
human error, mistakes, inept supervision,
organization, or interpretations. 27
 ILLUSTRATIVE CASE
Examining vouchers for a defined
characteristic (any default will be
considered an “error”):
Auditor’s acceptable risk = .05
A priori expected error rate = .03
Tolerable error rate = .06
Initial sample size, n = 195
As will be seen, exactly how the “initial 195” was
determined is not of great importance at this point!
28
A note on auditor’s risk

The auditor is only concerned

with the possibility of an
unacceptably HIGH error rate;
thus, a “classic one-tailed” test
on the upper limit is necessary.
We will put the entire risk on the
upper side. Although tables are
available, calculations are shown.
29
 ILLUSTRATIVE CASE
(less conservative approach)
Assume the errors, or “deviations,”
discovered in the sample (n=195) are
d = 3; the sample’s error rate is
p = 3/195 = .0154
Using auditor a priori estimate,
= [ (.03 * .97) /195 ] = .0122

The Standard Error of Proportions calculates

to .0122, and we would have … 30
 ILLUSTRATIVE CASE
Mathematically, the “upper” tolerance
limit, with 5% risk, is p plus the Standard
Error of Proportions times the t-score
related to 90% Reliability (i.e., 1.645):
.0154 + [.0122 x 1.645] = .0355
Note: x t R=.90
= .0201

The population error rate has only a 5%

chance of being higher than .0355.
31
 ILLUSTRATIVE CASE
• The auditor’s test indicates that the true
error rate has a 95% chance of being
someplace below .0355, well below the
.06 tolerance. [Auditor over-sampling!]
• More testing of this particular control
function is not necessary, since the
auditor’s random test result “engulfs,”
or “falls over,” a range which excluded
the pre-set .06 point-of-fear.
• Of course, = .06 is still possible! 32
 ILLUSTRATIVE CASE
(Ultra-conservative auditor)
Assume that the number of errors
discovered in the sample (n=195), is d = 3,
with a “worse case” view:
p = 3/195 = .0154
Mathematically, using
= [ (.5 * .5) /195 ] = .0253

Thus, with the “worst case” Standard Error

of Proportions being .0253, we have … 33
 ILLUSTRATIVE CASE
Mathematically, the “upper” tolerance
limit, with 5% risk, is p plus the Standard
Error of Proportions times the t-score:
.0154 + [.0253 x 1.645] = .057

Note:
x t R=.90
= .0416

The population error rate has only a 5%

chance of being higher than .057.
34
 ILLUSTRATIVE CASE
• Assume the last answer had been, e.g., .065,
above the tolerable rate. The auditor’s test
would be indicating a 95% chance that the
true error rate would not exceed .065--but it
could be anywhere below .065!
• More testing of this particular control would not
be required. The auditor might decided to…

INCREASE THE ASSESSED CR!

35
 FAQ?

Could the sample result

indicate such a “sufficiently
intolerable” error rate that the
client should “rework” the
data?

36
 FAQ?

How conservative should

auditors be when sampling?
Matter of opinion!!!
BUT, the more
heterogeneous …
To continue auditing when you
believe CR > 50% may be foolish. 37
 Observations ...

• Attribute sampling = clues as to risks of

acceptable final products, as in auditing,
or in eating at Coe’s Kwik Snax!
• Attribute sampling = clues to probabilities of
errors occurring, then “slipping by” both
the client and the auditor.
Even “100% sampling” cannot
eliminate risk! 38
 “CR” IMPACTS ON
“DR” SAMPLING
If CR is subjectively assessed as
higher than it should be, excessive
substantive testing (and excessive cost)
results. It is inefficient!

If CR is subjectively assessed as lower

than it should be, insufficient
substantive testing (and insufficient
evidence) results. It is ineffective!
39
Audit Programs and Samples
• Each audit program step could have its
samples and results. The auditor
would collectively view the set of
attributes tested, then express an
opinion on the caption.
• High uncertainty & risk (low
confidence) means that extensive
“good” information will be required
to convince any researcher that a
population is really “O.K.” 40
 FAQ?
Could [Should] IR be revised
retroactively if tests of transactions
disclosed unusually high error rates
or large dollar amounts of errors?

May be solely a
matter of auditor
judgment!
41
 Continuing…
• The weaker the internal controls,
• The higher the CR becomes, and
• The more IR should approach 100%
(even if revised by analytical
procedures),
• AND, the lower will be the Detection Risk
sought and demanded by the auditor!
• And vice versa!
42
 EVALUATING SAMPLING:
Qualitative Factors
• How critical is the nature of error rates?
• Was the criteria appropriate? Fraud?
• Should n be increased? (Attribute
sampling inferences “self correct” as n
increases!)
• Did any judgmental sampling give clues?
• Do other client procedures indicate the
control is effective?
43
 Final Observation
Assume a client has answered “NO,” to various
questions in the ICQ. Given the weaknesses,
tests of transactions may or may not confirm the
“state of the universe.” Substantive tests are
pending.

In Chapter 10, we will assume the audit of

various characteristics of sales processing,
starting with the following data:

44
 Case for Chapter 10

• AR = 5%
• N = 10,000
• n = 195 (initially)
• IR = 100% (poor conditions!)
• CR = 70% (poor controls!)
• Required DR = 7% or less
• n=?
45
 SCHEMA for
n in an Unknown Universe
CONTROLS:
Extensive Weak
OK!
D Small* LARGE!
A (as expected)
T Not OK!
A Small* Small*
(surprise?) (as expected)
* Confirming/destroying beliefs should not take long. 46
 Critical Key Terms
• Alpha risk • Random selection
• Attributes • Risk of
• Attribute sampling underassessment
• Beta risk • Sampling risk
• Discovery sampling • Sampling unit
• Expected occurrence • Statistical sampling
rate • Systematic sampling
• Non-statistical • Tolerable occurrence
sampling rate
• Population size • Upper occurrence rate
• Precision • Variables sampling
47
End of Chapter 9

48