Audit Sampling Explained: Risk, Sample Size and Evaluation
By SimplyCPA · 11 October 2026
On this page (8)
- Meaning: Applying a procedure to less than 100% of a population so the auditor can conclude about the whole population.
- Attribute sampling: Used for tests of controls — estimates a deviation rate.
- Variables and monetary-unit sampling (MUS): Used for substantive tests — estimate a dollar misstatement. MUS favours larger items.
- Sampling risk: Concluding from a sample differently than you would from the whole population. The dangerous direction is accepting a balance or relying on a control that you shouldn't.
- Sample size goes up when: Tolerable misstatement or deviation falls, expected misstatement rises, or the auditor wants more confidence.
Sampling risk vs non-sampling risk
- Sampling risk — the sample isn't representative, so the conclusion differs from what testing everything would show. Reduced by larger samples.
- Non-sampling risk — everything else: using the wrong procedure, misreading evidence, failing to spot an error. Reduced by planning, supervision and quality management.
The two wrong conclusions
| Effectiveness risk (dangerous) | Efficiency risk (costly) | |
|---|---|---|
| Tests of controls | Risk of assessing control risk too low — relying on a control that doesn't work | Risk of assessing control risk too high |
| Substantive tests | Risk of incorrect acceptance — accepting a materially misstated balance | Risk of incorrect rejection |
Effectiveness risks lead to the wrong audit opinion. Efficiency risks just cause extra work, because the auditor usually investigates further before acting on a "fail".
Attribute sampling (tests of controls)
The auditor sets a tolerable deviation rate and an expected deviation rate, picks a confidence level, and reads the sample size from a table. After testing, the upper deviation limit (sample deviation rate plus an allowance for sampling risk) is compared with the tolerable rate. If the upper limit exceeds tolerable, the control can't be relied on as planned.
Monetary-unit sampling (substantive tests)
MUS (also called probability-proportional-to-size sampling) treats every dollar as a sampling unit, so a $50,000 invoice is 50 times more likely to be selected than a $1,000 one. It's efficient for finding overstatements, but poor at finding understatements and zero or negative balances.
Worked example: Receivables have a book value of $3,000,000. Tolerable misstatement is $90,000, expected misstatement is nil, and the reliability factor for the desired confidence is 3.0.
Sample size = (Book value × Reliability factor) ÷ Tolerable misstatement = ($3,000,000 × 3.0) ÷ $90,000 = 100 items.
Sampling interval = $3,000,000 ÷ 100 = $30,000. Every item of $30,000 or more is automatically selected.
What drives sample size
| Factor | Effect on sample size |
|---|---|
| Lower tolerable misstatement or deviation rate | Increase |
| Higher expected misstatement or deviation rate | Increase |
| Higher desired confidence (lower acceptable sampling risk) | Increase |
| Higher assessed risk of material misstatement | Increase (substantive tests) |
| Population size | Little effect, except for very small populations |
Selecting the sample
- Random selection — every item has an equal chance (random number generator).
- Systematic selection — every nth item after a random start; MUS uses this on cumulative dollars.
- Haphazard selection — no conscious bias, but not statistical; acceptable for non-statistical sampling.
- Block selection — a contiguous group; rarely appropriate because it's unlikely to be representative.
Evaluating the results
Tests of controls
Tolerable deviation rate 6%; sample of 60; 2 deviations found. Sample rate = 3.3%. Using the AICPA table for the chosen confidence level, the upper deviation limit is, say, 8%. Because 8% exceeds the 6% tolerable rate, the auditor cannot rely on the control as planned — even though the sample rate looks low. It increases substantive testing instead.
Monetary-unit sampling
Project each misstatement to the population:
- For an item with a book value at or above the sampling interval, the projected misstatement is the actual misstatement.
- For a smaller item, calculate the tainting percentage (misstatement ÷ book value) and multiply it by the sampling interval.
Using the interval of $30,000 from above: an item recorded at $5,000 is found to be worth $4,000 — tainting = 20%, projected misstatement = 20% × $30,000 = $6,000. The upper limit on misstatement = projected misstatements + an allowance for sampling risk (basic precision of the reliability factor × interval = 3.0 × $30,000 = $90,000, plus incremental allowances). If that upper limit exceeds tolerable misstatement, the auditor concludes the balance may be materially misstated.
Deviations and misstatements must also be evaluated qualitatively — a single deviation caused by fraud matters far more than its rate suggests.
Full coverage, including classical variables sampling and selection methods, is in our AUD audit sampling notes.