Skip to content
SimplyCPA
CPA/AUD/Audit Sampling

Audit Sampling

Statistical and nonstatistical sampling, sampling risk, and how sample size responds to risk and tolerable misstatement.

By SimplyCPA · Updated 27 September 2026

Hard 1 hr 5 minArea III: Performing Further Procedures and Obtaining Evidence
Text size
On this page (8)

Why this topic matters

Audit sampling — covered by the clarified auditing standards (AU-C) in AU-C 530 — means applying a procedure to less than 100% of a population so that every sampling unit has a chance of selection, and projecting the results. Auditing and Attestation (AUD) tests the sampling risks, the factors that change sample size, attribute sampling for controls, and monetary-unit sampling for balances — including calculations.

Sampling and non-sampling risk

TestRisk that affects effectiveness (worse — wrong opinion)Risk that affects efficiency (extra work)
Tests of controlsOverreliance — concluding controls are more effective than they areUnderreliance — concluding controls are less effective than they are
Substantive testsIncorrect acceptance — concluding a balance is not materially misstated when it isIncorrect rejection — concluding a balance is misstated when it is not

Non-sampling risk arises from anything other than sampling: using an inappropriate procedure, misinterpreting evidence, or failing to recognize a deviation. It is reduced through planning, supervision, and quality management — not by larger samples.

Statistical versus nonstatistical sampling

  • Both are acceptable under generally accepted auditing standards (GAAS).
  • Statistical sampling uses random selection and probability theory to measure and control sampling risk quantitatively.
  • Nonstatistical sampling relies on judgment; sample sizes should be comparable to a statistical sample giving the same assurance.
  • Selection methods: random (every item equal chance), systematic (every nth item after a random start), haphazard (no conscious bias — nonstatistical only), and block selection (generally inappropriate).

Items that are individually significant or high-risk are usually examined 100% and excluded from the sampled population (stratification).

Attribute sampling — tests of controls

FactorEffect on sample size
Acceptable risk of overreliance ↓Increase
Tolerable deviation rate ↓Increase
Expected population deviation rate ↑Increase
Population size (large populations)Little or no effect

Evaluating results

  1. Sample deviation rate = deviations ÷ sample size.
  2. Upper deviation rate (from tables) = sample rate + allowance for sampling risk.
  3. If the upper deviation rate ≤ tolerable rate, the control can be relied on as planned. If it exceeds the tolerable rate, reduce reliance (raise assessed control risk) and expand substantive procedures.

EXAMPLE: Tolerable deviation rate 5%. A sample of 100 invoices finds 2 deviations (sample rate 2%); the table gives an upper deviation rate of 6.2%. Because 6.2% > 5%, the auditor cannot rely on the control as planned.

Also consider the qualitative nature of deviations: an intentional deviation may indicate fraud, which matters more than the rate.

Variables sampling — substantive tests

FactorEffect on sample size
Acceptable risk of incorrect acceptance ↓ (higher assessed risk of material misstatement)Increase
Tolerable misstatement ↓Increase
Expected misstatement ↑Increase
Population variability (standard deviation) ↑ — classical methodsIncrease
Stratification of the populationDecrease

Classical variables methods

  • Mean-per-unit: average audited value × number of items.
  • Ratio estimation: (audited value ÷ book value of sample) × population book value — best when misstatements are proportional to book values.
  • Difference estimation: average difference × number of items — best when misstatements are similar in size.

Ratio and difference methods need a reasonable number of misstatements in the sample to work.

Monetary-unit sampling (probability-proportional-to-size)

Monetary-unit sampling, also called probability-proportional-to-size (PPS) sampling, treats each dollar as a sampling unit, so larger items are more likely to be selected. It is designed to detect overstatement, works well when few misstatements are expected, and does not require a standard deviation.

  • Sampling interval = population book value ÷ sample size (or tolerable misstatement ÷ reliability factor).
  • Any item with a book value ≥ the interval is always selected.
  • Zero or negative balances need separate testing; understatements are hard to detect.

Projecting misstatement with PPS

ItemProjected misstatement
Book value ≥ intervalActual misstatement (no projection)
Book value < intervalTainting % × interval, where tainting % = (book − audited) ÷ book

Upper misstatement limit = projected misstatement + basic precision (reliability factor × interval) + incremental allowance. If the upper limit ≤ tolerable misstatement, accept the balance.

EXAMPLE: Population $600,000, sample size 60 → interval $10,000. An item recorded at $8,000 has an audited value of $6,000: tainting = 2,000 ÷ 8,000 = 25%; projected misstatement = 25% × 10,000 = $2,500. An item recorded at $15,000 with an audited value of $14,000 contributes its actual $1,000.

Evaluating misstatements

  • Project sample misstatements to the population and compare to tolerable misstatement, considering an allowance for sampling risk.
  • Investigate the nature and cause of each misstatement — fraud, a systematic error, or an anomaly (an anomaly may be excluded only if the auditor is highly certain it is not representative).
  • If projected misstatement is close to or exceeds tolerable misstatement, ask management to investigate and correct, extend testing, or modify the opinion.

How it is tested

  • Match sampling risks to effectiveness or efficiency.
  • Predict the direction of sample size changes.
  • Evaluate attribute sampling results against the tolerable rate.
  • Compute the PPS interval and projected misstatement.

EXAM TIP: The two dangerous risks are overreliance (controls) and incorrect acceptance (substantive) — both lead to an audit failure. The other two only waste time.