Attribute Sampling for Control Tests: A Worked Example From Sample Size to Conclusion

Attribute sampling answers one question: how often does a control fail? The answer is a deviation rate, and the sample result is projected to the population. This guide runs one test from design to conclusion. For the broader choice of methods see audit sampling methods, and for the standard see AU-C 530.

Step 1: Define the control and the deviation

Write the control as a testable statement and define the deviation before you look at items.

• Control: Each vendor payment over $2,500 is approved by someone other than the preparer before release.
• Deviation: A payment over $2,500 with no evidence of approval, or approved by the preparer, or approved after release.

The GAO Financial Audit Manual makes the point with a similar example: a deviation in cash disbursements is defined as an invoice not approved and initialed by an authorized individual. Define it in terms of the control not followed, not the dollar effect.

Step 2: Define the population and period

The population is every payment over $2,500 in the period you want to rely on the control, say January 1 to December 31. The sampling unit is a payment. Test the population's completeness by tying the listing to the disbursements journal total. A population with missing items cannot support the conclusion.

If controls differ across locations, test each location as a separate population or decide that one control system covers all.

Step 3: Set three inputs

Tolerable rate depends on how heavily you rely on the control: lower tolerable rates for high reliance. A higher expected rate increases the sample.

Step 4: Get the sample size

Use a table or software. The GAO Financial Audit Manual publishes a table for a 90 percent confidence level and a 5 percent tolerable rate of deviation:

A binomial recompute at 90 percent confidence and 5 percent tolerable rate gives 45, 77, 105, 132 and 158 items for zero to four deviations, so the manual's 78 is the binomial 77 rounded up. Poisson-based tables give slightly larger sizes (47, 78, 107, 134, 160). The table assumes a population over 5,000 items. For a smaller population the manual suggests asking the audit sampling specialist for a reduced sample size, and notes the effect is generally small unless the table sample is more than 10 percent of the population. It also states that if no deviations are expected, the 45-item sample is the most efficient, and that if no deviations are found, 45 items supports the control risk assessment. The manual also shows a 10 percent tolerable rate table, used only to evaluate results when preliminary control risk is low and deviations exceed the 5 percent table. If you choose a different confidence level or tolerable rate, use software and note that the table does not apply.

Our example: 5 percent tolerable, 0 percent expected, 90 percent confidence gives 45 items. The example population is 3,600 payments, and 45 is about 1 percent of it, so a reduction would be small.

Step 5: Select the items

Select randomly or systematically, without regard to dollar amount, so each item has a chance of selection. A computer-generated random selection or a systematic selection from a random start both qualify. Do not substitute judgment-selected high-dollar items for the sample, though you may test those in addition for other purposes.

Systematic selection example: population of 3,600 payments, sample 45, interval 3,600 ÷ 45 = 80. Pick a random start between 1 and 80, say 37. Select payments 37, 117, 197 and so on. Check the population for patterns that line up with the interval, such as every 80th item falling on the same preparer.

Step 6: Perform the procedure on each item

For each selected item, inspect the evidence of approval and note:

• Approver, date and authority level.
• Whether the approver differs from the preparer.
• Whether approval preceded release of payment.

If an item is not applicable, such as a voided check, replace it with another randomly selected item after satisfying yourself the void is proper. If you cannot apply the procedure or find an alternative, treat the item as a deviation.

Step 7: Evaluate

Count deviations. Compare to the acceptable number for the sample size.

• 0 deviations in 45: the control supports the planned reliance. At 90 percent confidence the true rate does not exceed about 5 percent.
• 1 deviation in 45: exceeds the acceptable number for the 5 percent table. The FAM allows the auditor, if reliance was high, to reassess control risk as moderate when the deviation count is within the 10 percent table (one in 45), and to conclude the control is not effective if more.
• 2 or more in 45: the control is not operating effectively for the planned reliance.

Investigate every deviation for cause: a new employee, a seasonal volume spike, a system change, or a pattern of override. Determine whether the test supports reliance, whether tests of compensating controls are needed, and whether substantive procedures must expand.

Worked example

The auditor tests 45 payments over $2,500 out of a population of 3,600.

• 43 payments have approval by a second person before release.
• 1 payment was approved by the preparer, who is also the controller.
• 1 payment was approved four days after the check cleared.

Two deviations in 45. The sample does not support reliance for the planned low control risk assessment. The auditor:

1. Investigates: the preparer-approved item was paid while the CFO was on leave, and the late approval was a duplicate invoice flagged by the CFO afterward.
2. Considers whether the period of the deviations (both in August) points to a delegation gap.
3. Concludes the control did not operate effectively for the full period and reassesses control risk as high for disbursements.
4. Expands substantive testing of accounts payable and expense by increasing sample sizes and extending the search for unrecorded liabilities.
5. Evaluates whether the deviations are a significant deficiency for the AU-C 265 communication.

If a larger sample might produce an acceptable result, consult a sampling specialist before selecting more items. Evaluating extra items against the original table is not valid.

Common errors

• Drawing the sample before defining the deviation.
• Using a population that excludes unusual items.
• Selecting for convenience, the first 45 of the month, rather than at random.
• Treating a missing document as "N/A."
• Extending the sample to wash out a deviation without a valid statistical basis.
• Testing the control at one point in time and concluding on the whole year.

Documentation checklist

• Control description and deviation definition.
• Population, period and completeness tie-out.
• Tolerable, expected rate, confidence level and sample size.
• Selection method and start.
• Results by item with tick marks.
• Deviation analysis and conclusion on the risk assessment.

CORAA prepares ready-to-review audit files for US CPA firms; the firm keeps the client, the review and the signature. See /us.

Sources

• AICPA, AU-C Section 530, Audit Sampling; AU-C Section 330, Performing Audit Procedures in Response to Assessed Risks and Evaluating the Audit Evidence Obtained
• U.S. Government Accountability Office, Financial Audit Manual, Volume 1 (GAO-26-108577), June 2026, FAM 450 (sample sizes and acceptable deviations at a 90 percent confidence level, evaluation of deviations): gao.gov

AU-C references are to AICPA Professional Standards, paraphrased here; read the standard itself before relying on a requirement. This page is guidance, not professional advice. Report an error