PCAOB AS 2315, Audit Sampling, and AICPA AU-C 530, Audit Sampling, ask for the same core work: design a sample for a stated purpose, choose a size that holds sampling risk to an acceptable level, select representative items, test every item, project the results, and evaluate them against a tolerance. The difference is mostly in structure and detail. AS 2315 is a short, older, narrative standard that discusses tests of details and tests of controls separately. AU-C 530 is a clarified standard with numbered requirements and application material.
Firms that audit both issuers and nonissuers can use one sampling methodology for both, with a few adjustments covered below. For method choices see audit sampling methods, and for what to do after testing see evaluating sample results.
What is audit sampling in each standard?
AS 2315 paragraph .01: applying an audit procedure to less than 100 percent of the items in an account balance or class of transactions to evaluate some characteristic of the balance or class. Paragraph .03 says there are two approaches, nonstatistical and statistical, and either can provide sufficient evidence when properly applied.
AU-C 530 paragraph .05 defines sampling as the selection and evaluation of less than 100 percent of the population of audit relevance such that the auditor expects the sample to be representative. It then defines statistical sampling by two characteristics: random selection, and an appropriate statistical technique to evaluate results, including measuring sampling risk. An approach lacking either is nonstatistical. AS 2315 does not draw that line in a definition.
A3 of AU-C 530 clarifies that examining a few items to understand operations or controls is not sampling.
How do they describe sampling risk?
Both treat sampling risk as the chance that a sample leads to a different conclusion than testing the whole population. Both split it into an effectiveness risk and an efficiency risk.
| Concept | AS 2315 | AU-C 530 |
|---|---|---|
| Wrongly accepting a material misstatement | Risk of incorrect acceptance (paragraph .12) | Sampling risk of the first type: a material misstatement does not exist when it does (paragraph .05) |
| Wrongly rejecting | Risk of incorrect rejection | Sampling risk of the second type |
| Controls, too much reliance | Risk of assessing control risk too low | Controls more effective than they are |
| Controls, too little reliance | Risk of assessing control risk too high | Controls less effective than they are |
AS 2315 paragraphs .13 and .14 say incorrect rejection and assessing control risk too high relate to efficiency, while incorrect acceptance and assessing control risk too low relate to effectiveness. AU-C 530 says the auditor is primarily concerned with the first type because it affects audit effectiveness and is more likely to lead to an inappropriate opinion.
How do they set the sample size?
AS 2315 paragraph .16 lists what to consider for a substantive test of details: the relationship to the audit objective, tolerable misstatement, the allowable risk of incorrect acceptance, and population characteristics. Paragraph .19 ties the allowable risk of incorrect acceptance to the assessed inherent and control risk and to other substantive procedures aimed at the same objective: the lower those assessments, the higher the allowable risk and the smaller the sample. Paragraph .23A says a properly applied nonstatistical sample ordinarily will be comparable to, or larger than, an efficient statistical one.
AU-C 530 A13 lists the same drivers. For tests of details they are the desired assurance, based on the risk of material misstatement and the assurance from other substantive procedures, plus tolerable misstatement, expected misstatement and stratification. For tests of controls they are the tolerable rate, the expected rate, the desired assurance and, if the population is very small, its size. A14 says sample size is not a valid criterion for choosing between statistical and nonstatistical.
Two differences stand out:
- Tolerable misstatement. AS 2315 paragraph .18A says that when the population is part of an account, tolerable misstatement for the population ordinarily should be less than for the account, to allow for misstatement in the unsampled portion. AU-C 530 A6 says tolerable misstatement is performance materiality applied to a sampling procedure and may be the same or smaller.
- Tolerable rate examples. AS 2315 paragraph .34 offers an illustration: for low planned control risk and high assurance from the sample alone, a tolerable rate of 5 percent or less; for higher planned control risk or assurance from other tests, 10 percent or more. AU-C 530 gives no such figures. A firm that borrows them should record the basis for the rate it picks in its own file.
How are items selected?
AS 2315 paragraph .24 says items must be selected so the sample can be expected to be representative, with all items having a chance of selection, and names haphazard and random-based selection for substantive tests. For tests of controls, paragraph .39 names random-based selection and says the method should have the potential to select from the entire period.
AU-C 530 paragraph .08 sets the same representativeness requirement. A17 says statistical sampling uses random selection, and nonstatistical sampling mainly uses random or haphazard. A16 lists simple random, systematic random and probability-weighted (including monetary unit) techniques. AU-C 530 A8 adds that, under AU-C 500, the auditor performs procedures to obtain evidence that the population is complete.
What if a selected item cannot be tested?
AS 2315 paragraph .25: the treatment of unexamined items depends on their effect on the evaluation. If treating them as misstated would not change the conclusion, no further examination is needed. If it would, the auditor considers alternative procedures. The auditor also evaluates the implications for risk assessments including fraud risk, management integrity and other parts of the audit.
AU-C 530 paragraph .10 requires a replacement item if the procedure does not apply (for example a properly voided check, A18). Paragraph .11 requires treating an item as a deviation or misstatement if neither the planned nor suitable alternative procedures can be applied. A19 keeps the same "would not alter the evaluation" relief for unexamined items, and notes AU-C 240 on fraud implications.
How do you project and evaluate?
Both require projection. AS 2315 paragraph .26 projects the misstatement to the population, adds it to misstatements found in items examined 100 percent, and compares the total with tolerable misstatement while giving appropriate consideration to sampling risk. AU-C 530 paragraphs .13 and .14 require projecting to the population and evaluating the results including sampling risk. A27 says the projected misstatement is the best estimate, and the closer it comes to tolerable misstatement, the more likely actual misstatement exceeds it.
Both require attention to the nature and cause of misstatements (AS 2315 paragraph .27, AU-C 530 paragraph .12), and both say high-misstatement results may require revising risk assessments (AS 2315 paragraph .28, AU-C 530 A26).
AS 2315 paragraph .44 covers dual-purpose samples: the size is the larger of the two separate sizes, and deviations and misstatements are evaluated separately. The AICPA material on dual-purpose tests is in AU-C 330 A24 rather than AU-C 530. See AU-C 330 responses.
Worked example: projection
AS 2315 paragraph .26 uses this scenario: every twentieth item is selected from 1,000 items, giving 50 sample items, and the overstatement found is $3,000. The sampled fraction is 50 / 1,000, so the projection is $3,000 / 0.05 = $60,000.
Suppose also that the auditor examined 100 percent of a few large items and found an $8,000 overstatement in them. The total projected misstatement is $60,000 + $8,000 = $68,000. If tolerable misstatement for the population is $90,000, the result is 75.6 percent of tolerable misstatement. The recorded amount is not rejected on this evidence alone, yet the margin is thin. Under both standards the auditor considers sampling risk: the projected amount is a point estimate, and there is a real chance that actual misstatement exceeds $90,000. The auditor looks at the causes, considers other evidence, and decides whether to extend testing.
Frequently asked questions
Which standard applies to a private company audit?
AU-C 530. AS 2315 applies to audits of issuers under PCAOB standards. See AICPA and PCAOB standards compared.
Does documentation differ?
Neither standard has its own documentation paragraph. The general documentation standards apply: AU-C 230 for nonissuers and the PCAOB's documentation standard for issuers. See AU-C 230.
Sources
- AICPA, AU-C Section 530, Audit Sampling (paragraphs .01 to .14, A3 to A28): https://www.aicpa-cima.com/resources/landing/aicpa-professional-standards
- AICPA, AU-C Section 330, Performing Audit Procedures in Response to Assessed Risks and Evaluating the Audit Evidence Obtained (A24, dual-purpose tests): https://www.aicpa-cima.com/resources/landing/aicpa-professional-standards
- PCAOB, AS 2315, Audit Sampling (paragraphs .01 to .48): https://pcaobus.org/oversight/standards/auditing-standards/details/AS2315
CORAA prepares ready-to-review audit files for US CPA firms from client books; you review and sign. See /us.
Part of CORAA University · Evidence and audit procedures: related guides, calculators and templates.
AU-C references are to AICPA Professional Standards, paraphrased here; read the standard itself before relying on a requirement. This page is guidance, not professional advice. Report an error