Sampling work is judged on what happens after the test. A sample with an error and no investigation, projection or conclusion is a gap in the file. This post sets out the sequence the GAO Financial Audit Manual lays out, which applies the AU-C 530 and AU-C 450 requirements, adapted to a private-entity audit, and three scenarios that show the decisions. For test design see attribute sampling and monetary unit sampling. The standard is AU-C 530.
The seven steps
- Investigate the nature and cause of every deviation or misstatement and its possible effect on the purpose of the procedure and on other parts of the audit.
- Project the sample result to the population to get a likely misstatement. For a nonstatistical sample, make a judgment about the effect.
- Calculate the upper limit on misstatement (projected misstatement plus an allowance for sampling risk) or an interval estimate at the chosen confidence level.
- Consider qualitative aspects: the nature, cause and pattern of the items.
- Communicate the items to management and request correction of factual and projected misstatements that are not clearly trivial.
- Conclude whether the population is free of material misstatement, after any management adjustments.
- Evaluate the effect on the financial statements as a whole, and whether the risk assessment holds.
Every one of these steps needs a line in the workpaper.
Investigating the cause
Ask three questions for each exception: What happened? Why? What else might it affect? A pricing misstatement caused by a rate table that was not updated affects every invoice priced from the table, inside and outside the sample. A one-off keying error does not. The cause determines the extent of further work.
Compare causes in the sample. If three items share the same cause, treat it as a systematic problem and consider a targeted test of the whole class of transactions.
Treating items that look unrepresentative (anomalies)
An anomaly is a misstatement shown to be an isolated event that does not represent the population. The GAO manual is strict: project all misstatements unless highly persuasive evidence shows an item is not representative. If you decide an item is an anomaly, perform procedures to show the same type of misstatement does not exist elsewhere in the population, evaluate the item on its own, evaluate the sample excluding it, and obtain senior approval (the FAM names the audit director; use your firm's equivalent, normally the engagement partner). Do not label an item an anomaly because it is inconvenient. A single wrong item that you could not explain is not an anomaly.
Projection
For a statistical sample, project mechanically. For monetary unit samples, the FAM method is: for an item at or above the sampling interval, projected misstatement equals the actual misstatement; for smaller items, tainting times the interval. For attribute samples used for substantive tests, use the upper limit of the misstatement rate to produce a conservative dollar estimate.
For a nonstatistical sample, use a ratio estimate: misstatements found divided by the recorded amount of items tested, multiplied by the population (or untested portion of it). The result carries no statistical allowance for sampling risk, so consider the risk of further misstatement before relying on it.
Always keep the items that were individually identified (factual) apart from the extrapolated amount (projected). Only the extrapolated portion is projected; the factual items are not multiplied again.
Compare to tolerable misstatement
Compare the upper limit to tolerable misstatement. If the upper limit is lower, the sample supports the conclusion that the population is not misstated by more than tolerable misstatement at the confidence level used. If it is higher, the sample does not support that conclusion and you need a response.
Responses:
- Ask management to review the whole population (or the affected portion) and correct it. Test management's work.
- Extend the test, with a specialist's help if a statistical sample.
- Perform a targeted test of the cause.
- Revise the risk assessment and the nature, timing and extent of other procedures.
- Propose an adjustment for the projected amount.
Scenario 1: Clean sample
A 60-item MUS on $4.8 million of receivables has no misstatements. The upper limit equals the tolerable misstatement of $240,000. The sample supports the balance. Conclude, document, and move on. A clean result is not "no work." It still needs the investigation step written as "no exceptions" and the conclusion.
Scenario 2: A few misstatements with a limited cause
The sample is the 60-item MUS from the monetary unit sampling example, with two overstatements from the same cause: a customer price list updated on October 1 but not in the billing system for one product line. Projected misstatement is $24,000 and the upper limit is $280,400, above tolerable misstatement of $240,000. A sample sized for zero expected misstatement leaves no room for sampling risk once a misstatement appears in a below-interval item, so the sample alone does not support the balance.
The cause is a control issue, and it is isolated to one product line. The auditor tests all invoices for that product line after October 1, finds $31,000 of overbilling and asks management to book the entry. The auditor documents that both sample misstatements are explained by the cause now corrected across the affected invoices, that no other population is exposed to it, and that the engagement partner agrees with the conclusion. The projection is replaced by the actual amount for the affected invoices, and the control gap goes into the deficiency evaluation. See AU-C 265 communication.
Scenario 3: Upper limit exceeds tolerable misstatement
An inventory price test of a 50-item sample finds overstatements totaling $18,000 on items worth $210,000. Projecting to the $2.6 million population gives about $223,000 of likely overstatement. Tolerable misstatement is $190,000. Likely overstatement exceeds tolerable misstatement before any allowance for sampling risk.
Actions: the auditor investigates the cause (standard costs not updated after a supplier price decrease), asks management to revalue the affected categories, tests management's revaluation, and records the final difference. The auditor does not extend the sample and re-evaluate with the original table; adding items and reusing the evaluation is not valid, so a sampling specialist is consulted first. The revised amount goes on the uncorrected misstatements schedule if management does not book it, and the control failure goes to the risk assessment.
Items you could not test
If you cannot apply the procedure to a selected item and no alternative works, treat the item as a deviation (control test) or misstatement (test of details). If the aggregate of untested items, treated as misstated, would not change the conclusion, you may not need to test them. Otherwise perform alternative procedures. See alternative procedures for non-responses.
Understatements in an overstatement test
A sample designed to find overstatements, such as an existence test, is a weak test for understatement. If you find several understatements, consult the specialist before netting them against overstatements, and consider a separate test for completeness.
Effect on the whole audit
Revisit the risk assessment. If the sample revealed misstatements the controls should have caught, the risk assessment for related accounts may have been too low, and procedures elsewhere need to expand. Record the partner's conclusion that the risk assessment holds or has changed.
Documentation checklist
- Each exception, with cause and effect on other work.
- Projection computation and upper limit or software output.
- Anomaly justification and partner approval, if used.
- Comparison to tolerable misstatement and the decision.
- Items communicated to management and their response.
- Cross-reference to the uncorrected misstatements schedule.
- Effect on risk assessment and other procedures.
CORAA prepares ready-to-review audit files for US CPA firms; the firm keeps the client, the review and the signature. See /us.
Sources
- AICPA, AU-C Section 530, Audit Sampling; AU-C Section 450, Evaluation of Misstatements Identified During the Audit
- U.S. Government Accountability Office, Financial Audit Manual, Volume 1 (GAO-26-108577), June 2026, FAM 450 and 480 (evaluation of sample results, anomalies, projected misstatement): gao.gov
Part of CORAA University · Evidence and audit procedures: related guides, calculators and templates.
AU-C references are to AICPA Professional Standards, paraphrased here; read the standard itself before relying on a requirement. This page is guidance, not professional advice. Report an error