Definition
Each item is judged yes or no: was the approval present, was the invoice matched, was the date correct? The result is a deviation rate, not a dollar amount. The auditor sets a tolerable rate of deviation, a confidence level and an expected rate, and these produce the sample size. Attribute sampling is the usual method for tests of controls.
Why it matters in an audit or review
The test answers whether a control can be relied on. If the sample deviation rate, adjusted for sampling risk, exceeds the tolerable rate, the control is not effective at the level assumed, and the auditor must revisit risk assessment and the extent of substantive procedures.
Example
A control requires a second signature on checks above $5,000 (illustrative). With a tolerable rate of 5 percent, 95 percent confidence and no expected deviations, a common rule of thumb gives about 60 items: the confidence factor of about 3.0 for 95 percent confidence and no expected deviations, divided by 0.05, is 60. The auditor finds zero deviations in 60 items and concludes the control may be relied on. One deviation would normally require a larger sample or no reliance.
Common mistakes
- Treating each deviation as a dollar error. The rate is what counts.
- Reducing the sample size because the control "has always worked."
- Not defining what counts as a deviation before testing starts.
FAQ
Does attribute sampling work for substantive testing?
Not for amounts. Dollar misstatement testing uses monetary unit or variables methods.
Sources
- AICPA, AU-C Section 530, Audit Sampling
- AICPA, AU-C Section 330, Performing Audit Procedures in Response to Assessed Risks
- AICPA, Audit Guide: Audit Sampling
Definitions paraphrase AICPA and FASB guidance; read the standard itself before relying on a requirement. Example figures are illustrative. This page is guidance, not professional advice. Report an error