Definition
Whenever an auditor tests less than 100 percent of a population, the sample may not represent it. Sampling risk is that gap. For tests of controls it appears as the risk of assessing control risk too low or too high. For substantive tests it is the risk of accepting a materially misstated balance or rejecting a fair one.
Why it matters in an audit or review
Sampling risk is controlled by sample size and selection method. A larger sample cuts it, and a representative method such as random or monetary unit selection supports it. It differs from nonsampling risk, which comes from errors in applying procedures or interpreting results.
Example
Illustrative: a test of 60 invoices finds 2 deviations, a 3.3% sample deviation rate. At a 95% confidence level the upper deviation limit is roughly 10%, above a 5% tolerable rate, so the sample does not support the planned reliance on the control.
Common mistakes
- Picking items judgmentally and then projecting as if random.
- Not projecting misstatements found in the sample to the population.
- Assuming a clean sample proves the population is clean.
FAQ
What is the difference between sampling risk and nonsampling risk?
Sampling risk comes from testing only part of a population. Nonsampling risk comes from any other cause of a wrong conclusion, such as using an inappropriate procedure.
Sources
- AICPA, AU-C Section 530, Audit Sampling
- AICPA, Audit Guide: Audit Sampling
Definitions paraphrase AICPA and FASB guidance; read the standard itself before relying on a requirement. Example figures are illustrative. This page is guidance, not professional advice. Report an error