AU-C 530 Audit Sampling: Sample Sizes, MUS and Evaluating Results

AU-C section 530, Audit Sampling, applies when the auditor decides to use audit sampling in a GAAS audit of a nonissuer. It does not tell the auditor when to sample. It sets the rules for designing the sample, choosing its size, selecting the items, and evaluating what the results say about the whole population.

This page paraphrases the standard and explains common sampling methods. Read AU-C 530 and the AICPA Audit Guide Audit Sampling before relying on any point here. The sample size figures below come from probability math, not from the standard, and the attribute and MUS figures were recomputed from the binomial and Poisson formulas.

What is audit sampling?

Audit sampling means applying audit procedures to less than 100% of the items in a population that matters to the audit, in a way that gives every sampling unit a chance of being selected, so the auditor has a reasonable basis to conclude about the entire population.

Two things are not audit sampling, even though they test less than everything:

• Selecting specific items, such as every invoice over $50,000 or every journal entry posted after year end. The auditor concludes only on the items tested, not on the rest of the population.
• Testing 100% of a population, for example all fixed asset additions in a year with twelve of them.

AU-C 500 describes all three ways of selecting items for testing. Many audit programs combine them: test the large and unusual items specifically, then sample the remainder.

What is the objective of AU-C 530?

The auditor's objective, when using audit sampling, is to provide a reasonable basis for the auditor to draw conclusions about the population from which the sample is selected.

Sampling risk and nonsampling risk

Sampling risk is the risk that the auditor's conclusion from a sample differs from the conclusion that would be reached if the whole population were tested. It works in two directions:

Nonsampling risk is the risk of a wrong conclusion for any reason not related to sampling: using the wrong procedure, misreading evidence, or failing to recognize a misstatement. A larger sample does nothing for nonsampling risk. Good planning, supervision and review do.

Statistical or nonstatistical?

AU-C 530 allows both. A statistical approach uses random selection of the sample items and probability theory to evaluate the results, including measuring sampling risk. Any approach without both features is nonstatistical.

Nonstatistical sampling is common in smaller firms and is acceptable, but it is not a shortcut. The AICPA Audit Guide's view, widely followed in practice, is that a well-designed nonstatistical sample is ordinarily comparable in size to a statistical sample with the same inputs. A nonstatistical sample of 25 items "because we always pick 25" has no support.

Designing the sample

When designing an audit sample, the auditor considers the purpose of the audit procedure and the characteristics of the population. In practice the design answers four questions:

1. What is the objective? For tests of controls, the deviation that matters (for example, an invoice paid without approval). For tests of details, the misstatement that matters (for example, overstated receivables).
2. What is the population, and is it complete? The auditor tests that the population is complete before sampling from it. Sampling an aged receivables list that does not agree to the general ledger proves little.
3. What is the sampling unit? An invoice, a customer balance, a line item, or an individual dollar (in monetary unit sampling).
4. Should the population be stratified? Splitting a population into groups with similar characteristics, usually by size, reduces variability and can reduce the total sample size.

How large should the sample be?

The auditor determines a sample size sufficient to reduce sampling risk to an acceptably low level. The standard does not give numbers. The size is driven by:

Tolerable misstatement is a monetary amount set by the auditor for a sampling procedure, the amount of misstatement in the population the auditor is willing to accept. It is the application of performance materiality to that procedure, and it can be the same as or lower than performance materiality. See AU-C 320 materiality.

Sample sizes for tests of controls

Tests of controls usually use attribute sampling: each item either has a deviation or it does not. If no deviations are expected, the zero-deviation sample sizes follow from binomial probability:

Read it this way: if the true deviation rate were 5%, the chance of drawing 59 items with no deviation is under 5%. So 59 items with zero deviations supports 95% confidence that the rate is below 5%. Expecting even one deviation increases the size. Use the tables in the AICPA Audit Guide or the firm's tool for other inputs.

For controls that operate infrequently, populations are small and firms use a separate practice table. A commonly used one, practice and not part of AU-C 530:

Monetary unit sampling for tests of details

Monetary unit sampling (MUS), also called probability-proportional-to-size sampling, treats each dollar in the population as a sampling unit. Larger balances are more likely to be selected, which fits tests for overstatement such as receivables or inventory. It is weak for understatement, because a balance recorded at zero has no chance of selection.

With no misstatement expected, the sample size is:

Sample size = Population book value × Confidence factor ÷ Tolerable misstatement

The confidence factors come from the Poisson distribution. For zero expected misstatements they are about 3.0 at 95%, 2.3 at 90% and 1.6 at 80% confidence. When some misstatement is expected, the denominator is reduced by the expected misstatement multiplied by an expansion factor from the firm's or the Audit Guide's tables, so the sample grows.

The sampling interval is the book value divided by the sample size. A systematic selection with a random start picks one dollar in every interval. Every item larger than the interval is selected with certainty.

A worked example

Illustrative figures; arithmetic recomputed. Accounts receivable has a book value of $2,400,000. Tolerable misstatement for the test is $60,000. The auditor wants 95% confidence and expects no misstatement.

Confirmation and alternative procedures find one misstatement: a balance recorded at $5,000 should be $4,000.

The upper limit of $67,000 exceeds tolerable misstatement of $60,000, even though the actual error found was only $1,000. The auditor cannot conclude at 95% confidence that receivables are not misstated by more than $60,000. Options include asking management to investigate and correct the population, extending the test, or performing other procedures. This is why sizing a sample for zero expected errors is efficient only when errors really are rare.

(Had the misstated balance been larger than the $20,000 interval, its actual misstatement would be used directly, with no projection and no incremental allowance.)

Selecting the sample items

The auditor selects items so that each sampling unit in the population has a chance of selection. Common methods:

• Random selection, using a random number generator. A statistical sample needs random-based selection, either this or systematic selection with a random start.
• Systematic selection, picking every nth unit after a random start. Watch for patterns in the population that line up with the interval.
• Haphazard selection, picking without a structured technique but also without conscious bias. Acceptable for nonstatistical samples only. In practice it drifts toward easy-to-find items, so reviewers question it.
• Block selection, picking a run of consecutive items. Rarely appropriate for audit sampling, because one block cannot represent a whole population.

Performing the procedures

If a procedure cannot be applied to a selected item (for example, a voided check), the auditor performs it on a replacement item. If the auditor cannot perform the designed procedure or a suitable alternative on a selected item, that item is treated as a deviation or a misstatement. A customer who never answers a confirmation, with no alternative procedure performed, is not a clean item.

Evaluating the results

For every deviation or misstatement found, the auditor investigates its nature and cause and evaluates its possible effect on the purpose of the procedure and on other areas of the audit. A deviation that turns out to be intentional raises fraud questions under AU-C 240, not just a sampling question.

For tests of details, the auditor projects the misstatements found in the sample to the population. The projected misstatement, plus any misstatement found in items tested specifically, goes to the summary of misstatements under AU-C 450.

The auditor then evaluates whether the sample results give a reasonable basis for conclusions about the population:

• For tests of controls, an unexpectedly high deviation rate may increase the assessed risk of material misstatement, unless more evidence substantiates the initial assessment.
• For tests of details, an unexpectedly high misstatement may mean a class of transactions or an account balance is materially misstated, unless more evidence shows otherwise.

If the conclusion is that sampling did not give a reasonable basis, the auditor may ask management to investigate and adjust, change the nature, timing and extent of further procedures, or both.

What should the sampling workpaper show?

AU-C 530 has no separate documentation list, so AU-C 230 applies: AU-C 230 asks that an experienced auditor with no previous connection to the engagement can understand the work done. In practice that means being able to re-perform the test. A complete sampling workpaper records:

• the objective and the deviation or misstatement being tested for
• the population, its source and how completeness was tested
• the sampling unit and any stratification
• the inputs to sample size (confidence, tolerable and expected amounts) and the resulting size
• the selection method, random start or seed, and the identity of each item selected
• the results, every deviation or misstatement, and its investigation
• the projection, the evaluation and the conclusion

See AU-C 230 audit documentation.

Common weaknesses in sampling files

Practice checks, not requirements of the standard. Gaps to avoid:

• Sample sizes chosen by habit with no link to risk, materiality or confidence
• Population not reconciled to the general ledger before sampling
• Misstatements found in the sample written off as "isolated" and not projected
• Unanswered confirmations treated as clean with no alternative procedure
• Haphazard selections that cluster at the start of the year or in one location
• Tolerable misstatement for the test set above performance materiality

Related

• AU-C 320 materiality
• AU-C 315 risk assessment and SAS 145
• AU-C 230 audit documentation
• Audit working papers: types and how to prepare them
• Materiality calculator (AU-C 320)

Sources

• AICPA, AU-C Section 530, Audit Sampling
• AICPA, AU-C Section 500, Audit Evidence
• AICPA, AU-C Section 450 and AU-C Section 230
• AICPA Audit and Accounting Guide, Audit Sampling (sample size and monetary unit sampling methods)

AU-C references are to AICPA Professional Standards, paraphrased here; read the standard itself before relying on a requirement. This page is guidance, not professional advice. Report an error