How attribute sample sizes are set
AU-C 530 requires the auditor to set a sample size large enough to reduce sampling risk to an acceptably low level, but does not prescribe a formula. For statistical tests of controls, three inputs drive the size: the acceptable risk of overreliance (shown here as confidence, 1 − risk), the tolerable deviation rate, and the expected population deviation rate.
This calculator uses the exact binomial distribution: it finds the smallest sample n where, if you find ⌈n × expected rate⌉ deviations, the one-sided upper limit on the population rate is still within tolerable. That is the construction behind Tables A-1 and A-2 of the AICPA Audit Guide Audit Sampling, and at 95% confidence it returns the same sample sizes. A Poisson approximation (reliability factor ÷ tolerable rate) is shown for comparison; it runs a little larger (60 rather than 59 at 95% / 5% / 0%).
Evaluating the sample
After testing, the upper deviation limit is the highest population deviation rate consistent with what you found at the chosen confidence. If it is no more than the tolerable rate, the sample supports reliance. The gap between the sample rate and the upper limit is the allowance for sampling risk.
Common questions
How do I determine sample size for a test of controls?
Choose the risk of overreliance (confidence level), the tolerable deviation rate and the expected deviation rate. The sample size is the smallest number of items for which finding the expected number of deviations still leaves the upper limit on the deviation rate at or below tolerable. At 95% confidence, 5% tolerable and 0% expected that is 59 items.
What is attribute sampling in auditing?
Attribute sampling estimates the rate at which a control fails (a yes/no attribute) in a population. It is the usual statistical method for tests of controls under AU-C 530, as opposed to variables or monetary unit sampling, which estimate a dollar misstatement.
What tolerable deviation rate should I use?
Many firms use 5% when they plan substantial reliance on a control and up to 10% for moderate reliance. The lower the tolerable rate, the larger the sample. The rate is a judgment the auditor documents in the sampling plan.
Does population size change the sample size?
Hardly, once the population is more than a few thousand items. The AICPA tables assume a large population. For small populations a finite population correction reduces the sample; the calculator shows it when you enter a population.
What if I find more deviations than expected?
Recompute the upper deviation limit with the actual deviations. If it exceeds the tolerable rate, the sample does not support the planned reliance: reduce reliance on the control, test a compensating control, or extend substantive procedures. Always consider the nature and cause of each deviation, including whether it suggests fraud.
Runs in your browser. The figures you type are not sent to CORAA or stored. Check the result against your firm's methodology before relying on it.