Attribute sampling for tests of controls

In this lesson you will

Define a control deviation and the population for a test of controls.
Determine sample size from the factors in AU-C 530.A13.
Compute and interpret the upper deviation limit.
Respond to deviations under AU-C 330.17.

Design starts with the deviation

AU-C 530.06 requires you to consider the purpose of the procedure and the characteristics of the population when designing a sample. For a control test, that means writing down:

The control and the risk it addresses.
What counts as a deviation. For a three-way match: invoice paid without a matching receiving report, or quantities differing beyond the system tolerance. Approval by someone without authority counts. A late signature might or might not, depending on the control's design.
The population and period. All disbursements from January 1 to December 31, or through the interim date plus roll-forward procedures (AU-C 330.12).
The sampling unit. Each invoice, each payment, each reconciliation.

Sample size inputs

AU-C 530.A13 lists the factors for tests of controls:

Tolerable rate of deviation. The rate you can accept and still rely on the control at the planned level. AU-C 530.05 defines it. The more reliance you plan, the lower the rate.
Expected rate of deviation. Based on prior results and your understanding. AU-C 530.A10 notes that if it is unacceptably high, you will normally not test the control.
Desired level of assurance, the complement of the risk of overreliance. Based on how much the risk assessment depends on the control.
Population size, which matters only for very small populations.

AU-C 330.09 requires more persuasive evidence the greater the reliance, which in practice means a lower tolerable rate or lower risk, and a larger sample.

The math behind the tables

Statistical attribute samples rest on the binomial distribution. With zero expected deviations, the sample size is the smallest n for which the chance of seeing no deviations, if the true rate equalled the tolerable rate, is no more than the risk of overreliance:

(1 - tolerable rate) to the power n is at most the risk.

At 5% risk:

Tolerable rate	Sample size (zero expected deviations)
10%	29
7%	42
5%	59

Expecting deviations raises the size. Published tables, including those in the AICPA Audit Guide Audit Sampling, cover combinations of risk, tolerable rate and expected rate. The attribute sampling worksheet and sample size calculator apply them.

Selection and performance

AU-C 530.08 requires selection that you can reasonably expect to be representative. Random or systematic selection over the whole period works. AU-C 530.10: if an item is not applicable, such as a properly voided check, replace it (AU-C 530.A18). AU-C 530.11: if you cannot perform the procedure or an alternative on an item, treat it as a deviation.

Evaluation

AU-C 530.A25: for tests of controls, the sample deviation rate is also the projected rate. The decision uses the upper deviation limit, which adds an allowance for sampling risk. If the upper limit is at or below the tolerable rate, the sample supports reliance. If it exceeds the tolerable rate, it does not.

AU-C 330.17 requires specific inquiries into deviations, then a decision: are the tests a sufficient basis for reliance, are additional tests needed, or must the risk be addressed with substantive procedures? AU-C 530.12 requires you to investigate the nature and cause of each deviation. A deviation caused by intent, such as an override, is not just a rate problem.

Common findings

Deviation not defined before testing.
Sample drawn from only part of the period of reliance.
Deviations explained away ("one-off, employee on vacation") and reliance kept with no evaluation.
Undocumented sample size rationale.

See the worked example guide for a full file.

Worked example

Testing invoice approval

Bayshore Packaging Co. requires a manager's electronic approval on every vendor invoice before payment. The team plans to rely on the control to reduce substantive testing of expenses. Population: 6,420 invoices paid in 2026.

Design: deviation = invoice paid with no approval, or approval by someone without authority for the amount. Tolerable rate 5%, expected rate 0%, risk of overreliance 5%.

Sample size: find the smallest n where 0.95 to the power n is at most 0.05. 0.95^58 = 0.051, 0.95^59 = 0.048, so n = 59. The team selects 59 invoices with a random number generator across the full year.

Result: one deviation, a $3,400 invoice approved by a clerk while the manager was out.

Evaluation: sample rate 1 / 59 = 1.7%. Upper deviation limit at 5% risk for 1 deviation in 59, computed from the binomial distribution: about 7.8%. That exceeds the 5% tolerable rate.

Conclusion: the sample does not support the planned reliance. Under AU-C 330.17, the team inquires about the cause, confirms it was an approval delegation not built into the system, and decides not to rely. Control risk returns to maximum and substantive testing of expenses is expanded.

Self-check

Answer each question before you open the answer.

List the factors AU-C 530.A13 gives for sample size in tests of controls.
Show answer
Tolerable rate of deviation, expected rate of deviation, desired level of assurance (complement of the risk of overreliance), and population size when the population is very small.
In a test of controls, what is the projected deviation rate?
Show answer
The sample deviation rate itself (AU-C 530.A25). The decision then considers sampling risk through the upper deviation limit.
A selected document cannot be found and no alternative procedure is possible. How do you treat it?
Show answer
As a deviation (AU-C 530.11).
Why is a zero-expected, 5% tolerable, 5% risk sample 59 items?
Show answer
Because 59 is the smallest sample for which the probability of finding no deviations, if the true rate were 5%, is at most 5%: 0.95 to the power 59 is about 0.048.

Sources

Back to the syllabus

Standards are paraphrased from the primary sources listed above; read the source before relying on a requirement. This lesson is training material, not professional advice. Report an error