A sample is a claim about items you did not look at. When an internal auditor tests 25 route settlements out of 37,400 and reports that the control is operating effectively, the audit committee hears a statement about all 37,400, and the only thing behind that statement is the design of the sample. Most sampling in internal audit is still done by habit: 25 because the SOX template says 25, “haphazard” because the auditee sent a box of files, one exception waved through as “isolated” because the alternative was another week of fieldwork. Those habits produce workpapers that cannot answer the two questions a good reviewer asks: what confidence does this sample give, and what happens to the conclusion if the deviation you found is not the only one. External auditors who want to rely on your work under the ICFR program ask the same questions with AS 2315 open.
This guide gives you the tools to choose a method and defend it: a method-selection decision table, attribute sample-size tables at 90% and 95% confidence computed from the binomial distribution (with the Poisson alternative, so you know why two tools disagree by one item), a monetary-unit sampling example on an $8.4 million inventory population taken from selection through the evaluation of two misstatements, a stratified sample with Neyman allocation, an exception-evaluation and projection table, model workpaper language, and a common-failures table. It was rewritten in September 2026 to reflect the Global Internal Audit Standards and current practice, and it pairs with the site’s shorter guide to the 25/40/60 sample-size conventions and the beginner’s guide to substantive testing. The running example is MidState Beverage, the site’s three-state distributor with 12 depots, a 2013 ERP and a six-person audit function.
In this guide
- What a sample can and cannot tell you
- Choosing the method: two decision tables
- Attribute sample sizes you can defend
- Evaluating exceptions and projecting results
- Monetary-unit sampling: a worked example on $8.4 million of inventory
- Stratified sampling: a worked example with allocation
- When full-population analytics replaces sampling
- Documenting and defending the sample
- Common sampling failures and edge cases
What a sample can and cannot tell you
Audit sampling is the application of a procedure to less than 100% of a population so that every item had a chance of selection and the result can be extended to the whole population. That definition, shared by AU-C 530, ISA 530 and PCAOB AS 2315, rules out two things auditors routinely call sampling. Picking the 20 largest invoices is targeted testing of key items, and it says nothing about the invoices you did not pick. Testing the folder the auditee handed you is not sampling either, because items outside the folder had no chance of selection. Both procedures have their place; neither supports a sentence that begins “based on our sample, the population…”
The gap between statistical and non-statistical sampling is narrower than most people think. Both require a complete population, a selection that gives every item a chance, and a projection of the results. The only thing a statistical sample adds is the ability to quantify sampling risk: to say “at 95% confidence the deviation rate is below 5%” rather than “we found no exceptions in 25 items.” Standard 14.1 of the Global Internal Audit Standards requires information that is sufficient, reliable, relevant and useful, and Standard 14.2 requires the analysis to support the findings; neither mandates statistics, but a sample whose confidence you cannot state is hard to call sufficient for a high-risk conclusion. The audit evidence guide covers sufficiency in general; this guide covers the part that depends on the sample.
| Risk | In a test of controls | In a dollar (substantive) test | How you control it |
|---|---|---|---|
| Sampling risk, wrong-way (the one that hurts) | Overreliance: the sample passes a control whose true deviation rate exceeds the tolerable rate | Incorrect acceptance: the sample passes a materially misstated balance | Set by the confidence level; the sample size holds it at 5% or 10% |
| Sampling risk, other-way (the one that costs) | Underreliance: the sample fails a control that works, triggering extension or a finding that evaporates | Incorrect rejection: the sample flags a balance that is fine | Reduced by a larger sample or a realistic expected rate; tolerated because its cost is time, not a wrong opinion |
| Non-sampling risk | The auditor looks at the right items and misses the deviation: wrong attribute, wrong criteria, careless re-performance | Misreading a count, accepting a copy for an original, mis-pricing the audited value | Precise attribute definitions in the work program, reviewer re-performance of a subset, training; no sample size fixes it |
The three inputs that set every sample size
Every statistical sample size, for an attribute test or a monetary-unit sample, is a function of three inputs, and the population’s size barely matters once it is above a few thousand items. The first is confidence, the complement of the sampling risk you accept: 95% confidence means a 5% risk of overreliance. The second is the tolerable rate (or tolerable misstatement): the highest deviation rate the population could have and still support reliance, typically 5% for a key control and up to 10% for one backed by compensating controls. The third is the expected rate: the deviation rate you actually think exists, from last year’s results, the walkthrough and the control’s operating conditions.
| Input | What it means | Typical setting | Effect (starting from 95% confidence, 5% tolerable, 0% expected = 59 items) |
|---|---|---|---|
| Confidence level | 1 minus the risk of overreliance you accept | 95% for key controls relied on by the ICFR program; 90% for controls with compensating controls or advisory work | Dropping to 90% cuts 59 to 45; raising to 99% pushes it to 90 |
| Tolerable deviation rate | The maximum population rate compatible with reliance | 5% key control; 8% moderate reliance; 10% low reliance | Raising 5% to 10% cuts 59 to 29; lowering to 3% raises it to 99 |
| Expected deviation rate | The rate you genuinely expect, so the sample can absorb it and still meet the tolerable rate | 0% for a mature automated or well-evidenced control; 1% to 2% for manual controls with occasional lapses | Expecting 1% raises 59 to 93 (1 deviation allowed); 2% raises it to 181 (4 allowed) |
| Population size | Number of sampling units in the period | Matters only below roughly 1,000 items, where the finite population correction applies | Population of 250: 51 instead of 59; population of 52: 33 |
Two of these inputs are judgments and the third is a forecast, which is why the same control at two companies can legitimately carry sample sizes of 29 and 93. What is not legitimate is choosing the inputs after the fact to make a sample of 25 look sufficient. A reviewer who sees “95% / 5% / 0%” in a workpaper next to a sample of 25 knows the inputs were not used.
Define the population before you size the sample
Sample size is the last decision, not the first. Before it come the population (every instance of the control’s operation, or every item in the balance, for a stated period), the sampling unit (a settlement sheet, an invoice line, a dollar), and the completeness check that proves the list you are sampling from is the population and not a subset. At MidState the route-settlement population for the FY27 route cash engagement was 37,400 settlements, but the ERP route-accounting module only held settlements for the 12 legacy depots; the two acquired distributors settle on spreadsheets and had to be added before any sample could speak for the whole company. Reconcile the population file to an independent total (settlement count to route-day count, invoice listing to the subledger control total), document it, and treat the report itself as information produced by the entity that needs its own IPE testing. A perfect sample from an incomplete population is a perfect answer to the wrong question.
Choosing the method: two decision tables
Auditors confuse two separate choices: how items are selected (random, systematic, haphazard, judgmental) and how results are evaluated (attribute, monetary-unit, classical variables, or not at all). Random and systematic selection can feed either a statistical or a non-statistical evaluation. Haphazard selection, done without conscious bias, can feed a non-statistical evaluation but never a statistical one, because you cannot compute the probability that a given item was chosen. Judgmental selection feeds no projection at all. The first table starts from the question the test must answer, which is where method selection should start.
| Question the test must answer | Method | Sampling unit and selection | What the result lets you say | MidState example |
|---|---|---|---|---|
| Did a control operate as designed, yes or no, across the period? | Attribute sampling (statistical), or non-statistical with the same sizes | One control occurrence; random or systematic with random start | “At 95% confidence the deviation rate does not exceed X%” | Depot manager review of daily settlement reconciliations |
| Is a recorded balance overstated by more than tolerable misstatement? | Monetary-unit sampling (MUS, also called PPS or dollar-unit sampling) | One dollar; systematic through cumulative dollars, large items fall in automatically | “At 95% confidence overstatement does not exceed $X,” plus a most-likely misstatement | ERP perpetual inventory at cost, $8.4 million |
| What is the total misstatement, either direction, in a population whose records may be unreliable? | Classical variables sampling, usually stratified, evaluated by difference or ratio estimation | One logical item (a line, an account); random within strata | “Estimated misstatement $X, plus or minus $Y at 90% confidence” | Spreadsheet inventory listings of the two acquired distributors |
| Does a rare, serious condition exist at all (ghost employee, phantom vendor, forged approval)? | Discovery sampling: attribute sampling with zero expected deviations, read from the other side | One item; random | “If 1% or more of the population were affected, 299 items would have found at least one case with 95% probability” | Vendor master additions without a W-9 and independent verification |
| Which specific items are wrong, and how much is at stake in them? | Targeted (key-item) testing, not sampling | Items chosen by size, risk score or analytic flag; tested 100% | Only what you found in the items examined; no projection | All 1,412 self-approved variance overrides from the FY27-01 report |
A walkthrough with a test of one to three instances belongs to none of these rows: it supports a conclusion on design, and only a sample supports a conclusion on operation, as the test of design versus operating effectiveness guide explains. The second table approaches the same decision from the population and the risk, which is how you check that the method you chose fits the data you actually have.
| Method | Use when the population looks like this | Risk posture | Do not use when |
|---|---|---|---|
| Attribute sampling | Many homogeneous control occurrences; each either complies or does not | Any; confidence and tolerable rate come from reliance, not from the population | The “deviation” is a matter of degree (a cursory review); test those as management review controls |
| Monetary-unit sampling | Reliable book values per item; concern is overstatement; few misstatements expected; heavy right tail of large items | High-value balances with low expected error: inventory, receivables, fixed-asset additions | Understatement is the concern, many items carry zero or negative balances, or you expect more than a handful of errors |
| Stratified classical variables | Values vary widely; errors expected in both directions; book value is a poor selection basis | Estimation tasks: purchase-price true-ups, remediation sizing, quantifying a known problem | Fewer than roughly 20 to 30 differences are likely in the sample, which makes the standard error unstable; MUS is more efficient there |
| Systematic selection (interval) | Population sorted in a file; needs a random start | Any | The file has a cycle that matches the interval, for example every 300th line of a file ordered by route when there are 300 routes |
| Haphazard selection, non-statistical evaluation | Physical files without a usable listing; low-risk controls | Low to moderate reliance | The conclusion will be quantified, the auditee assembled the items, or a listing exists that you could have sampled randomly |
| Full-population analytics | The control is enforced or evidenced in data that can be validated as complete | Any | The evidence lives outside the system (signatures, physical existence, judgment) |
Attribute sample sizes you can defend
The tables below were computed from the binomial distribution for a large population: the sample size is the smallest n for which the probability of observing no more than k deviations, when the true rate equals the tolerable rate, is at or below the accepted risk (5% for 95% confidence, 10% for 90%), where k is the number of deviations the expected rate implies for that sample size, rounded up. That is the basis of the attribute tables in the AICPA Audit Guide, Audit Sampling, and these values reproduce them cell for cell. The number in parentheses is the maximum number of deviations you can find and still meet the tolerable rate; it is part of the plan, and a workpaper that omits it cannot be evaluated.
| 95% confidence (5% risk of overreliance) | Tolerable rate 5% | Tolerable rate 8% | Tolerable rate 10% |
|---|---|---|---|
| Expected rate 0% | 59 (0) | 36 (0) | 29 (0) |
| Expected rate 1% | 93 (1) | 58 (1) | 46 (1) |
| Expected rate 2% | 181 (4) | 77 (2) | 46 (1) |
| 90% confidence (10% risk of overreliance) | Tolerable rate 5% | Tolerable rate 8% | Tolerable rate 10% |
|---|---|---|---|
| Expected rate 0% | 45 (0) | 28 (0) | 22 (0) |
| Expected rate 1% | 77 (1) | 48 (1) | 38 (1) |
| Expected rate 2% | 132 (3) | 48 (1) | 38 (1) |
Two features of the tables trip people up. First, at 90% confidence the 2%-expected row at 8% and 10% tolerable repeats the 1% row (48 and 38), because one allowable deviation in 48 is already 2.1% of the sample; sample sizes move in steps because allowable deviations are whole numbers. Second, the sizes are not proportional to confidence: going from 90% to 95% at a 5% tolerable rate adds 14 items (45 to 59), but going from a 5% to a 3% tolerable rate adds 40. Tolerable rate is the expensive input, which is why it should come from the control’s role and not from a wish to keep the sample small. The 25/40/60 conventions map onto these tables loosely: 25 sits just above the 22 for 90% confidence at 10% tolerable, 60 is the 59 for 95% at 5%, and the 40 in the middle has no exact reading (it holds 90% confidence at roughly a 5.6% tolerable rate with zero deviations). The 25/40/60 guide explains the frequency-based versions for monthly, weekly and daily controls.
If your sampling tool gives 60 rather than 59, or 95 rather than 93, it is using the Poisson approximation, in which the sample size for zero expected deviations is the reliability factor divided by the tolerable rate (3.0 divided by 0.05 gives 60 at 95%; 2.3 divided by 0.05 gives 46.05, rounded up to 47, at 90%). The Poisson figures run one to three items above the binomial ones, and both are defensible if the workpaper says which one it used. The mySampler tool on this site is free and handles the selection mechanics; whatever tool you use, the parameters and the random seed belong in the workpaper, not in the tool’s history. Other free utilities are on the tools page.
| Poisson basis, same inputs | Tolerable 5% | Tolerable 8% | Tolerable 10% |
|---|---|---|---|
| 95%, expected 0% / 1% / 2% | 60 / 95 / 184 | 38 / 60 / 79 | 30 / 48 / 48 |
| 90%, expected 0% / 1% / 2% | 47 / 78 / 134 | 29 / 49 / 49 | 24 / 39 / 39 |
Worked attribute example: settlement review at three depots
The FY27-01 route cash report found that settlement reconciliations were not independent at 9 of MidState’s 12 depots, which is a design failure and needs no sample. At the other three depots the depot manager reviews the cashier’s daily settlement reconciliation, investigates any variance over $25 and signs the sheet, and management wants to rely on that control while the nine depots are redesigned. Population: about 9,300 settlements at the three depots for the ten months tested, agreed to the route-day count. Attribute: the sheet bears the manager’s signature and, where a variance over $25 exists, a written explanation. Parameters: 95% confidence because the ICFR program relies on the control, 5% tolerable, 1% expected because the FY26 walkthrough found occasional unsigned sheets on Saturdays. Sample size from the table: 93, with one deviation allowed. Selection: random numbers from a seeded generator applied to the sequential settlement numbers, seed recorded.
The team found two unsigned sheets, both at the Toledo depot on Saturdays when the assistant manager covered. Two in 93 is a sample rate of 2.2%, but the sample rate is not the conclusion. The achieved upper deviation limit, the highest population rate consistent with the sample at the stated confidence, is 6.6% at 95% (5.6% even at 90%), above the 5% tolerable rate, so the sample does not support reliance as planned. There are three options. Conclude that the control is not operating effectively and report it, which is right when the deviations point to a systemic cause. Reduce reliance and re-plan around compensating controls, which is honest only if those controls were tested. Or extend the sample to the size at which the deviations found would be acceptable: 181 items allow four deviations at 95% and 5%, so the team examines 88 more settlements and may find at most two further deviations. MidState’s team extended, found one more unsigned Saturday sheet, and closed at three deviations in 181, an upper limit of 4.2% at 95% confidence: the control was reported as operating effectively, with a low-rated observation on Saturday coverage. Had the extension turned up three more deviations, the test would have stopped there, because no further extension can rescue a sample once the deviations exceed the allowance.
Small populations: what 2 of 12 actually buys you
The binomial tables assume a large population. For small ones the hypergeometric distribution applies and the required sample falls, sometimes substantially. The figures below answer the question “how many items must I test, finding no deviations, to be 90% or 95% confident that the population contains fewer deviations than the number stated.” They also expose the frequency conventions for what they are: testing 2 to 5 of 12 monthly reconciliations gives no meaningful statistical assurance, because you would need 8 of the 12 to be 90% confident that no more than one failed. The convention is defensible as a judgment about a control whose design has been walked through and whose output is reviewed monthly by someone else; it is not defensible as a statistic, and the workpaper should not describe it as one.
| Population | Intolerable condition | Zero-deviation sample, 90% confidence | Zero-deviation sample, 95% confidence | Large-population value for comparison |
|---|---|---|---|---|
| 12 monthly instances | 2 or more failures (16.7%) | 8 | 9 | Not applicable |
| 52 weekly instances | 6 or more failures (11.5%) | 16 | 20 | 22 / 29 at 10% tolerable |
| 52 weekly instances | 3 or more failures (5.8%) | 28 | 33 | 45 / 59 at 5% tolerable |
| 250 instances | 26 or more failures (10.4%) | 21 | 26 | 22 / 29 at 10% tolerable |
| 250 instances | 13 or more failures (5.2%) | 40 | 51 | 45 / 59 at 5% tolerable |
Evaluating exceptions and projecting results
Every exception is evaluated twice: qualitatively, to understand what it is and whether it changes the risk picture, and quantitatively, to project it to the population. Neither step may be skipped because the exception looks small. AU-C 530 and AS 2315 both require projection, and both allow an exception to be treated as an anomaly only when the auditor has a high degree of certainty, after additional work, that it is not representative of the population, which in practice almost never happens. The internal audit equivalent is simple: if you found it, it counts, and the only ways to reduce its effect on the conclusion are a larger sample or a corrected population definition you can defend.
| Sample size | 0 deviations (90% / 95%) | 1 deviation (90% / 95%) | 2 deviations (90% / 95%) | 3 deviations (90% / 95%) |
|---|---|---|---|---|
| 25 | 8.8% / 11.3% | 14.7% / 17.6% | 19.9% / 23.1% | 24.8% / 28.2% |
| 40 | 5.6% / 7.2% | 9.4% / 11.3% | 12.8% / 14.9% | 15.9% / 18.3% |
| 45 | 5.0% / 6.4% | 8.4% / 10.1% | 11.4% / 13.3% | 14.2% / 16.3% |
| 59 | 3.8% / 5.0% | 6.4% / 7.8% | 8.8% / 10.3% | 11.0% / 12.6% |
| 93 | 2.4% / 3.2% | 4.1% / 5.0% | 5.6% / 6.6% | 7.0% / 8.1% |
| 132 | 1.7% / 2.2% | 2.9% / 3.5% | 4.0% / 4.7% | 5.0% / 5.8% |
| 181 | 1.3% / 1.6% | 2.1% / 2.6% | 2.9% / 3.4% | 3.7% / 4.2% |
These are achieved upper deviation limits, computed from the binomial distribution as the population rate at which the observed result (k or fewer deviations in n) would occur with probability equal to the accepted risk. Read the 25-item row and the conventions look different: a single deviation in 25 leaves the population rate anywhere up to 14.7% at 90% confidence, which is why one exception in a 25-item SOX sample is treated as a control failure unless the sample is extended to 38 (the 90%, 10%, one-deviation size) with no further deviations. The table also shows the cost of the extension route: from 93 to 181 items, two deviations plus one more still land at 4.2%, but a third additional deviation would not.
| What you found | Evaluate it as | Project it how | Conclusion and next step |
|---|---|---|---|
| A control occurrence without the required evidence (no signature, no ticket, no reviewer note) | A deviation, even if the transaction itself is correct; the control is what is being tested | Count it; compute the achieved upper limit against the tolerable rate | Upper limit at or below tolerable: reliance supported. Above: extend to the size that would allow the deviations found, or conclude and report |
| A dollar difference in a haphazard (non-statistical) substantive sample | A misstatement | Ratio projection if errors scale with item size (misstatement divided by sample book value, times population book value); difference projection if errors are roughly constant per item (average misstatement per item times population count) | Compare the projection plus a judgmental allowance to tolerable misstatement; the projection is a most-likely figure, not an upper bound |
| A tainting in an MUS sample | Overstatement of the logical unit as a percentage of its book value | Tainting times the sampling interval, plus the incremental allowance for sampling risk (see the worked example) | Upper misstatement limit against tolerable misstatement |
| An item that cannot be located | A deviation (attribute) or a 100% misstatement (substantive) unless alternative evidence is obtained | As above; never replace the item with another | Missing documents are the most common finding in cash-intensive processes; log the search steps |
| A pattern: all deviations in one depot, one preparer, one weekday | Not an anomaly; a concentration that changes the risk assessment | Project the sample as a whole, then consider stratifying the extension by the concentration | Report the concentration; it is usually the actual finding |
| Anything that looks like intent: altered dates, split amounts, overrides after hours | A possible fraud indicator | Stop sampling; sampling is the wrong tool for estimating fraud | Escalate under the fraud protocol and move to targeted and full-population procedures; see the fraud red flags guide |
The ratio-versus-difference choice changes a projection more than most auditors expect. Suppose a haphazard sample of 40 travel and expense claims totaling $61,200, from a population of 3,120 claims totaling $2.9 million, contains $1,840 of unsupported expenses. Ratio projection gives $1,840 divided by $61,200, or 3.0%, applied to $2.9 million: $87,190. Difference projection gives $1,840 divided by 40, or $46 per claim, applied to 3,120 claims: $143,520. The two estimates differ by 65% from the same evidence, so the workpaper has to say which was used and why (errors in T&E scale with claim size, favoring ratio; a fixed per-claim processing error would favor difference). Neither figure carries a confidence level, because the selection was haphazard, and the report should say “we estimate” rather than “with 95% confidence.” A monetary error found in an item selected for an attribute test is a different case: count the deviation, report the dollars observed, and do not extrapolate them from a sample that was sized for a yes/no attribute.
Monetary-unit sampling: a worked example on $8.4 million of inventory
Monetary-unit sampling treats every dollar in a balance as a sampling unit, so an item’s chance of selection is proportional to its size and the largest items are certain to be selected. It is the natural method when the concern is overstatement, book values are reliable enough to select on, and few misstatements are expected: inventory existence and pricing, receivables, capitalized fixed-asset additions. The MidState FY27 warehouse inventory engagement supports the ICFR program’s inventory existence and valuation assertions. Population: the ERP perpetual inventory at cost for the 12 legacy depots at the mid-year count date, $8,400,000 across 6,318 SKU-depot lines, reconciled to the general ledger before selection. The two acquired distributors are excluded and tested in the stratified example, because their spreadsheet records do not support selection by book value.
| Parameter | Value | Basis |
|---|---|---|
| Population book value (BV) | $8,400,000 | ERP perpetual at cost, 6,318 lines, agreed to GL |
| Tolerable misstatement (TM) | $420,000 | 5% of the balance, the ICFR program’s allocation of performance materiality to inventory |
| Expected misstatement (EM) | $84,000 | 1% of the balance, from prior-year count differences |
| Risk of incorrect acceptance | 5% (95% confidence) | Key balance, direct reliance by the external auditor |
| Reliability factor, zero misstatements | 3.0 | Poisson factor at 95%; 4.75 for one misstatement, 6.30 for two, as tabulated in the AICPA guide |
| Expansion factor for expected misstatement | 1.6 | Classic PPS factor at 5% risk of incorrect acceptance |
| Sample size n | 89 | BV × 3.0 ÷ (TM − EM × 1.6) = $25,200,000 ÷ $285,600 = 88.2, rounded up |
| Sampling interval | $94,382 | $8,400,000 ÷ 89, rounded down |
| Random start | $37,514 | Random integer between 1 and 94,382; generator seed recorded |
The formula above is the transparent one, and the one to use when you need to show the arithmetic. The current AICPA guide’s MUS tables plan the same inputs through a factor that rises with the ratio of expected to tolerable misstatement (4.63 at a 0.20 ratio and 5% risk), which gives 20 × 4.63 = 92.6, or 93 items. Either basis is defensible provided the workpaper names it; quoting 95% confidence on a sample sized by neither is not.
Selection
Selection is mechanical once the file is fixed: sort the perpetual in a stable order (depot, then SKU), compute the cumulative book value down the file, and select the line containing each of the dollar positions $37,514, $37,514 + $94,382, $37,514 + 2 × $94,382 and so on. With this start the 89th position is $8,343,130 and the 90th would fall past the end of the population, so there are exactly 89 hits. Nine lines have book values at or above the interval (bulk pallet positions of the top-selling brands at the two largest depots, $97,300 to $247,600 each, $1,443,700 in total); they are certain selections and absorbed 15 of the 89 hits. The remaining 74 hits fell on 74 distinct lines in the sampled stratum of $6,956,300 across 6,309 lines, so the count team examined 83 lines: 9 top-stratum lines at 100% and 74 sampled lines. The first five hits show how the cumulative-dollar mechanics land on lines of very different sizes.
| Hit | Dollar position | Line selected (cumulative range) | Line book value | Note |
|---|---|---|---|---|
| 1 | $37,514 | Line 24 ($36,900 to $38,970) | $2,071 | Small line, selected because a dollar position fell inside it |
| 2 | $131,896 | Line 95 ($130,861 to $140,101) | $9,241 | Sampled stratum |
| 3 | $226,278 | Line 175 ($195,266 to $235,007) | $39,742 | Large line but below the interval; one hit, evaluated by tainting |
| 4 | $320,660 | Line 236 ($319,411 to $322,319) | $2,909 | Sampled stratum |
| 5 | $415,042 | Line 346 ($413,727 to $416,002) | $2,276 | Sampled stratum |
| Top stratum | Multiple positions each | 9 lines with book value ≥ $94,382 | $1,443,700 in total | Examined 100%; misstatements counted at face, not projected |
Results and evaluation
The nine top-stratum lines agreed to the counts and to current supplier cost. Two of the 74 sampled lines were misstated. Line A, a case-goods line at the Columbus depot, carried a book value of $11,161; the count supported $8,371, an overstatement of $2,790 traced to a receiving posting for a shipment that had been refused at the dock. Line B, book value $4,249, was priced from a superseded cost list; the audited value was $3,824, an overstatement of $425. A misstatement in MUS is expressed as a tainting, the misstatement divided by the line’s book value, because the dollar that was selected stands for the whole interval it came from. Line A’s tainting is 25.0% and line B’s is 10.0%. The evaluation ranks taintings from largest to smallest, projects each across its interval, and adds an incremental allowance for sampling risk built from the successive reliability factors.
| Component | Computation | Amount |
|---|---|---|
| Basic precision | Reliability factor for zero misstatements × interval = 3.00 × $94,382 | $283,146 |
| Projected misstatement, line A (tainting 25.0%) | 0.250 × $94,382 | $23,593 |
| Incremental allowance, line A | (4.75 − 3.00 − 1) × $23,593 = 0.75 × $23,593 | $17,695 |
| Projected misstatement, line B (tainting 10.0%) | 0.100 × $94,382 | $9,440 |
| Incremental allowance, line B | (6.30 − 4.75 − 1) × $9,440 = 0.55 × $9,440 | $5,192 |
| Top-stratum misstatements | Counted at face; none found | $0 |
| Most likely misstatement | Projected misstatements plus top-stratum misstatements | $33,034 |
| Upper misstatement limit at 95% | Basic precision + projected misstatements + incremental allowances | $339,067 |
| Tolerable misstatement | Planning parameter | $420,000 |
| Conclusion | Upper limit below tolerable (components rounded to the dollar; totals computed from unrounded values) | Balance accepted as not overstated by more than $420,000 at 95% confidence |
Three things in that table deserve a sentence each in the workpaper. The basic precision of $283,146 exists even with zero misstatements; it is the allowance for what a sample of this size cannot see, and it is why tolerable misstatement has to be several multiples of the interval for MUS to be workable. The most likely misstatement of $33,034 (0.4% of the balance) is what you would tell the controller to consider booking; the upper limit of $339,067 is what you compare with tolerable. And the conclusion is one-directional: MUS gives almost no assurance about understatement, because an understated line has fewer dollars and a smaller chance of selection, and an omitted line has none. If unrecorded inventory were the concern, the test would run from the count sheets back to the perpetual.
The sensitivity is worth showing to a manager who asks why two small errors matter. Had line A been a phantom line, recorded but not on the shelf at all, its tainting would have been 100%: projected misstatement $94,382, incremental allowance $70,787, and an upper limit of $462,947, above tolerable, on the strength of one line worth $11,161. The breakeven is a tainting of about 74% on the largest error. That arithmetic is behind the practitioner’s rule that MUS tolerates small pricing errors comfortably and missing items very badly, and it is why a refused-shipment posting that stayed in the perpetual was reported as a control finding on receiving reversals even though the sample passed.
Stratified sampling: a worked example with allocation
Stratification divides a population into groups that are more alike internally than the population as a whole, samples each group separately, and combines the results. It earns its place when item values vary widely (a simple random sample would be dominated by noise from the small items and might miss the large ones), when errors are expected in both directions, or when book values are not reliable enough to select on. MidState’s acquisition integration engagement met all three conditions. The two acquired distributors, Tri-County and Lakeshore, still run spreadsheet perpetuals that are not on the ERP; the purchase agreements carry a working-capital true-up based on inventory at cost; and finance wants to know whether the listings can be loaded into the ERP as they stand. The combined listing at the count date showed 2,140 lines at $2,060,000. The objective was to estimate the total misstatement of the listing, either direction, at 90% confidence with a planned allowance for sampling risk of $75,000, against a tolerable misstatement of $103,000 (5% of the listing).
The strata were defined on recorded line value. Lines at or above $10,000 form a certainty stratum examined in full, because a handful of lines hold a disproportionate share of the value and no sample should be allowed to miss them. The three sampled strata were allocated by the Neyman rule, which gives each stratum a share of the sample proportional to its count times its standard deviation, so variable strata get more items and homogeneous strata fewer. There was no prior-year difference data, so the planning standard deviation for each stratum is the standard deviation of the book values within it, the usual substitute. The total sample for a stratified mean-per-unit design with a finite population correction is the square of the sum of N times sigma across the sampled strata, divided by the sum of (planned allowance divided by the z-value) squared and the sum of N times sigma squared; with z of 1.645 for 90% confidence and an allowance of $75,000, that gives 249.5, rounded to 250.
| Stratum (recorded line value) | Lines (N) | Book value | Planning sigma | N × sigma | Neyman allocation | Proportional to count | Proportional to value |
|---|---|---|---|---|---|---|---|
| S1: $10,000 and above (certainty) | 20 | $300,944 | Not sampled | Not sampled | All 20 | All 20 | All 20 |
| S2: $2,500 to $9,999 | 157 | $696,538 | $1,758 | 276,006 | 83 | 19 | 99 |
| S3: $500 to $2,499 | 757 | $816,737 | $523 | 395,911 | 119 | 89 | 116 |
| S4: below $500 | 1,206 | $245,781 | $135 | 162,810 | 49 | 142 | 35 |
| Total | 2,140 | $2,060,000 | Not applicable | 834,727 | 251 sampled (rounded up per stratum) + 20 certainty | 250 + 20 | 250 + 20 |
The three allocation columns show why the rule matters. Allocating in proportion to count would have spent 142 of 250 items on lines worth $245,781 in total and only 19 on the $696,538 stratum, a design that could not detect a material problem in the lines that carry the money. Allocating in proportion to value overcorrects and starves the small stratum, which is where spreadsheet listings usually hide obsolete and miscounted lines. Neyman sits between them because it weights the spread of values, not just their total. The same design at 95% confidence would have required 320 sampled lines; the team chose 90% because the purpose was an estimate for a negotiation and a migration decision, not an ICFR opinion, and documented the choice. Each sampled line was counted, priced from the supplier’s invoice and compared with the listing, with differences recorded with sign (positive for overstatement). The evaluation uses difference estimation: the mean difference in each stratum times the number of lines in the stratum, summed across strata, plus the certainty stratum at face.
| Stratum | Sampled lines | Sample book value | Sample audited value | Lines with differences | Mean difference per line | Standard deviation of differences | Projected misstatement (N × mean) |
|---|---|---|---|---|---|---|---|
| S1 (certainty) | 20 of 20 | $300,944 | $289,044 | 2 | Not projected | Not applicable | $11,900 at face |
| S2 | 83 of 157 | $372,473 | $366,142 | 8 | $76.28 | $392.1 | $11,976 |
| S3 | 119 of 757 | $127,939 | $122,628 | 18 | $44.63 | $167.1 | $33,785 |
| S4 | 49 of 1,206 | $10,665 | $10,282 | 5 | $7.82 | $26.3 | $9,426 |
| Total | 271 lines | $812,021 | $788,096 | 33 | Not applicable | Not applicable | $67,087 most likely overstatement |
The standard error of the projected total is the square root of the sum, across the sampled strata, of N squared times the finite population correction (1 minus n over N) times the variance of the differences divided by n; it comes to $12,435, and at 90% confidence (z of 1.645) the achieved allowance for sampling risk is $20,455. The estimated overstatement is therefore $67,087 plus or minus $20,455, and the upper bound of $87,542 is below the $103,000 tolerable misstatement. The listing can be accepted as not overstated by more than tolerable misstatement for the true-up, and the most likely overstatement of $67,087 (3.3% of the listing) is the figure the deal team took into the negotiation. Two observations belong beside that conclusion. The achieved allowance of $20,455 is far tighter than the planned $75,000 because differences vary much less than values, which is normal when a design is planned on book-value dispersion and is not a sign the sample was too large, since the plan could not know that in advance. And 31 of the 251 sampled lines (12.4%) were wrong, a rate no acceptable balance should carry; the report’s finding was about the receiving and adjustment process at the two warehouses, not about the $67,087.
When full-population analytics replaces sampling
Sampling exists because examining everything is expensive. Where the control’s operation is recorded in data and the data can be validated as complete, examining everything costs a query, and a sample of 59 becomes an odd choice. MidState’s FY27-01 finding that 1,412 of 37,400 settlements carried self-approved variance overrides came from a full-population comparison of the override user ID with the preparer ID, not from a sample. A 93-item attribute sample from that population would have expected to catch about 3.5 overrides, would have found anywhere from none (a 2.8% chance) to seven, and could never have produced the list of 1,412 that management needed to act on. The decision rule is not “analytics if we have data” but a sharper one: use full-population analytics when the attribute you are testing is fully represented in a data field, and sample when the evidence lives outside the system.
| Control or assertion | What a sample would do | What full-population analytics does | Verdict |
|---|---|---|---|
| Variance overrides approved by someone other than the preparer | Test 93 settlements for an independent approver ID | Compare approver ID with preparer ID on all 37,400 settlements; list every match | Analytics; sample only to validate the report logic and the completeness of the extract |
| Duplicate vendor payments | Cannot be sampled meaningfully; a duplicate rate of 0.2% needs about 1,500 items to find one with 95% probability | Fuzzy-match invoice number, amount, vendor and date across the full AP file | Analytics, then targeted testing of the matches, which is not a sample and is not projected; see AP analytics |
| Terminated employees removed from the ERP within two business days | Sample 45 terminations and check the disable date | Join the HR termination file to the ERP user table and the last-login log for every termination | Analytics; the user access review guide gives the join logic |
| Manual journal entries reviewed before posting | Sample 60 manual entries for reviewer evidence | Screen the whole population for risk attributes (posted by preparer, round amounts, weekend, suspense accounts), then test the flagged entries in full | Both: analytics to select, targeted testing of what it flags, and a random sample of the remainder if a population-level conclusion is also needed; see journal entry analytics and journal entry testing |
| Depot manager signature on paper settlement sheets | Attribute sample of the sheets | Nothing; the evidence is ink on paper | Sample |
| Inventory exists and is priced correctly | MUS or stratified count | Flags negative quantities, stale lines and cost outliers, but cannot confirm existence | Sample, with analytics used to define key items and strata |
| Management review control performed with appropriate precision | Sample of review instances, re-performed | Nothing; the precision of a judgment is not a data field | Sample and re-perform; see the management review controls guide |
| Payroll paid only to active employees at approved rates | Sample 60 pay records to HR files | Match every pay record to the HR master and the approved rate table | Analytics; see payroll analytics |
Two cautions keep analytics honest. An analytic is a full-population test only if the population is complete and the fields are reliable, which puts the burden back on IPE testing: the settlement extract has to be reconciled to the route-day count, and the approver ID field has to be shown to be system-populated rather than typed. And the items an analytic flags are a targeted selection, not a sample, so nothing found in them can be projected to the unflagged remainder; if the engagement also needs a conclusion about the entries the screen did not flag, take a random sample of them and evaluate it as an attribute test. Teams that run the same scripts every month are doing continuous auditing, and the continuous auditing versus continuous monitoring guide covers what changes when the auditee runs them instead.
Documenting and defending the sample
Standard 14.6 of the Global Internal Audit Standards requires documentation sufficient for an experienced auditor with no connection to the engagement to understand the work performed and the basis for the conclusions. For a sample that means a reviewer must be able to recompute the sample size, regenerate the selection and re-evaluate the results without asking the auditor anything. The workpaper best-practices guide covers the general standards and the audit workpaper example shows a complete test sheet; the block below is the sampling section that belongs in every test of controls, filled in for the MidState settlement review.
Objective. To conclude whether the depot manager review of daily route settlement reconciliations operated effectively at the Columbus, Fort Wayne and Toledo depots from 1 September 2025 to 30 June 2026, supporting reliance by the ICFR program on control RC-04.
Population and completeness. 9,312 settlement sheets extracted from the ERP route-accounting module (report RA-117, run 8 July 2026, parameters at W/P 4.2.1). Sheet count agreed to the route-day schedule (9,312 route-days, W/P 4.2.2) with no unreconciled differences. The extract was tested as IPE at W/P 4.2.3.
Sampling unit and attributes. One settlement sheet. Attribute 1: sheet bears the depot manager’s (or documented delegate’s) signature dated no later than the next business day. Attribute 2: where the variance exceeds $25, a written explanation is present and references the driver or customer. Either attribute failing is one deviation for the sheet.
Method and parameters. Statistical attribute sampling, binomial basis (AICPA Audit Guide tables). Confidence 95%, tolerable deviation rate 5%, expected deviation rate 1%. Planned sample 93 with one deviation allowable. Rationale: key control relied on by the ICFR program; expected rate from the FY26 walkthrough.
Selection. Random selection of 93 sheet numbers from the range 1 to 9,312 using mySampler, seed 20260709, selection list at W/P 4.2.4. No items were replaced; sheet 4,417 could not be located at the depot and was obtained from the scanned archive (W/P 4.2.5).
Results. Two deviations in 93 (sheets 2,206 and 7,853, both Toledo Saturdays covered by the assistant manager, attribute 1). Achieved upper deviation limit 6.6% at 95%, above the tolerable rate. Sample extended by 88 items to 181 (seed 20260716, W/P 4.2.6); one further deviation (sheet 8,120). Final result: 3 deviations in 181, achieved upper deviation limit 4.2% at 95% confidence.
Evaluation and conclusion. All three deviations arise from Saturday coverage by an assistant manager who was not on the signature delegation; no monetary error was associated with any of them. The deviations are not treated as anomalies. Control RC-04 operated effectively for the period at the three depots at 95% confidence with a 5% tolerable rate. Observation 3 (Saturday delegation) raised at low severity; see the severity rating guide for the rating basis.
Every element in that block answers a reviewer’s question before it is asked, and the questions a good reviewer asks are predictable. An audit manager reviewing sample sizes should be able to run down this list in ten minutes per test sheet; if the workpaper cannot support the answers, the test is not finished, however many items were examined.
| Reviewer question | Answer that closes it | Answer that is a red flag |
|---|---|---|
| Where did the population come from and how do you know it is complete? | Named report, run date, parameters, reconciled to an independent count or control total | “The auditee sent us the list” |
| Why these confidence and tolerable-rate settings? | Tied to the control’s role (ICFR reliance, compensating controls) and stated before selection | Settings chosen after the sample size, or “we always use 25” |
| Show me how the items were selected | Method, tool, seed or random start, selection list on file | “Judgmentally, covering all months,” with no list |
| What was the allowable number of deviations, and what did you find? | Planned allowance, deviations found, achieved upper limit, comparison to tolerable | Sample rate compared directly with the tolerable rate (“2.2% is under 5%”) |
| What happened to the exception? | Cause, pattern check, qualitative evaluation, effect on the conclusion, cross-reference to the finding | “Isolated” with no analysis, or an item quietly replaced |
| What does this sample say about the depots or months not covered? | Nothing; the conclusion is scoped to the population sampled | A period-wide or company-wide conclusion from a block or a subset |
Reporting language follows from the evaluation. To the audit committee, the settlement test reads: “We tested 181 settlements at the three depots where the reconciliation review is independent and found three without evidence of review, all on Saturdays; at 95% confidence the rate of unreviewed settlements does not exceed 4.2%, within the 5% threshold we set for reliance.” The inventory MUS reads: “The perpetual inventory of $8.4 million is not overstated by more than $420,000 at 95% confidence; our best estimate of overstatement is $33,000, arising from a receiving reversal that was not processed and a superseded cost list.” Both sentences state the confidence, the threshold and the estimate; neither claims more than the sample supports. A committee that hears those sentences consistently learns to distrust a report that only says “no exceptions noted.”
Common sampling failures and edge cases
The failures below surface in quality reviews and in external auditors’ reliance assessments, and every one of them has been seen in a workpaper that looked complete. Most are not arithmetic errors; they are decisions made for convenience that destroy the sample’s ability to speak for the population.
| Failure | What it looks like | Why it matters | Fix |
|---|---|---|---|
| Sampling from an unverified population | Selection from a list the auditee produced, with no reconciliation to a control total | Missing items had no chance of selection; the conclusion covers only the list | Reconcile the population to an independent total and test the extract as IPE before selecting |
| Sample size by habit | 25 for everything, with “95%” typed in the parameters field | 25 items with zero deviations supports 90% confidence at about a 9% rate, not 95% at 5%; the workpaper misstates the assurance | Set confidence, tolerable and expected rates first, read the size from the table, record the allowable deviations |
| Comparing the sample rate with the tolerable rate | “2 of 93 is 2.2%, below 5%, control effective” | The sample rate ignores sampling risk; the upper limit for 2 in 93 is 6.6% at 95% | Evaluate with the achieved upper deviation limit, always |
| Calling a deviation isolated | One unsigned sheet explained as “the manager was on vacation” and excluded from the evaluation | Standards allow the anomaly treatment only with a high degree of certainty after additional work; vacations recur | Count every deviation; if the cause is specific, fix the control, not the evaluation |
| Replacing items | A missing invoice swapped for the next one in the file | Missing items are disproportionately the problem items; replacement biases the sample toward what exists | Treat unlocatable items as deviations unless alternative evidence is found; log the search |
| Haphazard selection that is not haphazard | Items from the top of each folder, the first week of each month, or the depots nearest the office | Predictable selection lets the population’s structure (and the auditee) shape the sample | Use random selection whenever a listing exists; when it does not, document the physical selection rule and vary it |
| Attribute sample used for a dollar conclusion | “We found $3,400 of errors in 40 invoices, so exposure is about $250,000” | The sample was sized for a yes/no attribute; the projection has no stated precision and may have missed the large items entirely | Report observed dollars as observed; design a MUS or stratified test if a dollar estimate is needed |
| MUS applied to the wrong assertion | MUS on accounts payable to find unrecorded liabilities | Understated and omitted items have fewer or no dollars to be selected | Test completeness from external evidence (subsequent payments, receiving logs) toward the ledger |
| Extension after the fact to make the result pass | Sample enlarged until the deviation count looks acceptable, with no stated stopping rule | Open-ended extension inflates the risk of overreliance; the stated confidence no longer holds | Extend once, to the table size that would allow the deviations already found, and stop if the allowance is breached |
| Interim sample with a year-end conclusion | 60 items tested through September, control reported effective for the year in January | Three months of operation have no evidence; the ICFR program will not accept it | Plan a roll-forward sample or an update procedure for the remaining period |
Rare events: discovery sampling
When the question is whether something exists at all (a ghost employee, a fictitious vendor, a forged approval), the relevant number is not a deviation rate but the probability that a sample would contain at least one instance if the condition were present at a given rate. That probability is 1 minus (1 minus the occurrence rate) to the power of the sample size, and solving for the sample gives the discovery sampling figures: to be 95% sure of seeing at least one case when 1% of the population is affected, you need 299 items; at 0.5%, 598; at 2%, 149; at 5%, 59, the same 59 as the attribute table’s zero-deviation cell viewed from the other side. At 90% confidence the figures are 230, 460, 114 and 45. Discovery sampling explains why sampling is a poor fraud-detection tool: a payroll fraud affecting 3 of 1,900 employees (0.16%) would need a sample of about 1,200 of the 1,900, nearly two-thirds of the population, to find with 95% probability, and the payroll audit guide uses full-population matching instead.
Multi-location populations
A sample of 45 settlements drawn across MidState’s 12 depots supports one conclusion about the company-wide population and no conclusion about any depot, because the average depot contributed fewer than four items. If the report needs to say something about each depot, each depot needs its own sample, which multiplies the work by twelve, or the test needs to be redesigned: sample company-wide for the operating-effectiveness conclusion, then use full-population analytics (override rates, unreconciled variance totals, sync-failure counts by depot) to say which depots deserve attention. The mistake to avoid is the middle path, where a company-wide sample with three Dayton items and one Dayton deviation is reported as “Dayton has a 33% failure rate.”
Automated controls, roll-forward and reliance on others’ testing
An automated control that has been shown to work once continues to work identically until it or its environment changes, so the test is one instance plus evidence that the ITGCs over change management and access held for the period; sampling 25 instances of a three-way match adds cost, not assurance, as the ITGC versus application controls guide explains. Manual controls tested at an interim date need roll-forward coverage for the remaining period: a smaller sample proportionate to the months left (10 to 15 items for October to December after 45 through September is common practice) plus an inquiry about changes to the control. Where management’s own testing or the external auditor’s work covers the same control, Standard 9.5 on coordination and reliance lets you rely on it after assessing the tester’s competence and objectivity and re-performing a portion; re-performing 10% to 20% of management’s sample and comparing its parameters with your own thresholds is a common rule. For more fieldwork guides, the topics hub groups them by subject and the list of all guides covers everything on the site.
Related guides
- Audit sample sizes: 25, 40, 60 — the frequency-based conventions and where they come from.
- mySampler — the site’s free sampling tool for selections and sample sizes.
- Substantive testing for internal auditors — where MUS and variables sampling fit in a substantive program.
- Test of design versus operating effectiveness — why a walkthrough is not a sample.
- Audit evidence — sufficiency, reliability and relevance beyond the sample.
- IPE testing — validating the report you are sampling from.
- Journal entry analytics — full-population screening that replaces the JE sample.
- Control deficiency evaluation — what to do with a control that failed its sample.
- Workpaper best practices — documentation standards the sampling section has to meet.
- Tools — the site’s free utilities for fieldwork.
- Monetary Unit Sampling (MUS): Size, Selection, Evaluation — sample sizes, selection and evaluation worked through.
- Attribute Sampling: Plan, Select, Evaluate, Conclude — sample sizes, tolerable rates, evaluation and the tables, worked end to end
Leave a Reply