Attribute Sampling Explained: A Practical Guide for Internal and External Auditors
How Auditors Use Attribute Sampling to Test Internal Controls
Auditors rarely have the time or resources to examine every transaction, authorization, reconciliation, or control activity performed by an organization.
Instead, they frequently use audit sampling to obtain evidence about a larger population by examining a smaller number of selected items.
One of the most important techniques for testing internal controls is attribute sampling.
Attribute sampling is commonly used to determine whether a particular control characteristic exists or whether a prescribed control procedure was performed.
For example, an auditor may want to determine whether purchase orders were properly approved, bank reconciliations were reviewed, or changes to vendor banking information received independent authorization.
In each case, the auditor is evaluating a specific characteristic of the transaction or control activity.
Attribute sampling helps auditors estimate how frequently a control deviation occurs and evaluate whether the results support the intended level of reliance on that control.
Understanding this methodology is essential for internal auditors, external auditors, compliance professionals, and anyone responsible for evaluating internal control effectiveness.
1. What Is Attribute Sampling?
Attribute sampling is an audit sampling technique used to evaluate the occurrence or nonoccurrence of a defined characteristic within a population.
The characteristic is called an attribute.
Examples include:
Evidence of supervisory approval.
Completion of a required reconciliation.
Authorization of a vendor master file change.
Documentation of a control review.
Compliance with an established transaction approval requirement.
Evidence that access rights were reviewed.
Each selected item is evaluated against a predefined criterion.
The auditor generally classifies the item as either:
Conforming: The required attribute is present and the control requirement was satisfied.
Deviation: The required attribute is absent or the control requirement was not satisfied.
For example, if company policy requires independent approval of every vendor banking change, the auditor can test a sample of changes to determine whether appropriate approval occurred.
The results provide evidence about the operation of the control across the population.
2. Attribute Sampling vs. Variables Sampling
Attribute sampling and variables sampling serve different audit objectives.
Characteristic | Attribute sampling | Variables sampling |
Primary purpose | Estimate the frequency of a characteristic or deviation | Estimate a monetary amount or other quantitative population value |
Typical application | Tests of controls | Substantive testing of account balances |
Measurement | Conforming or deviation | Numerical amount |
Example | Was the invoice approved? | What is the estimated monetary misstatement? |
Result | Estimated deviation rate | Estimated amount or misstatement |
Attribute sampling is particularly useful when the audit objective concerns the operating effectiveness of a control.
Variables sampling is more appropriate when the objective is to estimate a numerical population characteristic, such as a monetary misstatement.
Auditors should select the sampling methodology based on the engagement objective rather than simply using the method with which they are most familiar.
3. Why Attribute Sampling Matters
Attribute sampling provides a structured method for evaluating internal controls.
It can help auditors:
Establish an objective basis for selecting transactions.
Evaluate control performance across a population.
Quantify observed deviations.
Consider sampling risk.
Determine whether the results support control reliance.
Communicate findings to management.
Document the basis for audit conclusions.
When statistical attribute sampling is properly designed and applied, it allows auditors to quantify sampling risk.
However, statistical sampling does not eliminate professional judgment.
Auditors must still define the population, select appropriate parameters, evaluate deviations, and determine the implications for the engagement.
4. The Five Essential Elements of Attribute Sampling
A statistical attribute sampling plan generally involves five important elements.
1. Population
The complete set of items about which the auditor wants to draw a conclusion.
Example: All 8,000 vendor payments processed during the fiscal year.
2. Sampling unit
The individual item selected for examination.
Example: One vendor payment transaction.
3. Control attribute
The specific characteristic being tested.
Example: Evidence of authorization by an appropriate individual.
4. Deviation
A defined failure to satisfy the control requirement.
Example: A payment was processed without the required approval.
5. Sampling parameters
The assumptions used to design and evaluate the sample, including the tolerable deviation rate, expected deviation rate, and acceptable risk of overreliance.
Each element must be established before the auditor begins testing.
5. Tolerable Deviation Rate
The tolerable deviation rate (TDR) is the maximum population deviation rate the auditor is willing to accept while still concluding that the control is sufficiently effective for the intended audit purpose.
For example, an auditor might establish a tolerable deviation rate of 5%.
This means the auditor's intended reliance on the control requires sufficient evidence that the population deviation rate does not exceed the established tolerance.
The appropriate rate depends on factors such as:
The importance of the control.
The risk addressed by the control.
The consequences of control failure.
The planned degree of control reliance.
The effectiveness of other controls.
Applicable professional standards and audit methodology.
A 5% tolerable rate is not a universal auditing standard.
Certain critical controls may require a substantially lower tolerance.
For example, an organization may have little tolerance for unauthorized changes to vendor banking information.
6. Expected Deviation Rate
The expected deviation rate (EDR) is the auditor's estimate of the population deviation rate before performing the sample.
The estimate may be based on:
Prior audit results.
Preliminary testing.
Management's control monitoring.
Historical exception rates.
Changes in personnel or systems.
Knowledge of the process.
Suppose an auditor expects approximately 1% of purchase orders to lack the required approval.
That expectation influences the required sample size.
Generally, a higher expected deviation rate requires a larger sample, assuming the other sampling parameters remain unchanged.
If the expected deviation rate approaches or exceeds the tolerable rate, the auditor should reconsider whether the proposed sampling approach can support the intended control reliance.
7. Acceptable Risk of Overreliance
Sampling risk arises because the auditor examines only part of the population.
For tests of controls, a particularly important risk is the risk of overreliance.
This is the risk that the auditor concludes a control is more effective than it actually is.
For example, a sample may suggest that a control operates within the tolerable deviation rate even though the actual population deviation rate exceeds that tolerance.
An auditor may establish a 5% acceptable risk of overreliance, corresponding to a 95% one-sided confidence level for the sampling evaluation.
A lower acceptable risk of overreliance generally requires a larger sample.
The appropriate level depends on the audit objective and the intended degree of reliance on the control.
8. How Is Attribute Sample Size Determined?
Statistical attribute sample size depends primarily on:
Tolerable deviation rate.
Expected deviation rate.
Acceptable risk of overreliance.
Population size, when finite-population effects are relevant.
The statistical sampling method selected.
Auditors commonly use approved sampling tables, statistical software, or validated audit sampling tools.
Consider an illustrative sampling plan:
Parameter | Assumption |
Population | 8,000 transactions |
Tolerable deviation rate | 5% |
Expected deviation rate | 1% |
Acceptable risk of overreliance | 5% |
Sampling method | Statistical attribute sampling |
The auditor would use a sampling table or appropriate statistical calculation to determine the required sample size.
It would be inappropriate to automatically select 25 or 40 transactions simply because those sample sizes were used in previous audits.
Statistical sample sizes should be based on the audit objective and sampling parameters—not on customary sample counts.
9. A Practical Attribute Sampling Example
Assume an internal auditor is testing purchase order approvals.
The organization processed 8,000 purchase orders during the year.
Management's policy requires approval before a purchase order is issued.
The auditor establishes the following sampling plan:
Population: 8,000 purchase orders.
Attribute: Evidence of appropriate approval before issuance.
Tolerable deviation rate: 5%.
Expected deviation rate: 1%.
Acceptable risk of overreliance: 5%.
For illustration, suppose the auditor uses a valid random sample of 150 purchase orders.
The auditor identifies three deviations.
The observed sample deviation rate is:
[\text{Sample Deviation Rate}=\frac{\text{Number of Deviations}}{\text{Sample Size}}]
[=\frac{3}{150}=2%]
The observed deviation rate is 2%.
However, the auditor should not conclude that the control is acceptable simply because 2% is below the 5% tolerable rate.
The auditor must also consider sampling risk.
10. Understanding the Upper Deviation Rate
The upper deviation rate, sometimes called the upper deviation limit or upper precision limit, is a statistical upper bound on the population deviation rate at the selected confidence level.
It reflects uncertainty associated with examining only a sample.
Using the preceding example:
Sample size: 150.
Deviations: 3.
Observed deviation rate: 2%.
Confidence level: 95%.
Under a one-sided exact binomial evaluation, the upper confidence bound is approximately 5.1%.
This result is slightly above the 5% tolerable deviation rate.
Consequently, under that specified statistical model, the sample would not provide sufficient evidence to support the planned reliance on the control at the selected risk level.
This does not prove that the population deviation rate exceeds 5%.
It means the sample does not provide the required level of assurance that the rate is within tolerance.
For a finite population, an exact hypergeometric evaluation may produce a different upper bound. Auditors should apply the evaluation method appropriate to the sampling design.
11. Why the Observed Deviation Rate Is Not Enough
Consider two hypothetical samples.
Measure | Sample A | Sample B |
Sample size | 50 | 200 |
Deviations | 1 | 4 |
Observed deviation rate | 2% | 2% |
Both samples have an observed deviation rate of 2%.
But the larger sample generally provides more precise statistical evidence.
The upper deviation limit for Sample B will ordinarily be lower than that for Sample A, assuming the same statistical model and confidence level.
This illustrates why auditors cannot evaluate attribute sampling results using only the observed percentage.
The sample size and acceptable sampling risk also matter.
12. Selecting the Sample
The method used to select the sample affects the validity of the audit conclusion.
For statistical attribute sampling, the auditor should use a selection method consistent with the statistical design.
Common approaches include:
Simple random sampling: Each sampling unit has an equal probability of selection.
Systematic sampling with a random start: Items are selected at a specified interval after a randomly determined starting point, provided the method is appropriate for the population and does not introduce problematic patterns.
Stratified sampling: The population is divided into meaningful groups and sampled using an appropriate design.
Statistical sampling requires a selection method that supports valid probability-based inference.
Haphazard selection, convenience selection, and judgmental selection do not provide the same basis for quantifying sampling risk.
13. Defining a Deviation Before Testing
One of the most important sampling decisions is defining what constitutes a deviation.
Suppose a bank requires two authorized individuals to approve changes to customer wire transfer instructions.
The auditor should establish how to classify situations such as:
Only one approval is documented.
Approval occurred after the change.
The approver lacked the necessary authority.
Evidence of approval is missing.
The transaction was processed through an approved exception procedure.
The auditor should determine the applicable control criteria before examining the sample.
Otherwise, inconsistent classification can undermine the reliability of the results.
Missing documentation may need to be treated as a deviation when the auditor cannot obtain sufficient appropriate evidence that the control operated.
14. Evaluating the Nature and Cause of Deviations
Statistical evaluation is important, but auditors should also understand why deviations occurred.
For example, three missing approvals might result from:
A temporary system outage.
Inadequate employee training.
Deliberate management override.
Poorly designed workflow controls.
Unauthorized access.
A misunderstanding of the approval requirement.
The same observed deviation rate can represent very different levels of risk.
single deviation involving suspected fraud or intentional management override may require significant attention, even when the statistical upper deviation rate is within tolerance.
Auditors should evaluate both the frequency and the qualitative significance of deviations.
15. Attribute Sampling and PCAOB Auditing Standards
For audits performed under PCAOB standards, audit sampling is addressed by AS 2315, Audit Sampling.
AS 2315 explains the use of sampling in audit testing and the importance of considering sampling risk.
In tests of controls, the auditor should consider the relationship among:
The planned reliance on controls.
The tolerable rate of deviation.
The expected rate of deviation.
The allowable risk of assessing control risk too low.
The sample results.
PCAOB AS 1105, Audit Evidence, is also relevant because auditors must obtain sufficient appropriate evidence to support their conclusions.
AS 2301, The Auditor's Responses to the Risks of Material Misstatement, addresses the auditor's response to assessed risks, including tests of controls when applicable.
The important principle is that a sample should be designed to achieve the audit objective.
An arbitrary sample that does not support the intended conclusion may provide insufficient evidence, even when the auditor documents the procedures thoroughly.
16. Attribute Sampling in Internal Auditing
Internal auditors use attribute sampling in many areas beyond financial reporting.
Examples include:
Audit area | Attribute tested |
Accounts payable | Proper invoice approval |
Payroll | Authorized employee changes |
Procurement | Compliance with purchasing approval requirements |
Vendor management | Independent authentication of banking changes |
Information technology | Evidence of access review |
Cybersecurity | Timely approval of privileged access |
Banking compliance | Required account opening documentation |
Regulatory compliance | Completion of prescribed reviews |
Financial reporting | Evidence of supervisory reconciliation review |
Inventory | Documentation of required inventory counts |
Attribute sampling can be particularly valuable when management needs assurance concerning whether a recurring control is operating consistently.
However, auditors should consider whether sampling is appropriate for the control being tested.
For example, an automated control that operates consistently through a stable configuration may require a different testing approach from a manual control performed separately for every transaction.
17. Statistical vs. Nonstatistical Attribute Sampling
Auditors may use statistical or nonstatistical sampling.
Statistical sampling uses probability-based selection and statistical evaluation to quantify sampling risk.
Nonstatistical sampling relies on professional judgment to determine sample size and evaluate results without mathematically quantifying sampling risk.
Both approaches can be appropriate when properly designed and applied.
However, a nonstatistical sample should not be presented as providing a quantified 95% confidence level unless a valid statistical methodology supports that claim.
Likewise, a large judgmental sample is not automatically a statistical sample.
The auditor must distinguish between professional judgment about sampling risk and mathematically quantified sampling risk.
18. Common Attribute Sampling Mistakes
Several mistakes can undermine audit conclusions.
Using arbitrary sample sizes: Selecting a standard number of transactions without considering risk and tolerance.
Failing to define the population: Testing transactions that do not represent the period or activity being evaluated.
Using an incomplete population: Omitting transactions because of unreliable system reports or data extraction errors.
Poorly defined attributes: Failing to establish exactly what constitutes a deviation.
Confusing the sample rate with the population rate: Assuming the observed deviation percentage is the actual population rate.
Ignoring sampling risk: Concluding that a control is effective without considering the upper deviation limit.
Overlooking qualitative significance: Treating all deviations as equally important.
Inappropriate replacement of sample items: Replacing difficult-to-test items without a valid methodological basis.
Applying statistical conclusions to judgmental samples: Claiming quantified confidence without probability-based selection.
Failing to investigate deviations: Reporting exception counts without determining their causes and implications.
These errors can lead auditors to place unjustified reliance on ineffective controls.
19. Using Technology and AI in Attribute Sampling
Technology can improve attribute sampling by helping auditors:
Identify complete transaction populations.
Generate random samples.
Extract supporting documentation.
Match approvals to transactions.
Detect missing control attributes.
Identify unusual exceptions.
Document sampling results.
Artificial intelligence may assist in evaluating large volumes of unstructured documents, such as invoices, approval emails, and reconciliation evidence.
However, AI-generated classifications should be validated.
An AI system may incorrectly identify an approval, overlook an exception, or misinterpret a document.
Auditors should understand the reliability of the information used and retain sufficient appropriate evidence to support their conclusions.
AI can make sampling procedures more efficient, but it does not eliminate sampling risk or the need for professional judgment.
20. A Practical Attribute Sampling Workpaper
A well-designed workpaper should document the sampling methodology and the basis for the auditor's conclusion.
Workpaper element | Required information |
Audit objective | Control being evaluated |
Population | Description, size, and period |
Population completeness | Procedures supporting population reliability |
Sampling unit | Individual item selected |
Attribute | Required control characteristic |
Deviation definition | Conditions constituting failure |
Tolerable deviation rate | Maximum acceptable population rate |
Expected deviation rate | Planning estimate |
Acceptable sampling risk | Selected risk of overreliance |
Sample size | Number of items selected and basis |
Selection method | Random or other appropriate method |
Results | Number and nature of deviations |
Statistical evaluation | Upper deviation limit, if applicable |
Conclusion | Implications for control reliance |
Follow-up | Investigation and reporting of deviations |
The workpaper should allow an experienced auditor to understand what was tested, how the sample was selected, how deviations were evaluated, and why the conclusion was reached.
21. Attribute Sampling Checklist for Auditors
Before concluding an attribute sampling engagement, ask:
Is the audit objective clearly defined?
Is the population complete and appropriate?
Is the sampling unit properly identified?
Is the control attribute clearly defined?
Are deviation criteria established before testing?
Is the tolerable deviation rate appropriate?
Is the expected deviation rate reasonable?
Is the acceptable sampling risk consistent with planned reliance?
Was the sample selected using the intended methodology?
Were all selected items properly evaluated?
Were deviations investigated?
Was the upper deviation limit calculated correctly when statistical sampling was used?
Were qualitative implications considered?
Does the conclusion follow from the evidence?
Are significant deficiencies communicated appropriately?
The Bottom Line
Attribute sampling is one of the most useful techniques for evaluating the operating effectiveness of internal controls.
It allows auditors to examine selected transactions, identify control deviations, and evaluate whether the results support conclusions about a larger population.
But effective attribute sampling requires more than selecting transactions and calculating an exception percentage.
Auditors must define the population, establish meaningful sampling parameters, select items appropriately, evaluate sampling risk, and investigate deviations.
The distinction between the observed deviation rate and the statistically evaluated upper deviation limit is particularly important.
A control does not become effective simply because the sample deviation rate is below management's tolerance. The auditor must obtain sufficient appropriate evidence to support that conclusion.
When properly designed and applied, attribute sampling improves the consistency, credibility, and defensibility of audit conclusions.
For internal and external auditors, it remains an essential component of professional audit tradecraft.
Learn More with Corporate Compliance Seminars
Corporate Compliance Seminars provides continuing professional education covering audit evidence, statistical and nonstatistical sampling, internal control testing, audit methodology, and risk-based auditing.
Our programs help internal auditors, external auditors, and compliance professionals strengthen their practical auditing skills and apply professional standards effectively.
Visit Corporate Compliance Seminars to explore available CPE training programs.
Comments