Expected Deviation Rate Explained: How Auditors Estimate Control Failures Before Testing
Understanding expected population deviation rates, attribute sampling, sample size determination, and the relationship between expected and tolerable deviations
When auditors design tests of internal controls, they must make several important decisions before selecting a sample.
One of the most important is estimating how frequently the control is expected to fail.
This estimate is called the Expected Population Deviation Rate (EPDR), commonly shortened to the Expected Deviation Rate (EDR).
Expected deviation rate is a fundamental concept in attribute sampling. It influences the number of transactions auditors need to examine, the efficiency of audit testing, and the likelihood that the planned sampling approach will provide sufficient appropriate audit evidence.
However, expected deviation rate is frequently misunderstood.
Some auditors confuse it with the tolerable deviation rate. Others assume that a control with no known history of failure should automatically have an expected deviation rate of zero.
Both assumptions can lead to inappropriate sampling decisions.
This article explains how expected deviation rates work, how auditors establish reasonable estimates, and how these estimates affect audit planning and evaluation.
1. What Is the Expected Deviation Rate?
The Expected Population Deviation Rate is the rate at which an auditor anticipates deviations from a prescribed control will occur in the population being tested.
It is an estimate made during audit planning, before the auditor evaluates the results of the planned sample.
For example, an organization processes 20,000 vendor invoices annually.
The organization's policy requires supervisory approval before an invoice can be paid.
Based on prior audit results, preliminary testing, and knowledge of the organization's control environment, the auditor estimates that approximately 2% of invoices may lack the required approval.
The expected deviation rate is therefore 2%.
The auditor uses this estimate when determining the appropriate sample size.
Expected deviation rate is what the auditor anticipates finding—not the maximum deviation rate the auditor is willing to accept.
The estimate should have a reasonable basis. It should not simply be a convenient percentage selected to reduce audit work.
2. Expected Deviation Rate Versus Tolerable Deviation Rate
Two important sampling concepts must be distinguished.
Expected Deviation Rate (EDR)
The estimated percentage of items in the population that will fail to satisfy the prescribed control requirement.
Tolerable Deviation Rate (TDR)
The maximum population deviation rate the auditor is willing to accept while still achieving the intended audit objective.
Consider the following example:
Sampling parameter | Rate |
Expected deviation rate | 2% |
Tolerable deviation rate | 5% |
Acceptable risk of overreliance | 5% |
Corresponding confidence level | 95% |
The auditor expects approximately 2% of transactions to contain deviations but is willing to tolerate a population deviation rate of no more than 5% for the planned level of control reliance.
The difference between the expected and tolerable rates is important because the sampling plan must provide sufficient precision to distinguish an acceptable population deviation rate from an unacceptable one.
Generally, the closer the expected deviation rate is to the tolerable deviation rate, the larger the sample needed.
If the expected deviation rate exceeds the tolerable deviation rate, the auditor should reconsider whether reliance on the control is appropriate.
3. Why Expected Deviation Rate Matters
Expected deviation rate affects audit planning in several ways.
Sample Size
A higher expected deviation rate generally requires a larger sample when the tolerable deviation rate and acceptable sampling risk remain unchanged.
Audit Efficiency
A reasonable estimate helps avoid selecting samples that are unnecessarily large or too small to support the intended conclusion.
Control Reliance
An expectation of frequent deviations may indicate that the auditor should reduce planned reliance on the control or consider alternative audit procedures.
Audit Risk
An unrealistic estimate can produce a sampling plan that does not adequately address the auditor's intended risk of overreliance.
For example, an auditor who assumes an expected deviation rate of zero despite a history of control failures may select an inadequately sized sample for the anticipated conditions.
The issue is not that zero is always an invalid estimate. Rather, the auditor must have a reasonable basis for the estimate.
4. How Auditors Establish the Expected Deviation Rate
Auditors should use relevant and reliable information to estimate the anticipated population deviation rate.
Several sources can be considered.
Prior-Year Audit Results
Previous testing may provide useful information about how frequently a control has failed.
Suppose the prior-year audit tested 150 transactions and identified three deviations.
The observed prior-year deviation rate was: 3 ÷ 150 × 100 = 2%
The auditor might use 2% as a starting point for the current-year estimate.
However, the auditor should consider whether the control, personnel, systems, and operating environment have changed.
Prior-year results do not automatically represent current-year conditions.
Preliminary Testing
Auditors may perform a preliminary assessment or pilot sample to estimate the likely deviation rate.
For example, a preliminary examination of 40 transactions identifies one deviation.
The observed rate is: 1 ÷ 40 × 100 = 2.5%
This information may help develop the sampling plan.
However, a small preliminary sample can produce an imprecise estimate, and the auditor should consider that uncertainty.
Management's Control Monitoring Results
Management may maintain exception reports, quality assurance results, or internal control monitoring records.
These records can provide information about the frequency of control failures.
However, auditors should evaluate the reliability, completeness, and relevance of management-generated information before relying on it.
Changes in Systems and Personnel
Significant changes may affect the expected deviation rate.
Examples include:
Implementation of a new accounting system.
Changes in transaction approval workflows.
Employee turnover.
Changes in supervisory responsibilities.
Increased transaction volumes.
Introduction of automated controls.
Changes in business operations.
A previously effective control may experience more deviations during a system conversion or organizational restructuring.
Conversely, properly implemented automation may reduce the expected deviation rate.
Known Control Deficiencies
Previously identified control deficiencies may indicate that deviations are likely to recur.
The auditor should evaluate whether management implemented corrective actions and whether those actions were effective.
An unresolved control deficiency may make planned reliance inappropriate, regardless of the expected deviation rate selected.
5. How Expected Deviation Rate Affects Sample Size
Consider an auditor testing whether vendor payments received required supervisory approval.
The auditor establishes:
Tolerable deviation rate: 5%.
Acceptable risk of overreliance: 5%.
Confidence level: 95%.
Sampling method: Statistical attribute sampling.
The auditor evaluates several possible expected deviation rates.
Expected deviation rate | General sample size implication |
0% | Smaller sample may be sufficient |
1% | Larger sample than the zero-deviation assumption |
2% | Additional sample size generally required |
3% | Substantially larger sample may be necessary |
4% | Very large sample may be required |
5% or more | Planned reliance should be reconsidered |
The relationship is not necessarily linear.
As the expected deviation rate approaches the tolerable deviation rate, the sample size can increase sharply.
The exact sample size depends on the statistical method, confidence requirement, acceptable number of deviations, population characteristics, and other sampling design assumptions.
There is no universal sample size determined by expected deviation rate alone.
6. Example: Designing an Attribute Sampling Plan
Assume an auditor is evaluating an automated purchasing approval control.
The organization processes 15,000 purchase orders annually.
The auditor establishes the following sampling parameters:
Parameter | Planning assumption |
Population size | 15,000 |
Expected deviation rate | 1% |
Tolerable deviation rate | 5% |
Acceptable risk of overreliance | 5% |
Confidence level | 95% |
The auditor must select a sample large enough to provide the desired statistical assurance if deviations occur at approximately the expected rate.
For illustration, suppose the auditor uses a binomial attribute sampling plan with a sample of 100 items.
At a 95% one-sided confidence level:
Zero deviations produce an upper deviation rate of approximately 2.95%.
One deviation produces an upper deviation rate of approximately 4.66%.
Two deviations produce an upper deviation rate of approximately 6.16%.
Under this particular sampling plan, the auditor could accept no more than one deviation while supporting a 5% tolerable deviation rate at the selected confidence level.
The plan's actual probability of acceptance when the population deviation rate is 1% is approximately 73.6%.
This illustrates an important planning consideration: the auditor should not focus exclusively on the probability of incorrectly relying on an ineffective control. The auditor should also consider whether the sampling plan is reasonably likely to support the intended conclusion when the expected deviation rate is accurate.
If the expected deviation rate is underestimated, the planned sample may produce more deviations than anticipated.
The auditor may then be unable to support the planned reliance.
7. Expected Deviation Rate Is Not the Observed Deviation Rate
Auditors must distinguish between the estimate made before testing and the results obtained after testing.
Expected deviation rate: Estimated before the sample is evaluated.
Observed sample deviation rate: Calculated from the actual sample results.
The observed sample deviation rate is: Number of Deviations ÷ Number of Items Tested × 100
Suppose an auditor expects a 1% deviation rate but tests 100 transactions and identifies four deviations.
The observed sample deviation rate is: 4 ÷ 100 × 100 = 4%
The actual results are materially different from the planning expectation.
This difference should prompt the auditor to investigate the nature and cause of the deviations.
The auditor should not simply revise the expected deviation rate after testing to make the original sample plan appear appropriate.
The original planning estimate and the actual results serve different purposes and should remain distinguishable in the audit documentation.
8. What Happens When Actual Deviations Exceed Expectations?
Suppose an auditor establishes:
Expected deviation rate: 1%.
Tolerable deviation rate: 5%.
Confidence level: 95%.
The auditor tests 100 transactions and identifies four deviations.
The observed sample deviation rate is 4%.
Although 4% is less than the 5% tolerable deviation rate, the sample does not support the intended level of control reliance at the selected confidence level.
The exact one-sided 95% upper confidence bound is approximately 9.0%.
This exceeds the 5% tolerable deviation rate.
The auditor should investigate the exceptions and determine the implications for the audit.
Possible responses include:
Investigating the nature and causes of the deviations.
Evaluating whether the deviations indicate a broader control deficiency.
Reassessing the planned reliance on the control.
Considering whether additional audit procedures are appropriate.
Modifying substantive testing where necessary.
Communicating significant control deficiencies to appropriate management or governance personnel.
An observed rate below the tolerable deviation rate does not automatically mean that the control passes.
Sampling risk must be considered when evaluating the results.
9. Why an Expected Deviation Rate of Zero Can Be Dangerous
Auditors sometimes assume that a control should have an expected deviation rate of zero because management describes it as automated or highly effective.
However, even automated controls may fail because of:
Incorrect system configurations.
Unauthorized changes to application settings.
Inappropriate user access.
Defective interfaces.
Incomplete transaction processing.
Management override.
Changes in business rules.
An expected deviation rate of zero may be reasonable in certain circumstances, particularly when supported by relevant evidence about the control's operation.
But it should not be assumed merely because the control is automated.
For example, an automated three-way matching control may reject invoices that do not agree with purchase orders and receiving records.
The auditor should still determine whether the control can be overridden, whether system changes are appropriately managed, and whether the underlying information is reliable.
The absence of known deviations is not necessarily evidence that no deviations are likely.
0. Expected Deviation Rates for Different Types of Controls
Different controls may have different expected deviation rates because their design and operating characteristics differ.
Consider the following illustrative situations.
Control | Possible planning consideration |
Automated invoice matching | May have a low expected deviation rate if configuration and relevant IT controls are reliable |
Manual supervisory approval | May experience deviations due to human error or inconsistent performance |
Monthly bank reconciliation | Limited number of occurrences may make traditional attribute sampling less useful |
Vendor master file changes | Expected deviations may be affected by access restrictions and approval procedures |
Journal entry review | Risk and significance of deviations may be more important than frequency alone |
User access recertification | Expected deviations may depend on personnel turnover and access administration |
These are not prescribed rates or conclusions.
Auditors should evaluate the specific control, relevant risks, and available evidence before determining the expected deviation rate.
11. Statistical Versus Nonstatistical Sampling
Expected deviation rate is relevant to both statistical and nonstatistical sampling.
Statistical Sampling
Statistical sampling uses probability theory to determine sample sizes and evaluate sampling risk.
The expected deviation rate is incorporated into the sampling design.
For example, the auditor may use an attribute sampling table or statistical software to determine an appropriate sample size based on:
Expected population deviation rate.
Tolerable deviation rate.
Acceptable risk of overreliance.
Population characteristics.
Nonstatistical Sampling
Nonstatistical sampling uses professional judgment rather than formal probability calculations to determine and evaluate the sample.
The auditor should still consider the anticipated frequency of deviations.
A higher expected deviation rate generally supports selecting a larger sample or reconsidering planned reliance.
However, nonstatistical sampling does not provide a mathematically quantified confidence level.
Auditors should not describe a nonstatistical sample as providing 95% confidence unless that claim is supported by an appropriate statistical methodology.
For PCAOB engagements, AS 2315, Audit Sampling, provides the relevant professional guidance.
12. Common Mistakes When Establishing Expected Deviation Rates
Mistake 1: Confusing Expected and Tolerable Deviation Rates
The expected deviation rate is a planning estimate.
The tolerable deviation rate is an acceptance threshold for the intended audit objective.
They are not interchangeable.
Mistake 2: Selecting an Arbitrary Percentage
An auditor assumes a 1% expected deviation rate without considering prior results, control characteristics, or current conditions.
The estimate may not reflect the population being tested.
Mistake 3: Ignoring Prior Audit Findings
The prior audit identified multiple approval failures, but the current-year sampling plan assumes no deviations.
The estimate may be unsupported unless corrective actions have been implemented and their effectiveness evaluated.
Mistake 4: Using the Same Rate for Every Control
Different controls have different risks, operating characteristics, and histories of failure.
A single default rate may not be appropriate.
Mistake 5: Treating Management's Representations as Sufficient Evidence
Management states that the control rarely fails.
The auditor accepts that statement without reviewing supporting information.
Management's representations may inform planning, but their reliability should be evaluated.
Mistake 6: Changing the Estimate After Seeing Sample Results
An auditor changes the expected deviation rate after testing to justify the selected sample size.
This compromises the integrity of the original sampling plan.
Mistake 7: Ignoring the Significance of Individual Deviations
A low deviation rate does not necessarily mean that the control is effective.
One unauthorized multimillion-dollar payment may warrant substantial investigation even if the overall observed deviation rate is small.
13. Using Artificial Intelligence to Estimate Expected Deviation Rates
Artificial intelligence can assist auditors in analyzing historical control testing results and identifying patterns that may affect expected deviation rates.
For example, an auditor could provide:
Prior-year control testing results.
Current-year preliminary testing results.
Changes in relevant policies.
Information about system conversions.
Management's remediation records.
Relevant exception reports.
AI may help summarize the information and suggest factors that should influence the expected deviation rate.
Example AI Prompt
"Review the attached prior-year control testing results and current-year preliminary testing information. Identify historical deviation rates, significant changes in control design or operation, and factors that may affect the expected population deviation rate. Recommend a planning estimate with supporting rationale. Clearly distinguish verified information from assumptions, and identify any additional evidence needed."
The AI output should be treated as a planning aid.
The auditor must validate calculations, assess the reliability of the information, and determine whether the proposed estimate is appropriate.
AI-generated estimates should not replace professional judgment or a validated sampling methodology.
14. What Should the Audit Workpaper Document?
An attribute sampling workpaper should ordinarily document the expected deviation rate and the basis for selecting it.
Workpaper element | Recommended documentation |
Audit objective | Control and related risk being tested |
Population | Definition, period, size, and completeness |
Sampling unit | Individual transaction or control occurrence |
Control attribute | Specific requirement being tested |
Expected deviation rate | Planning estimate |
Basis for estimate | Prior results, preliminary testing, monitoring data, or other evidence |
Tolerable deviation rate | Maximum acceptable population deviation rate |
Sampling risk | Acceptable risk of overreliance |
Sample size | Selected sample size and supporting methodology |
Sample selection | Method used to select items |
Actual deviations | Exceptions identified during testing |
Evaluation | Comparison of actual results with the sampling plan |
Conclusion | Implications for control reliance and additional procedures |
The workpaper should clearly distinguish the original expected deviation rate from the observed sample deviation rate.
It should also explain significant differences between the expected and actual results.
For PCAOB audits, AS 1215, Audit Documentation, establishes requirements for documenting audit procedures, evidence, and conclusions.
15. Final Thoughts: Expected Deviation Rate Is a Planning Judgment
Expected deviation rate is an important element of attribute sampling because it helps auditors anticipate the frequency of control failures before testing begins.
A reasonable estimate contributes to efficient sample design and appropriate evaluation of control reliance.
However, the estimate must be supported by relevant information and professional judgment.
The relationship among the major sampling parameters can be summarized as:
Expected Deviation Rate → Tolerable Deviation Rate → Sampling Risk → Sample Size → Testing Results → Audit Conclusion
Auditors should remember three important principles:
First: Expected deviation rate is a planning estimate, not an established population fact.
Second: A higher expected deviation rate generally requires a larger sample when other sampling parameters remain constant.
Third: The actual sample results must be evaluated using an appropriate methodology that considers sampling risk and the significance of identified deviations.
The objective is not to select an expected deviation rate that produces the smallest possible sample.
The objective is to develop a sampling plan capable of providing sufficient appropriate evidence for the intended audit conclusion.
An unsupported expected deviation rate can undermine the entire sampling plan before the auditor tests the first transaction.
About Corporate Compliance Seminars
Corporate Compliance Seminars (CCS) provides Continuing Professional Education (CPE) programs for internal auditors, external auditors, accounting professionals, compliance professionals, and information technology professionals.
Our training programs address PCAOB auditing standards, attribute and variable sampling, risk assessment, internal controls, audit evidence, audit documentation, and practical applications of artificial intelligence in auditing.
Explore upcoming CPE events at www.compliance-seminars.com.
Comments