How Auditors Determine Sample Size: A Practical Guide to Risk-Based Audit Sampling
Understanding Sampling Risk, Tolerable Misstatement, Population Characteristics, and Statistical Confidence
John C. Blackshire, Jr. Corporate Compliance Seminars (CCS) | Audit Sampling and Audit Evidence Series
How many transactions should an auditor examine?
Is a sample of 25 transactions sufficient? Should the auditor test 40, 60, or 100 items? Does a population containing one million transactions require a substantially larger sample than a population containing 10,000 transactions?
These are fundamental questions in both internal and external auditing.
Unfortunately, auditors sometimes determine sample sizes based on historical practices, standardized checklists, or arbitrary rules rather than the risks and objectives of the engagement.
A sample of 25 transactions may be entirely appropriate for one audit objective and wholly inadequate for another.
The correct sample size is determined by the audit objective, population characteristics, acceptable sampling risk, expected errors, and the level of assurance required—not by a universal number of transactions.
This article explains how auditors should determine sample size, the differences between statistical and nonstatistical sampling, and the factors that influence the amount of testing necessary to support a defensible audit conclusion.
1. What Is Audit Sampling?
Audit sampling involves applying audit procedures to fewer than 100% of the items within a defined population so the auditor can draw conclusions about that population.
Sampling is particularly useful when examining large volumes of transactions, balances, documents, or control activities.
For example, an organization may process:
250,000 vendor invoices annually.
100,000 payroll transactions.
50,000 customer credit adjustments.
20,000 purchase orders.
10,000 inventory items.
Examining every transaction may be impractical.
Sampling allows auditors to obtain evidence efficiently while recognizing that conclusions based on samples involve uncertainty.
The challenge is determining how much testing is necessary.
2. Start With the Audit Objective
Before calculating sample size, the auditor must understand what the test is intended to accomplish.
Consider two different audit objectives:
Objective A: Determine whether purchase orders received the required management approval.
Objective B: Estimate the total monetary amount of incorrect vendor payments.
These objectives require different sampling approaches.
The first is generally suited to attribute sampling because the auditor is evaluating whether a control attribute exists.
The second may require variables sampling or another substantive testing methodology because the objective is to estimate monetary misstatement.
Sample size should not be determined until the auditor has identified the audit objective and selected an appropriate testing methodology.
3. Statistical Versus Nonstatistical Sampling
Auditors may use statistical or nonstatistical sampling.
Both can be appropriate when properly designed and evaluated.
Statistical sampling
Statistical sampling uses probability-based selection and statistical evaluation to quantify sampling risk.
Common applications include attribute sampling, classical variables sampling, and monetary unit sampling.
Statistical sampling allows the auditor to establish a measurable relationship among sample size, expected errors, tolerable errors, and confidence.
Nonstatistical sampling
Nonstatistical sampling uses professional judgment rather than statistical probability calculations to determine sample size and evaluate results.
The auditor still considers risk, population characteristics, and the objective of the test.
However, the auditor does not quantify sampling risk mathematically.
Nonstatistical sampling is not permission to select an arbitrary number of transactions.
The sample must still be sufficient to support the intended conclusion.
4. The Seven Major Factors That Influence Sample Size
Several factors determine how many items an auditor should examine.
Factor | General relationship to sample size |
Audit risk and required assurance | Greater required assurance generally increases sample size |
Tolerable deviation or misstatement | Lower tolerance generally increases sample size |
Expected deviation or misstatement | Higher expected error generally increases sample size |
Population variability | Greater variability generally increases sample size for classical variables sampling |
Sampling methodology | Different methods produce different sample-size requirements |
Population size | May matter, especially for smaller populations; often has limited impact for large populations |
Other relevant audit evidence | Greater assurance from other procedures may reduce the assurance needed from the sample |
These relationships are general rather than universal.
The auditor must apply them within the selected sampling methodology.
5. Factor One: Audit Risk and Required Confidence
Audit risk is a fundamental consideration in sample design.
In substantive testing, the auditor is particularly concerned about the risk of incorrect acceptance.
This occurs when the sample supports accepting a materially misstated population.
In tests of controls, the comparable concern is the risk of assessing control risk too low—concluding that a control is more effective than it actually is.
Statistical sampling allows the auditor to select an acceptable sampling risk.
For example:
Confidence level | Corresponding sampling risk |
90% | 10% |
95% | 5% |
99% | 1% |
These are illustrative one-sided assurance levels for an appropriately specified statistical test. They should not be interpreted as universal audit confidence requirements.
As the required confidence increases, the sample size generally increases.
An auditor seeking 99% confidence will generally require more testing than one seeking 90% confidence, assuming the other sampling parameters remain unchanged.
The required assurance should be based on the audit objective and the overall audit strategy.
6. Factor Two: Tolerable Deviation Rate
When testing internal controls, auditors frequently use attribute sampling.
The auditor determines whether a control operated as required.
Examples include whether a payment was approved, whether a reconciliation was reviewed, or whether access changes were authorized.
The tolerable deviation rate is the maximum population deviation rate the auditor is willing to accept for the intended reliance on the control.
Suppose an auditor is testing a monthly control that should operate without significant exceptions.
The auditor might establish a low tolerable deviation rate because even a modest frequency of failures could undermine reliance on the control.
For another control, a higher deviation rate might be tolerable, depending on its purpose, the significance of the risk, and the nature of the control.
The lower the tolerable deviation rate, the larger the sample generally needs to be.
Tolerable deviation should be established before evaluating the sample results.
7. Factor Three: Expected Deviation Rate
The expected deviation rate represents the auditor's estimate of how frequently the control may fail.
The estimate may be based on previous audits, preliminary testing, management monitoring, changes in personnel, system conversions, or other relevant information.
Consider two populations:
In Population A, the auditor expects virtually no deviations.
In Population B, prior testing suggests that 4% of transactions may contain control deviations.
If the auditor uses the same tolerable deviation rate and required assurance, Population B will generally require a larger sample.
A higher expected deviation rate leaves less room between expected performance and the maximum acceptable deviation rate.
If the expected deviation rate approaches or exceeds the tolerable rate, the auditor should reconsider whether reliance on the control is appropriate.
8. Factor Four: Tolerable Misstatement
For substantive tests of details, tolerable misstatement is a major sample-size input.
It represents the maximum monetary misstatement the auditor is willing to accept in the population for the intended audit procedure.
Suppose a company reports inventory of $10 million.
The auditor establishes tolerable misstatement for the inventory population at $250,000.
The sampling methodology must provide an appropriate basis for evaluating whether population misstatement exceeds that amount.
If tolerable misstatement is reduced to $100,000, the required sample size will generally increase.
This is because the auditor must detect smaller potential misstatements with the required level of assurance.
Tolerable misstatement should be determined in the context of the overall audit approach and applicable materiality considerations.
9. Factor Five: Population Variability
Population variability is especially important in classical variables sampling.
Consider two populations containing 10,000 items:
Population A contains transactions with relatively similar monetary values.
Population B contains transactions ranging from $10 to $1 million.
Population B has substantially greater monetary variability.
If the auditor uses a classical variables sampling method, greater variability generally requires a larger sample to achieve the same estimation precision.
One way to address variability is through stratification.
For example, the auditor might divide the population into high-value, medium-value, and low-value transactions.
High-value transactions may be tested individually, while an appropriate sample is selected from the remaining population.
This can improve sampling efficiency without sacrificing the quality of the conclusion.
10. Factor Six: Population Size
One of the most common misconceptions in audit sampling is that sample size must
increase proportionally with population size.
That is not generally correct.
For sufficiently large populations, sample size is often influenced much more by confidence, tolerable error, and expected error than by the total number of items.
For example, under a simplified attribute sampling model, a population of 10,000 transactions and a population of 100,000 transactions may require nearly identical sample sizes.
However, population size becomes more important when the population is small.
A population containing only 24 monthly control occurrences presents different sampling considerations from a population containing 100,000 daily transactions.
The auditor must also consider whether sampling is appropriate at all.
For some small populations, examining every occurrence may be more effective.
11. Factor Seven: Assurance From Other Audit Procedures
Sample size should be considered within the overall audit strategy.
For example, the auditor may obtain evidence from analytical procedures, other substantive tests, automated control testing, or related assurance activities.
Where those procedures provide appropriate evidence addressing the same relevant risk and assertion, the assurance required from a particular sample may be reduced.
However, evidence must be relevant to the specific audit objective.
A strong control over vendor approval does not automatically provide assurance that vendor invoices were recorded at the correct amount.
The auditor must understand what each procedure actually establishes.
12. A Practical Attribute Sampling Calculation
Consider an auditor testing whether purchase orders received required approval.
Assume the following sampling parameters:
Population: 10,000 purchase orders.
Expected deviation rate: 0%.
Tolerable deviation rate: 5%.
Acceptable risk of assessing control risk too low: 5%.
Selection method: Random selection.
Evaluation: One-sided binomial upper confidence bound.
Under a zero-deviation acceptance plan, the auditor can calculate the sample size needed so that observing zero deviations supports an upper population deviation limit of approximately 5% at 95% confidence.
For a sufficiently large population, the calculation is:
n ≥ ln(0.05) ÷ ln(0.95)
The result is approximately 58.4.
Rounding upward gives:
Required sample size: 59 items.
If the auditor randomly examines 59 purchase orders and finds no deviations, the one-sided 95% upper deviation bound is approximately 4.95% under the binomial model.
That is below the 5% tolerable deviation rate.
This example assumes a sufficiently large population and the specified statistical model.
Exact finite-population calculations can produce slightly different results.
The conclusion also depends on the validity of the population, selection process, and procedures performed.
13. How Sample Size Changes With Tolerable Deviation
Assume a 95% one-sided confidence level and a zero-deviation acceptance plan.
The following sample sizes illustrate the relationship between tolerable deviation and required testing.
Tolerable deviation rate | Approximate minimum sample size |
10% | 29 |
5% | 59 |
3% | 99 |
2% | 149 |
1% | 299 |
These values use the binomial zero-deviation model for large populations.
They are not universal sample-size requirements for audit engagements.
If the auditor expects deviations or intends to accept some observed deviations, a different sample-size calculation is necessary.
The important lesson is that lower tolerable deviation rates can substantially increase required sample size.
14. How Confidence Affects Sample Size
Using the same simplified zero-deviation model and a 5% tolerable deviation rate:
Confidence level | Approximate minimum sample size |
90% | 45 |
95% | 59 |
99% | 90 |
Increasing confidence from 90% to 99% doubles the approximate number of items required in this example.
This illustrates the tradeoff between audit assurance and testing effort.
The auditor should not automatically select the highest confidence level.
The appropriate assurance depends on the significance of the risk and the overall audit approach.
15. What Happens When the Auditor Finds Deviations?
The preceding examples assume no deviations.
But what happens when the auditor identifies one or more exceptions?
Suppose the auditor tests 59 purchase orders and identifies two without required approval.
The observed deviation rate is:
2 ÷ 59 = 3.39%.
Although the observed rate is below the 5% tolerable deviation rate, the auditor cannot conclude that the population is acceptable.
The statistical allowance for sampling risk must also be considered.
Under a one-sided 95% exact binomial calculation, the upper deviation bound would be approximately 10.3%, exceeding the 5% tolerable rate.
The sample therefore would not support the planned level of reliance on the control.
The auditor should investigate the deviations, evaluate their causes and significance, and reconsider the audit approach.
This demonstrates why simply comparing the observed sample error rate with the tolerable rate is inadequate.
16. Sample Size for Variables Sampling
Variables sampling differs from attribute sampling because the auditor is estimating numerical amounts.
Common classical variables methods include mean-per-unit, difference, and ratio estimation.
Sample-size determination depends on the estimation method and the variability of the population characteristic being tested.
For a simplified mean-estimation application, a common planning approximation is:
n ≈ (Z × σ ÷ E)²
Where:
n = approximate required sample size.
Z = confidence coefficient.
σ = estimated standard deviation.
E = desired margin of error for the population mean.
This is a simplified statistical formula, not a complete audit sample-size methodology.
Practical audit sampling may require adjustments for finite populations, expected misstatements, estimation method, and the audit's required assurance.
For example, suppose the estimated standard deviation is $200 per item, the desired margin of error is $50 per item, and a two-sided 95% confidence coefficient of 1.96 is used.
The approximate sample size is:
n ≈ (1.96 × 200 ÷ 50)²
n ≈ 61.47
Rounding upward produces approximately 62 items.
This calculation illustrates how variability and desired precision affect sample size.
It does not establish that 62 items are sufficient for any particular financial statement audit.
17. Monetary Unit Sampling and Sample Size
Monetary unit sampling (MUS) is commonly used in substantive testing of recorded monetary balances.
It is particularly useful when the auditor is concerned about overstatements.
MUS sample size is influenced by:
Recorded population value.
Tolerable misstatement.
Expected misstatement.
Required assurance.
The selected statistical evaluation approach.
Under a simplified zero-expected-misstatement planning approach, an auditor may use a confidence factor to determine a sampling interval and approximate sample size.
For example, a $5 million accounts receivable population with tolerable misstatement of $100,000 and a confidence factor of 3 would produce a preliminary interval of approximately $33,333 and a sample size of approximately 150 monetary-unit selections.
The actual design must account for the applicable MUS methodology, expected misstatements, high-value items, and other sampling considerations.
A confidence factor of 3 is an illustrative approximation, not a universal requirement.
18. Why Arbitrary Sample Sizes Are Dangerous
Some audit departments use standardized sample sizes such as 25, 40, or 60 transactions for nearly every engagement.
Standardization can improve consistency, but it can also create false confidence.
A sample of 25 transactions may be sufficient for a limited objective involving a low-risk population.
The same sample may be inadequate when the auditor needs strong assurance that a critical control has a very low deviation rate.
Consider a zero-deviation sample of 25 items.
Using the simplified one-sided 95% binomial model, the upper deviation bound is approximately 11.3%.
That means the sample does not provide 95% confidence that the population deviation rate is below 5%.
The auditor should not conclude that a control is highly reliable merely because all 25 selected transactions passed.
A sample with no exceptions is not necessarily a statistically sufficient sample.
19. Sample Size and the Frequency of a Control
The frequency of a control affects the number of opportunities available for testing.
Consider these examples:
Control frequency | Approximate annual occurrences |
Annual | 1 |
Quarterly | 4 |
Monthly | 12 |
Weekly | 52 |
Daily business-day control | 250 |
Per transaction | Potentially thousands |
An auditor testing an annual control may examine its single annual occurrence and evaluate the evidence surrounding its operation.
A monthly reconciliation control has only 12 occurrences during a year.
A transaction-level approval control may operate thousands of times.
These populations require different approaches.
Auditors should not mechanically apply a transaction-based sample-size table to controls that operate only monthly or quarterly.
The sampling unit, frequency, risk, and nature of the evidence must be considered.
20. When Should Auditors Test 100% of a Population?
Sampling is not always the best approach.
Auditors may choose to examine every item when:
The population is small.
Individual transactions are highly significant.
The risk of material misstatement is unusually high.
Automated procedures make complete testing practical.
The population contains a limited number of high-value items.
Specific regulatory or contractual requirements call for complete testing.
For example, an auditor may examine all 12 monthly bank reconciliations rather than select a sample.
Similarly, an auditor may test all transactions above a defined monetary threshold and sample the remaining population.
However, testing every record with an automated procedure does not automatically establish that every relevant control operated effectively.
The auditor must still evaluate the reliability of the data, the completeness of the population, and the procedures performed.
21. The Role of Professional Judgment
Statistical formulas provide a disciplined way to determine sample size.
They do not eliminate professional judgment.
The auditor must still determine whether the population is appropriate, whether the test addresses the relevant risk, and whether the resulting evidence supports the intended conclusion.
For example, an auditor may calculate a statistically sufficient sample size for testing purchase order approvals.
But if the population excludes emergency purchases, the sample may fail to address a significant risk.
Similarly, a statistically valid sample of recorded vendor payments may not detect payments that were never recorded.
Professional judgment is necessary to ensure that the sampling approach addresses the correct population and audit objective.
22. How AI and Data Analytics Can Improve Sampling
Artificial intelligence and data analytics can help auditors design and execute sampling procedures more efficiently.
Potential applications include:
Evaluating population characteristics.
Calculating transaction distributions.
Identifying high-value items.
Supporting stratification.
Generating random selections.
Calculating statistical sample sizes.
Identifying unusual transactions.
Evaluating sample results.
Preparing audit documentation.
However, AI-generated calculations should be independently validated.
Auditors should confirm that the statistical method is appropriate, the population is complete, and the formulas have been correctly applied.
AI may also help identify high-risk transactions for targeted examination.
That is valuable, but targeted selection should not be confused with probability sampling.
Selecting the most unusual transactions does not, by itself, support statistical projection to the entire population.
23. A Practical Sample-Size Planning Checklist
Before selecting a sample, the auditor should document the following:
Planning question | Auditor's determination |
What is the audit objective? | Control effectiveness or monetary estimation |
What is the population? | Defined transactions, balances, or control occurrences |
Is the population complete? | Reconciliation and data validation |
What is the sampling unit? | Transaction, item, monetary unit, or control occurrence |
What methodology will be used? | Statistical or nonstatistical |
What is the tolerable error? | Deviation rate or monetary misstatement |
What error is expected? | Based on relevant available information |
What assurance is required? | Based on risk and overall audit strategy |
Is stratification appropriate? | Based on population characteristics |
What sample size is justified? | Supported by the methodology |
How will items be selected? | Appropriate selection procedure |
How will exceptions be evaluated? | Projection, sampling allowance, and qualitative assessment |
How will conclusions be documented? | Workpapers and supervisory review |
The workpaper should explain not only how many items were selected, but also why that number was appropriate.
24. How Sample Size Relates to Audit Evidence
Sample size is only one component of audit evidence.
An auditor may examine 500 transactions and still obtain poor evidence if the procedures are ineffective.
Conversely, a carefully designed test of a smaller population may provide strong evidence when the objective, risk, and procedures are appropriately aligned.
PCAOB AS 1105, Audit Evidence, emphasizes the need for sufficient appropriate audit evidence.
Sufficiency concerns the quantity of evidence.
Appropriateness concerns its relevance and reliability.
Increasing sample size cannot compensate for evidence that does not address the audit objective.
For example, examining 500 invoices does not establish that vendors are legitimate if the auditor never performs procedures addressing vendor identity.
The auditor must select procedures that test the relevant assertion or control objective.
25. Applicable Professional Standards
Several professional standards and guidance documents address audit sampling.
PCAOB AS 2315 — Audit Sampling: Provides requirements concerning audit sampling in
PCAOB engagements, including sample planning, selection, and evaluation.
PCAOB AS 1105 — Audit Evidence: Addresses the sufficiency and appropriateness of audit evidence.
AICPA AU-C Section 530 — Audit Sampling: Addresses audit sampling in audits conducted under generally accepted auditing standards.
AICPA Audit Sampling Guide: Provides practical guidance on statistical and nonstatistical sampling, including attribute sampling, classical variables sampling, and monetary unit sampling.
IIA Global Internal Audit Standards: Require internal auditors to obtain sufficient, reliable, and relevant information and to perform appropriate analyses and evaluations to support engagement findings and conclusions.
The Global Internal Audit Standards do not prescribe a universal sample size for internal audit engagements.
The auditor must select an appropriate methodology based on the engagement's objectives and circumstances.
Conclusion: Sample Size Must Be Defensible
Determining audit sample size is not simply a mathematical exercise.
It is a professional decision that begins with understanding the audit objective and the risks being addressed.
Statistical sampling provides methods for quantifying sampling risk and calculating sample sizes.
Nonstatistical sampling relies more directly on professional judgment but still requires a disciplined rationale.
In either case, auditors should avoid arbitrary sample sizes and unsupported conclusions.
The number of transactions examined should reflect tolerable error, expected error, population characteristics, the required assurance, and the selected sampling methodology.
Auditors must also evaluate the results properly.
A sample with no exceptions does not automatically establish that a control is effective.
A projected monetary misstatement below tolerable misstatement does not automatically establish that a balance is acceptable.
The auditor must consider the uncertainty associated with sampling and the quality of the evidence obtained.
The fundamental question is not, "How many transactions did we test?"
The fundamental question is, "Does the sample provide sufficient appropriate evidence to support the conclusion we intend to make?"
That is the foundation of professional audit sampling.
Strengthen Your Audit Sampling Skills With Corporate Compliance Seminars
Corporate Compliance Seminars (CCS) offers continuing professional education covering audit sampling, audit evidence, internal controls, risk assessment, and audit methodology.
Our programs help internal and external auditors understand statistical and nonstatistical sampling, design appropriate audit procedures, and evaluate audit evidence.
Explore our auditing and assurance CPE programs at https://www.compliance-seminars.com/.
Comments