Tolerable Deviation Rate Explained: How Auditors Determine Whether Internal Controls Are Operating Effectively

10 min read

Understanding tolerable deviation rates, expected deviations, sampling risk, and how auditors evaluate the results of tests of controls

When auditors test internal controls, one of the most important questions is: How many control failures can occur before the auditor concludes that a control is not operating at the level of effectiveness required for the planned reliance?

The answer involves a fundamental concept in audit sampling: the Tolerable Deviation Rate (TDR).

Tolerable deviation rate is particularly important when auditors use attribute sampling to evaluate whether controls are operating effectively.

A poorly selected tolerable deviation rate can lead to inappropriate audit conclusions, excessive audit work, or unjustified reliance on ineffective controls.

Understanding how tolerable deviation rates work is essential for internal auditors, external auditors, and professionals responsible for evaluating internal control effectiveness.

1. What Is the Tolerable Deviation Rate?

The tolerable deviation rate is the maximum rate of deviation from a prescribed control that an auditor is willing to accept in a population while still achieving the intended audit objective.

In simpler terms: The tolerable deviation rate establishes how much control failure the auditor can accept for the intended level of reliance on the control.

Consider an organization that requires supervisory approval before vendor payments are processed.

An auditor wants to determine whether this control is operating effectively.

Management processes 10,000 vendor payments annually.

The auditor selects a sample of payments and examines whether each payment received the required approval.

Before selecting the sample, the auditor establishes a tolerable deviation rate of 5%.

This means the auditor is willing to accept a population deviation rate of no more than 5% for the planned audit objective.

However, it does not mean that finding deviations in 5% of the sample automatically supports a conclusion that the control is effective.

The auditor must consider sampling risk and the statistical upper deviation rate, when statistical sampling is used.

That distinction is critical.

2. Tolerable Deviation Rate Versus Expected Deviation Rate

Auditors must distinguish between two different concepts.

Tolerable Deviation Rate (TDR)

The maximum population deviation rate the auditor is willing to accept for the intended audit purpose.

Expected Population Deviation Rate (EPDR)

The rate of control deviations the auditor anticipates finding in the population before conducting the test.

For example:

Sampling parameter	Rate
Tolerable deviation rate	5%
Expected population deviation rate	1%
Desired confidence level	95%
Acceptable risk of overreliance	5%

The expected deviation rate influences the sample size required to obtain the desired assurance.

Generally, the closer the expected deviation rate is to the tolerable deviation rate, the larger the required sample.

If the expected deviation rate equals or exceeds the tolerable deviation rate, the auditor should reconsider whether the planned level of reliance on the control is appropriate.

Tolerable deviation is what the auditor can accept. Expected deviation is what the auditor anticipates finding.

3. Why the Tolerable Deviation Rate Matters

Tolerable deviation rates affect three important audit decisions.

First: Sample size: A lower tolerable deviation rate generally requires a larger sample, assuming other sampling parameters remain unchanged.

Second: Evaluation of sample results: The tolerable deviation rate establishes the benchmark against which the auditor evaluates the estimated population deviation rate, including sampling risk.

Third: Reliance on internal controls: If the sampling results do not support the planned level of control reliance, the auditor may need to modify the audit approach.

For external financial statement audits, this may require additional substantive procedures.

For internal audits, it may affect the assessment of control effectiveness, the severity of an identified deficiency, or recommendations to management.

The auditor should establish the tolerable deviation rate before examining the sample results.

Changing the tolerable deviation rate after discovering control failures simply to obtain a passing result undermines the credibility of the audit.

4. How Auditors Determine an Appropriate Tolerable Deviation Rate

There is no single tolerable deviation rate that applies to every audit.

The appropriate rate depends on the nature of the control, the risk being addressed, and the auditor's intended reliance.

Factors include:

The significance of the control to the audit objective.
The risk of material misstatement or other significant adverse consequences.
Whether the control addresses fraud or management override risks.
The degree of reliance the auditor intends to place on the control.
The effectiveness of other relevant controls.
The nature and consequences of potential deviations.
Applicable auditing standards and the firm's methodology.

For example, a control preventing unauthorized electronic funds transfers may warrant a much lower tolerable deviation rate than a routine administrative review.

The following rates are illustrative planning examples, not PCAOB-prescribed thresholds:

Illustrative control situation	Possible TDR
High-risk authorization control	1%
Significant financial reporting control	3%
Routine transaction approval control	5%
Lower-risk administrative control	10%

These figures should not be adopted automatically. A firm's methodology and the specific audit circumstances must support the selected rate.

In some situations, a single deviation may be sufficiently significant to require further investigation regardless of the calculated sample deviation rate.

5. Attribute Sampling and the Tolerable Deviation Rate

Attribute sampling is commonly used to test whether a particular control attribute is present or absent.

Examples include:

Was the transaction properly authorized?
Was the bank reconciliation reviewed?
Was the purchase order approved?
Was the vendor change independently verified?
Was the journal entry supported by appropriate documentation?

Each sampled item is evaluated against a defined control requirement.

For a binary attribute test, the result is generally classified as:

Compliant: The control requirement was satisfied.
Deviation: The control requirement was not satisfied.

The sample deviation rate is calculated as:

Sample Deviation Rate = Number of Deviations ÷ Sample Size × 100

For example, if an auditor tests 100 transactions and identifies three deviations:

3 ÷ 100 × 100 = 3%

However, a 3% sample deviation rate does not establish that the population deviation rate is exactly 3%.

The sample is only a portion of the population.

The auditor must account for sampling risk.

6. Understanding Sampling Risk

Sampling risk is the possibility that the auditor's conclusion based on a sample differs from the conclusion that would have been reached by examining the entire population using the same procedures.

When testing controls, one particularly important risk is the risk of assessing control risk too low, also commonly called the risk of overreliance.

This occurs when the sample results lead the auditor to conclude that a control is sufficiently effective when the actual population deviation rate exceeds the tolerable deviation rate.

For example:

An auditor establishes a tolerable deviation rate of 5%.
The sample produces a deviation rate of 3%.
The auditor concludes that the control passes because 3% is less than 5%.
That conclusion may be inappropriate.
The true population deviation rate could be higher than the observed sample rate.

Statistical attribute sampling addresses this uncertainty through an upper deviation rate calculated at the selected confidence level.

7. The Upper Deviation Rate: The Critical Evaluation Measure

The Upper Deviation Rate (UDR) is a statistical upper confidence bound for the population deviation rate.

It incorporates the observed sample results and the auditor's selected sampling risk.

Consider an auditor testing 100 transactions.

Measure	Result
Sample size	100
Deviations identified	3
Sample deviation rate	3.0%
Confidence level	95%
One-sided upper deviation rate	Approximately 7.6%
Tolerable deviation rate	5.0%

The upper deviation rate is approximately 7.6% using an exact one-sided binomial confidence calculation.

Although the observed deviation rate is only 3%, the upper confidence bound exceeds the tolerable deviation rate of 5%.

Conclusion: The sample does not provide sufficient statistical support for the planned level of reliance on the control.

This does not prove that the actual population deviation rate exceeds 5%.

It means the sample results are insufficient to support the intended conclusion at the selected confidence level.

This is one of the most important distinctions auditors must understand when evaluating attribute sampling results.

8. How Sample Size Changes the Conclusion

Assume an auditor establishes:

Tolerable deviation rate: 5%.
Confidence level: 95%.
Sampling method: Random statistical attribute sampling.
Evaluation method: Exact one-sided binomial upper confidence bound.

Consider the following illustrative results:

Sample size	Deviations	Sample rate	Upper deviation rate	Supports 5% TDR?
60	0	0.0%	4.9%	Yes
100	0	0.0%	3.0%	Yes
100	1	1.0%	4.7%	Yes
100	3	3.0%	7.6%	No
200	3	1.5%	3.8%	Yes

Figures are rounded and assume independent, representative observations under the stated binomial model. Different sampling designs and methods may produce different results.

Notice that the number of deviations alone does not determine the conclusion.

Three deviations in a sample of 100 do not support the 5% tolerable deviation rate at 95% confidence.

Three deviations in a sample of 200 do.

The larger sample provides additional information and reduces sampling uncertainty.

The auditor must evaluate the deviation rate, sample size, and sampling risk together.

9. Does Zero Deviations Mean the Control Is Perfect?

No.

Suppose an auditor tests 60 transactions and identifies no deviations.

The sample deviation rate is 0%.

However, that does not establish that the population contains no deviations.

At a 95% confidence level, the exact one-sided upper deviation rate for zero deviations in 60 independent observations is approximately 4.9%.

Therefore, the auditor may have statistical support for a 5% tolerable deviation rate, but not necessarily for a 1% tolerable deviation rate.

This illustrates why auditors should not equate a zero-deviation sample with proof that a control never fails.

Even well-designed and effectively operating controls may experience occasional deviations.

The audit objective is to obtain an appropriate level of assurance, not to claim certainty unsupported by the evidence.

10. What Happens When the Tolerable Deviation Rate Is Exceeded?

When the statistical upper deviation rate exceeds the tolerable deviation rate, the sample does not support the planned level of reliance.

The auditor should investigate the deviations and evaluate the implications.

Potential responses include:

Investigating the nature and cause of deviations: Determine whether deviations resulted from human error, system configuration problems, inadequate supervision, management override, or other causes.
Evaluating the significance of the deviations: A missing approval on a routine low-value transaction may have different implications from an unauthorized multimillion-dollar wire transfer.
Considering additional testing: Additional testing may be appropriate when justified by the audit methodology and circumstances. Simply expanding the sample until a favorable result appears is not an acceptable substitute for a properly designed sampling approach.
Reassessing control reliance: For a financial statement audit, the auditor may need to revise the assessed control risk and modify substantive procedures.

Reporting control deficiencies: For internal audit engagements, the results may support a finding requiring management attention and corrective action.

A deviation does not automatically establish fraud, but it may indicate increased exposure to fraud or error.

11. Statistical Versus Nonstatistical Sampling

Auditors may use statistical or nonstatistical approaches to test controls.

Statistical Sampling

Statistical sampling uses probability theory to select and evaluate samples.

It permits the auditor to quantify sampling risk.

For example, an auditor may calculate a 95% one-sided upper confidence bound for the population deviation rate.

Nonstatistical Sampling

Nonstatistical sampling relies on professional judgment rather than formal probability calculations to evaluate sampling risk.

The auditor still considers sample size, expected deviations, tolerable deviations, and the nature of identified exceptions.

However, the auditor does not express the sampling risk through a mathematically calculated confidence level.

Nonstatistical sampling is not an excuse to disregard sampling risk.

The auditor must still obtain sufficient appropriate evidence to support the audit conclusion.

For PCAOB engagements, AS 2315, Audit Sampling, provides relevant requirements and guidance.

12. Common Auditor Mistakes Involving Tolerable Deviation Rates

Mistake 1: Comparing Only the Sample Deviation Rate to the TDR

An auditor identifies three deviations in 100 transactions and concludes that the control passes a 5% tolerable deviation rate.

The auditor fails to account for sampling risk.

Mistake 2: Establishing the TDR After Testing

An auditor selects a tolerable deviation rate after reviewing the exceptions.

This introduces bias and may invalidate the intended sampling approach.

Mistake 3: Treating All Deviations as Equally Significant

A missing signature and an unauthorized payment may both represent deviations from a prescribed control.

However, their potential consequences may differ significantly.

Mistake 4: Ignoring the Cause of Deviations

A sample may identify several exceptions caused by the same system configuration weakness.

The common cause may indicate a broader control deficiency requiring additional evaluation.

Mistake 5: Using the Same TDR for Every Control

Different controls address different risks.

A single default tolerable deviation rate may not be appropriate for all control objectives.

Mistake 6: Assuming a Passed Sample Proves the Control Is Effective

A statistically acceptable result supports a conclusion about the population deviation rate at the selected confidence level.

It does not independently establish that the control is appropriately designed, that the test addressed the correct attribute, or that the underlying population was complete.

13. Using Artificial Intelligence in Attribute Sampling

Artificial intelligence can help auditors plan and document control testing, but its output must be validated.

Potential applications include:

Developing attribute sampling plans.
Identifying relevant control attributes.
Explaining the relationship between sample size and tolerable deviation rate.
Preparing sample selection procedures.
Analyzing exception descriptions.
Drafting control testing workpapers.
Summarizing findings and proposed management actions.

Example AI Prompt

"Develop an attribute sampling plan for testing accounts payable approvals. The population contains 10,000 transactions. The tolerable deviation rate is 5%, the expected population deviation rate is 1%, and the acceptable risk of overreliance is 5%. Identify an appropriate sample size using a specified statistical method, explain the assumptions, and provide a decision table showing how many deviations can be accepted. Include the relevant formulas and explain how the auditor should investigate deviations."

AI can assist in explaining the sampling approach and generating calculation code.

However, sample size calculations, confidence bounds, and acceptance numbers should be independently verified using a validated statistical method.

AI-generated calculations should not become audit evidence merely because they are presented in a professional-looking table.

14. What Should the Audit Workpaper Document?

A properly prepared attribute sampling workpaper should ordinarily include:

Workpaper element	Documentation
Audit objective	Control being evaluated and risk addressed
Population	Population definition, period, size, and completeness
Sampling unit	Individual transaction or other unit selected
Control attribute	Specific evidence required to establish compliance
Sampling method	Statistical or nonstatistical approach
Tolerable deviation rate	Selected rate and supporting rationale
Expected deviation rate	Planning assumption and basis
Sampling risk	Selected confidence level or other evaluation approach
Sample size	Number of items and supporting determination
Sample selection	Method used to select the sample
Testing results	Deviations and supporting workpaper references
Evaluation	Sample deviation rate and sampling risk assessment
Conclusion	Implications for control reliance and further procedures

The documentation should allow an experienced auditor to understand the procedures performed, evidence obtained, and conclusions reached.

For PCAOB audits, AS 1215, Audit Documentation, establishes the applicable documentation requirements.

15. Final Thoughts: Tolerable Deviation Rate Is a Risk-Based Audit Decision

The tolerable deviation rate is more than a percentage entered into a sampling worksheet.

It represents an important audit judgment about the level of control failure that can be accepted for a particular audit objective.

Auditors must understand the relationship among:

Tolerable Deviation Rate → Expected Deviation Rate → Sample Size → Observed Deviations → Sampling Risk → Audit Conclusion

The most common mistake is assuming that a sample deviation rate below the tolerable deviation rate automatically demonstrates that the control is operating effectively.

That is not necessarily true.

The auditor must consider sampling risk, evaluate the nature and cause of deviations, and determine whether the evidence supports the intended level of reliance.

The objective of attribute sampling is not to find a sample that passes. It is to obtain sufficient appropriate evidence to support a defensible audit conclusion.

About Corporate Compliance Seminars

Corporate Compliance Seminars (CCS) provides Continuing Professional Education (CPE) programs for internal auditors, external auditors, accounting professionals, compliance professionals, and information technology professionals.

Our training covers PCAOB auditing standards, audit sampling, risk assessment, internal controls, audit evidence, fraud detection, and practical applications of artificial intelligence in auditing.

Explore upcoming training events at www.compliance-seminars.com.