Sampling in control testing is the process of selecting and examining a subset of items or transactions from a large population to evaluate the effectiveness of an internal control. Instead of testing every single transaction, auditors use sampling to gather sufficient evidence to conclude whether controls are operating as intended.
Why Use Sampling for Internal Controls?
Testing 100% of transactions or activities subject to a control can be impractical, time-consuming, and costly, especially for controls that operate frequently. Sampling allows auditors to draw conclusions about the entire population of control activities based on the results from a representative sample. This makes the audit process more efficient while still providing a reasonable basis for assessing the control's effectiveness.
The Type of Sampling Used: Attribute Sampling
According to professional standards and common practice, the primary type of sampling used specifically for testing internal controls is attribute sampling.
- Attribute sampling is focused on identifying the presence or absence of a specific characteristic (or attribute) within a sample.
- In control testing, this "characteristic" is typically evidence that a control was performed correctly.
As stated in the reference: "Attribute sampling will be used primarily for testing internal controls. Attribute sampling will test for seeking specific characteristics."
How Attribute Sampling Works in Control Testing
The process of using attribute sampling for control testing generally involves:
- Defining the Control and the Population: Clearly identify the specific control being tested (e.g., requirement for manager approval on purchases over $500) and the population it applies to (e.g., all purchase requisitions over $500 during the audit period).
- Defining the Attribute: Specify the characteristic that indicates the control was performed effectively (e.g., presence of a manager's signature/electronic approval).
- Defining the Deviation: Clearly define what constitutes a failure or deviation from the control (e.g., a purchase requisition over $500 without a manager's signature).
- Determining Sample Size: Using statistical or non-statistical methods, determine the appropriate number of items to test based on factors like the desired confidence level, the tolerable deviation rate (the maximum rate of control failures the auditor is willing to accept), and the expected deviation rate.
- Selecting the Sample: Choose the specific items to test from the population using a method that ensures randomness and represents the population (e.g., random number generation, systematic selection).
- Performing the Test: Examine each item in the sample for the defined attribute. Note any deviations found.
- Evaluating the Results: Based on the number of deviations found in the sample, the auditor projects the results to the entire population to estimate the likely rate of control failure. This helps the auditor conclude whether the control is operating effectively.
Examples of Attribute Sampling in Control Testing
Here are a few practical examples:
- Testing the authorization of payments: Sample a selection of outgoing payment transactions and check if each transaction has the required level of approval documented. The attribute is the presence of the authorized signature or electronic approval.
- Testing the matching of documents: Sample purchase transactions and check if the purchase order, receiving report, and vendor invoice are all present and match before payment is processed. The attribute is the complete and matched set of documents.
- Testing account reconciliation reviews: Sample bank reconciliations and check if they were reviewed and signed by a supervisor in a timely manner. The attribute is the supervisor's signature and review date.
Attribute vs. Variable Sampling
It's important to distinguish attribute sampling from other types of sampling used in auditing. As the reference notes, "The other type of sampling is variable sampling, which is used for substantive testing."
- Attribute Sampling: Tests for characteristics or qualities (e.g., Was the control performed? Yes/No?). Used primarily for tests of controls.
- Variable Sampling: Tests for monetary amounts or quantities (e.g., Is the balance of accounts receivable fairly stated?). Used primarily for substantive testing of account balances and transactions.
In summary, sampling in control testing specifically utilizes attribute sampling to assess the effectiveness of internal controls by checking for the presence or absence of predefined characteristics that indicate the control was performed correctly.
