AUD, Auditing and Attestation

Sources for Audit Sampling

Last reviewed 2026-09-14

The standards and authorities behind PocketCPA's AUD lessons on Audit Sampling. The topic rests on AU-C 530.

About this topic

An auditor rarely examines every transaction in a population. It examines some of them and reasons about the rest, and this topic covers how that is done defensibly.

Audit sampling applies a procedure to less than 100 percent of a population so that every item has a chance of selection. That lets the auditor draw a conclusion about the whole population. Two risks come with it, and only one of them responds to a bigger sample.

Key points

• Audit sampling applies a procedure to less than 100% of items and projects results to the entire population.
• Sampling risk is the risk that the sample conclusion differs from the conclusion reached by testing the entire population.
• Statistical sampling uses random selection and probability theory to measure sampling risk; nonstatistical does not.
• The two key risks: overreliance (assessing control risk too low) and incorrect acceptance (accepting a misstated balance).

What the lessons cover

1. Statistical versus nonstatistical sampling
2. Attributes sampling for tests of controls
3. Variables sampling for substantive tests
4. Choosing the method against the objective
5. Projecting sample results: the four computations
6. Deviations, misstatements, and items the auditor cannot examine
7. Where audit sampling does not reach
8. Dual-purpose samples
9. Documenting the sampling application
10. AU-C 530 against PCAOB AS 2315

Authoritative references

Where these requirements sit in the literature.

• AU-C 530.05 defines tolerable misstatement as the maximum misstatement in a population the auditor is willing to accept, being the application of performance materiality to a particular sampling procedure and set at an amount at or below performance materiality. It also carries the two aspects of sampling risk in a substantive test, the risk of incorrect acceptance and the risk of incorrect rejection, against nonsampling risk, the risk of an erroneous conclusion for reasons unrelated to sample size.
• AU-C 530.07 carries the factors influencing sample size for a test of controls and their direction: inverse to the tolerable rate of deviation and to the acceptable risk of assessing control risk too low, direct to the expected population deviation rate and to the required confidence level.
• AU-C 530.14 and AU-C 530.14 carry the reliance decision: compare the upper deviation rate, the sample deviation rate plus an allowance for sampling risk, against the tolerable rate of deviation. An upper rate that does not exceed the tolerable rate supports the planned reliance; one that exceeds it does not.
• AU-C 530.14b carries the proximity rule on the substantive side. The closer projected misstatement is to tolerable misstatement, the greater the risk that actual misstatement exceeds tolerable, and the auditor should treat the sample as possibly not providing a reasonable basis for the conclusion and perform further procedures or request correction.
• The application guidance to AU-C 530 carries the projection mechanics: the tainting percentage times the sampling interval for a logical unit below the interval, the actual misstatement for an individually significant item at or above it, and the difference and ratio estimators for classical variables sampling.
• AU-C 530 at standard level carries the rest:
  • the two defining characteristics of statistical sampling.
  • the equal acceptability of both approaches.
  • the requirement that all sampling units have a chance of selection so results can be projected.
  • attributes sampling as the method for tests of controls.
  • monetary unit sampling's strengths and weaknesses.
  • the treatment of an item the auditor cannot examine, along with replacement, and why GAAS has no anomaly.
  • the content of the sampling documentation.
• AS 2315.09 through .14 carry the risk architecture.
  • Audit risk splits into sampling and nonsampling risk.
  • Sampling risk varies inversely with sample size.
  • Nonsampling risk includes inappropriate procedures and misstatements missed in documents examined, and is reduced through planning, supervision and firm-level quality.
  • The four aspects of sampling risk sort into the two that bear on efficiency (.13) and the two that bear on effectiveness (.14).
• AS 2315.16 through .23A carry planning a substantive sample.
  • the four planning considerations.
  • tolerable misstatement and its determination for a partial population.
  • the inverse relationship between the allowable risk of incorrect acceptance and sample size.
  • items excluded from sampling because they are examined 100 percent.
  • stratification.
  • the three sample-size determinants.
  • the comparability of nonstatistical to statistical sample sizes.
  • AS 2315.17 additionally requires the population to fit the objective and names subsequent cash disbursements and shipping documents as the sources for understatement testing.
• AS 2315.24 through .30 carry selection, performance and evaluation for substantive samples.
  • Representativeness and the opportunity for every item to be selected, with footnote 4 listing random-based methods including sampling with probability proportional to size.
  • The graduated treatment of unexamined items and the wider implications to evaluate.
  • The projection requirement, the addition of misstatements from items examined 100 percent, the comparison with tolerable misstatement and the worked 60,000 illustration.
  • The qualitative aspects.
  • Revision of planning assumptions.
  • Aggregation with other evidence and other sampling applications.
• AS 2315.31 through .43 carry tests of controls.
  • The four planning considerations.
  • Where sampling does not apply, including segregation-of-duties controls and obtaining the understanding of internal control, with footnote 7's concurrent-testing exception.
  • The tolerable rate and its 5 percent and 10 percent illustrations.
  • Deviations not necessarily producing misstatements.
  • A combination of controls treated as one procedure.
  • The risk of assessing control risk too low, with footnote 9's 5 to 10 percent range.
  • The sample-size factors.
  • Treating an unexaminable item as a deviation.
  • The deviation rate as the best estimate of the population rate, with its 60-item illustration.
  • The qualitative aspects.
  • Re-evaluating substantive procedures when the sample does not support the planned control risk.
• AS 2315.44 through .46 carry dual-purpose samples, sized at the larger of the two and evaluated separately, and the choice of approach, with .46 naming what statistical sampling buys and what it costs.
• AS 1105.22 through .28 carry the three means of selecting items for testing: selecting all items, selecting specific items, and audit sampling. AS 1105.27 is the paragraph to cite for the proposition that testing specific items is not audit sampling and its results cannot be projected.
• AS 1215.10 carries documentation of the items inspected, with separate content requirements for an audit sample (identifying characteristics such as check numbers), a threshold selection (scope and population identification only), and a systematic sample (source, starting point and interval).
• AS 2105.08 and .09 carry the PCAOB determination of tolerable misstatement at the account or disclosure level, below financial-statement materiality, taking into account the nature, cause and amount of misstatements accumulated in prior-period audits.
• AS 2301.47, with the definition at AS 2301.A2, carries the dual-purpose test: design it to achieve both objectives and evaluate the results in forming conclusions about both the assertion and the effectiveness of the control.
• AS 2810.10, .12 and .14 carry the destination of a sample's output.
  • Accumulate all misstatements other than the clearly trivial.
  • Include projected misstatements from sampling in that accumulation, rather than only those specifically identified.
  • Reconsider the audit strategy and plan as the accumulation approaches the materiality level.

How PocketCPA uses these sources

Every lesson is written in original words and cites the paragraph each rule comes from. No standard's text is reproduced. How lessons and questions are written and checked is set out in our methodology.

See also

• Sources for every AUD topic
• Free AUD sample questions
• The CPA exam glossary