Audit Sampling Concepts Importance of Sampling Auditor does

Audit Sampling Concepts

Importance of Sampling • Auditor does not look at everything • How does this affect the opinion? • Auditor CANNOT look at everything • Why? 2

Introduction to Audit Sampling Audit sampling is: • The application of an audit procedure to less than 100 percent of the items within an account balance population or class of transactions. • For the purpose of evaluating some characteristic of the balance or class. Audit procedure Account balance Class of transactions 3

Purpose of Sampling • The auditor examines only a portion of the population in order to estimate • How much is a portion? 4

Risk and Materiality Risk and materiality form the basis for determining the extent of procedures to be undertaken. • Extent • Materiality is related to sampling precision • Risk is related to confidence from sampling 5

6

When to Do Sampling • When? 1. The nature and materiality of the balance or class of transactions does not demand a 100% audit 2. A decision must be made about the balance or class of transactions. 3. The time and cost to audit 100% of the population would be too great 7

When is Sampling Used? • To conduct: • For tests of controls • Tests of details 8

Inclusions and Exclusions Related to Audit Sampling involves looking at part of a population in order to reach a conclusion on the entire population. • Sampling would not include: • 100% audit • a walk-through 9

Representative Sampling • Having a representative sample is important • What does representative mean? 10

Sampling and Non-Sampling Risk Sampling risk: • The probability that an auditor’s conclusion based on a sample might be different from the conclusion based on an audit of the entire population. • Beta risk or risk of incorrect acceptance (RIA) • Alpha risk or risk of incorrect rejection (RIR). Auditors are primarily concerned with Beta risk. 11

• Non-sampling risk: • The risk of auditor error that arises from the possibility that the auditor • Failure to detect a misstatement 12

Statistical Sampling • Uses the laws of probability for selecting and evaluating a sample from a population • Selected at random • Random sample: • Statistical calculations are used 13

Nonstatistical (Judgmental) Sampling Non-statistical sampling is audit sampling in which auditors do not utilize statistical calculations to express the results. 14

Statistical vs. Non-Statistical • Similarities • Both require a structured process • Differences • Sampling risk cannot be quantified • The use of stratification 15

Non-Probabilistic Sample Selection Methods • Directed sample selection • When used? • Auditor often able to identify items likely to contain errors • Items containing selected characteristics • Large dollar item coverage 16

• Block sample selection • a selection of several items in a sequence • Reasonable number of blocks must be chosen • Haphazard sample selection • Auditor goes through the population and haphazardly selects items 17

Probabilistic Sample Selection Methods • Sampling risk requires • Simple random sample selection • Every member of the population has an equal chance of being selected • Systematic sample selection or systematic sampling • Auditor calculates an interval and use the interval to select sample 18

• Major problem with systematic sampling is bias • Once the first item is chosen • No problem if • But some characteristics 19

Attribute Sampling Methodology • Another key statistical methodology • very useful for tests of controls • look in the population for a particular attribute or characteristic • The main question to be answered is • If the auditor can allow 5% deviations 20

Probability Proportionate-to-Size Sampling Methodology • A key statistical methodology • Also known as • The sampling unit is • MUS allows the result to be stated 21

Advantages of Statistical Sampling • Provides: • for quantitative evaluation of the sample results • a more defensible expression of the test results • It is more objective 22

Disadvantages of Statistical Sampling • Requires random sample selection which may be more costly and time consuming. • Might require additional training costs for staff members to use statistics or specialized software 23

Advantages of non-statistical sampling • Allows the auditor to inject his or her subjective judgment in determining the sample size • May be designed so that it is equally effective and efficient as statistical sampling while being less costly 24

Disadvantages of non-statistical sampling • Cannot draw objectively valid statistical inferences from the sample results • Cannot quantitatively measure and express sampling risk. 25

The Main Phases of the Sampling Process • Both statistical and non-statistical methods 1. 2. 3. 4. Planning the sample Selecting the sample Performing the tests Evaluating the results 26

Sampling Process • Fourteen steps in the sampling process. • Look at tests of controls versus tests of details 27

1. State the Objectives of the Test • Test of control: • Are the controls working as specified? • Are there monetary errors or fraud or other irregularities • Test of detail: • Auditor wants to determine the maximum amount of overstatement and understatement that could exist based on the sample 28

2. Decide if Audit Sampling Applies • Test of control: • some controls can be sampled • Test of detail: • sampling test of details depends on the nature of the population • others cannot be • high volume can be 29

3. Define attributes and exception or error conditions Planning term: Test of control Test of detail Define the item of interest Identify the characteristic or attribute of interest Individual dollars Define exceptions or errors Define the control deviation or exception Normally, any monetary difference or error 30

4. Define the population • Population can be defined in a way to suit the audit tests • Must sample from the entire population as defined • In testing controls over sales, what is the population? • In testing details in accounts receivable it is the recorded dollar population • Most populations can be stratified, if needed. 31

5. Define the sampling unit • Tests of control: • Usually a physical unit • Test of detail: • If MUS • If non-statistical sampling 32

6. Specify tolerable deviation rate (TDR) or specify materiality • Test of control: • TDR (Also TER) • Test of detail: • Materiality is used • As TDR increases • These decisions require the use of 33

7. Specify RIA • Test of control: • What is RIA? Also called RACR or ARACR. • Test of detail: • What is RIA (ARIA)? • Risk of Incorrect Acceptance • Risk of Assessing Control Risk Too Low 34

• Test of control: • Assume • TDR 6% • Test of detail: • If RIA changes from 10% to 5% • since assurance required increases • RIA 10% • When controls are good • But unknown to the auditor the true error rate is 8% 35

8. Estimate population exception rate or misstatements • Test of control: • Estimated population deviation rate (EPDR or EPER) • Test of detail: • Provide an advance estimate of the total dollar error, i. e. misstatements, in the population • The lower the EPDR, the smaller the sample size 36

9. Determine the initial sample size • For non-statistical or judgmental sampling, professional judgment is used to calculate the sample size • For statistical sampling, mathematical formulae are used, either in specially prepared tables or using software designed for audit sampling • For stratified sampling, the sample is allocated among the strata 37

10. Select the sample • Using the number of items determined in Step #9, choose the items from the population using the sampling unit defined in Step #5 • Use probabilistic or non-probabilistic methods • To enable quantification of sampling risk, probabilistic, i. e. statistical, methods must be used 38

11. Perform the audit procedures • For test of controls, examine each item for the attribute defined in Step #3, recording all exceptions found • For test of details, apply the audit procedures designed in the audit program 39

12. Generalize from the sample to the population • Test of controls sample error rate (SER) • But that is not necessarily equal to the actual population rate • In practice, auditors tend to test controls when they expect no exceptions • But ultimately, the method of generalization depends on the sampling methodology used 40

• When generalizing tests of details, auditors deal with • Misstatements found are projected from the sample results to the population • Auditor must calculate a point estimate 41

• To calculate the point estimate: • (Client Misstatement / Recorded Value of Sample) x Recorded Book Value of the Population • Thus for a misstatement of $500 in A/R with a sample value of $10, 000 and a total book value of $25, 000 • Note that if the population is divided into strata • The total point estimate may not be an adequate result for the population • The auditor must consider this fact 42

Calculating Point Estimate for a population Example of Errors Found Dollars Audited Stratum Sample Size Book Value of Stratum Recorded Value Audited Value Client Misstatement 1 3 $88, 955 $91, 695 $(2, 740) 2 6 71, 235 43, 995 43, 024 971 3 6 47, 105 13, 105 10, 947 2, 158 Total 15 $207, 295 $146, 055 $145, 666 $389 Example of Point Estimate Calculation Stratum Client Misstatement / Recorded Value from Sample 1 $(2, 740)/$88, 955 2 3 Total x Recorded Book Value for Stratum = Point Estimate of Misstatement $88, 955 $(2, 470) 971/43, 995 71, 235 1, 572 2, 158/13, 105 47, 105 7, 757 $6, 589 43

13. Analyze exceptions or misstatements • Test of control • Test of detail • What breakdown in internal controls caused the exceptions? • Were the misstatements caused by control exceptions? • Should additional substantive testing be conducted because of these results? • Is additional substantive testing required? 44

14. Decide the acceptability of the population • Test of control • If TER is sufficiently larger than SER • If TER – SER is too small • Test of detail • Compare the difference between the projection to the population • If projection is greater than materiality level 45

• What if the auditor decides the population is NOT acceptable? What to do? • 1. Revise TER (tolerable error rate), ARACR, or ARIA (the risks of accepting incorrect populations) • 2. Expand the sample size. • 3. Revise assessed control risk. • 4. Report weaknesses in management letter. 46

Problem 1 • • For the examination of the financial statements of Scotia Inc. , Rosa Schellenberg, a public accountant, has decided to apply non-statistical audit sampling in the tests of sales transactions. Based on her knowledge of Scotia’s operations in the area of sales, she decides that the estimated population deviation rate is likely to be 3 percent and that she is willing to accept a 5 percent risk the true population rate is not greater than 6 percent. Given this information, Rosa selects a random sample of 150 sales invoices from the 5, 000 prepared during the year and examines them for exceptions. She notes the following exceptions in her working papers. There is no other documentation. REQUIRED a. Which of the invoices in the table should be defined as an exception? b. Explain why it is inappropriate to set a single acceptable TER and EPER for the combined exceptions. c. State the appropriate analysis of exceptions for each of the exceptions in the sample. Invoice No: Comment 5028 Sales invoice had incorrect price, but a subsequent credit was sent out as a correction. 6791 Voided sales invoice examined by auditor. 6810 Shipping document for a sale of merchandise could not be located. 7364 Sales invoice for $2, 875 has not been collected and is six months past due. 7625 Client unable to locate the printed duplicate copy of the sales invoice. 8431 Invoice was dated three days later than the date of the shipping document. 8528 Customer purchase order is not attached to the duplicate sales invoice. 8566 Billing is for $100 less than it should be due to a pricing error. 8780 Client unable to locate the printed duplicate copy of the sales invoice. 9169 Credit is not authorized, but the sale was only for $7. 65. 47

Problem 2 You have been asked to do planning for statistical testing of the audit of cash receipts. Following is a partial audit program for the audit of cash receipts. 1. Review the cash receipts journal for large and unusual transactions. 2. Trace entries from the prelisting of cash receipts to the cash receipts journal to determine whether each is recorded. 3. Compare customer name, date, and amount on the prelisting with the cash receipts journal. 4. Examine the related remittance advice for entries selected from the prelisting to determine whether cash discounts were approved. 5. Trace entries from the prelisting to the deposit slip to determine whether each has been deposited. REQUIRED a. Identify which audit procedures can be tested using attribute sampling. Justify your response. b. State the appropriate sampling unit for each of the tests in part (a). c. Define the attributes that you would test for each of the tests in part (a). State the audit object associated with each of the attributes. d. Define exception conditions for each of the attributes that you have described in part (c). e. Which of the exceptions would be indicative of potential fraud? Justify your response. 48

Problem 3 – Attribute Sampling Lenter Supply Corp. is a medium sized distributor of wholesale hardware supplies in southern Manitoba. It has been a client of yours for several years and has instituted excellent internal control for the control of sales, at your recommendation. In providing control over shipments, the client has prenumbered “warehouse removal slips” that are used for every sale. It is company policy never to remove goods from the warehouse without an authorized warehouse removal slip. After shipment, two copies of the warehouse removal slip are sent to billing for the computerized preparation of a sales invoice. One copy is stapled to the duplicate copy of the prenumbered sales invoice, and the other copy is filed numerically. In some cases more than one warehouse removal slip is used for billing one sales invoice. The smallest warehouse removal slip number for the year is 14682 and the largest is 37521. The smallest invoice number is 47821 and the largest is 68507. In the audit of sales, one of the major concerns is the effectiveness of the control in making sure all shipments are billed. The auditor has decided to use attribute sampling in testing internal control. 49

(a) State an effective audit procedure for testing whether shipments have been billed. What is the sampling unit for the audit procedure? (b) Assuming the auditor expects no deviations in the sample but is willing to accept a TDR of 3%, at a 10% RIA, what is the appropriate sample size? 50

Calculating Sample Size – CAS 530 • R = n. P • R is the PPS Factor determiner from a PPS table. • n is the sample size • P is the precision or Tolerable Deviation Rate • The auditor also needs to know the Expected Population Deviation Rate (EPDR) • Usually obtained from last years audit sampling results • Use an EPDR of 0. i. e. the auditor expects no deviations 51

R Value Table Number of Errors R @ 90% R @ 95% R @ 97. 5% 0 2. 31 3. 00 3. 69 1 3. 89 4. 75 5. 58 2 5. 33 6. 30 7. 23 3 6. 69 7. 76 8. 77 4 8. 00 9. 16 10. 25 5 9. 28 10. 52 11. 67 6 10. 54 11. 85 13. 06 7 11. 78 13. 15 14. 43 8 13. 00 14. 44 15. 77 9 14. 21 15. 71 17. 09 10 15. 41 16. 97 18. 40 52

• Given a confidence level of 90% and TDR of 3% • With and EPDR of 0, R = 2. 31 • Thus n = R/P = 2. 31/0. 03 = 77. 53

The following table is from the text, Appendix 10 A. TABLE FOR DETERMINING SAMPLE SIZE FOR TEST OF CONTROL USING THE MUS APPROACH TOLERABLE RATE OF DEVIATIONS FOR ERRORS 0. 01 0. 02 0. 03 0. 04 0. 05 0. 06 0. 07 0. 08 0. 09 0. 10 0. 15 0. 20 Beta Risk = 0. 05 300 150 100 75 60 50 43 38 34 30 20 15 Beta Risk = 0. 10 231 116 77 58 47 39 33 29 26 24 16 12 Beta risk or risk of incorrect acceptance. The risk of accepting an account as materially accurate when it is in fact materially misstated. More audit work would actually be needed and it is not performed. Alpha risk or risk of incorrect rejection. The risk of rejecting an account as materially accurate when it is in fact not materially misstated. This would require more audit work when it is really not needed. 54

EXPECTED POPULATION DEVIATION RATE (IN PERCENTAGE) 2 3 TOLERABLE DEVIATION RATE (IN PERCENTAGE) 4 5 6 7 8 9 10 15 20 5 % Risk of Incorrect Acceptance(RIA or Beta Risk) 0. 00 0. 25 0. 50 0. 75 1. 00 1. 25 1. 50 1. 75 2. 00 2. 25 2. 50 2. 75 3. 00 3. 25 3. 50 3. 75 4. 00 5. 00 6. 00 7. 00 149 236 . . . . 99 157 208 . . . . 74 117 117 156 192 227 . . . 59 93 93 124 153 181 208 . . 49 78 78 78 103 127 150 173 195 . . . . 42 66 66 66 88 88 88 109 129 148 167 185 . . 36 58 58 58 77 77 95 95 112 129 146 . . . 32 51 51 68 68 84 84 84 100 158 . . 29 46 46 61 61 61 76 76 89 116 179 . 19 30 30 30 30 40 40 50 68 14 22 22 22 22 30 30 37 55

EPDR 0. 00 0. 25 0. 50 0. 75 1. 00 1. 25 1. 50 1. 75 2. 00 2. 25 2. 50 2. 75 3. 00 3. 25 3. 50 3. 75 4. 00 4. 50 5. 00 5. 50 6. 00 7. 50 8. 00 8. 50 2 3 4 5 6 7 8 9 10 15 20 10 % Risk of Incorrect Acceptance (RIA or Beta Risk) 114 194 265 . . 76 129 129 176 221 . . 57 96 96 132 166 198 . . . . 45 77 77 77 105 132 158 209 . . . 38 64 64 64 88 88 88 110 132 153 194 . . 32 55 55 75 75 75 94 94 113 131 149 218 . . . . 28 48 48 65 65 82 82 98 98 130 160 . . . 25 42 42 42 58 58 73 73 73 87 115 142 182 . . 22 38 38 38 52 52 52 65 65 78 103 116 199 . . . 15 25 25 25 25 34 34 34 45 52 52 60 68 11 18 18 18 18 18 25 25 32 56

Effect of population size -Initial sample size only -Possible to make adjustment to initial sample size based on overall population size -Finite correction factor n = n’ 1 + n’/N n = revised sample size n’ = initial sample size N = population size 57

From the problem 12 -24 Population is n’ = Thus revised sample size is 58

c) Use of a random number table • A one-to-one correspondence between warehouse removal slip • How is this correspondence achieved? 59

Random Stab Random Number Table 37039 97547 64673 31546 99314 66854 97855 25145 84834 23009 51584 66754 77785 52357 98433 54725 18864 65866 76918 78825 58210 97965 68548 81545 82933 93545 85959 63282 78049 67830 14624 17563 25697 07734 48243 50203 25658 91478 08509 23308 48130 65047 40059 67825 18934 64998 49807 71126 77818 84350 67241 54031 34535 04093 35062 58163 30954 51637 91500 48722 60988 60029 60873 86723 36464 98305 08009 00666 29255 18514 50188 22554 86160 92250 14021 65859 16237 50014 00463 13906 35936 71761 95755 87002 66023 21428 14742 94874 23308 58533 26507 04458 61862 63119 09541 01715 87901 91260 57510 36314 30452 09712 37714 95482 30507 43373 58939 95848 28288 60341 52174 11879 61500 12763 64433 02268 57905 72347 49498 78938 71312 99705 71546 42274 23915 38405 64257 93218 35793 43671 64055 88729 11168 56864 21554 70445 24841 04779 56774 96129 35314 29631 06937 54545 04470 75463 77112 40704 48823 65963 39359 12717 56201 22811 07318 44623 02843 33299 59872 86774 06926 94550 23299 45557 07923 75126 00808 01312 34348 81191 21027 77087 10909 03676 97723 92277 57115 50789 68111 75305 53289 39751 56093 58302 52236 65756 50273 61566 61962 16623 17849 96701 94971 94758 08845 32260 50848 93982 66451 32143 05441 10399 17775 48006 58200 58367 66577 68583 21108 41361 56640 27890 28825 96509 21363 53657 60119 60

Upper Exception Limit (UEL) • • Sample size = TER = RIA = Number of deviations = • Using the following tables: • UEL = • Are the controls working? 61

ACTUAL NUMBER OF DEVIATIONS FOUND SAMPLE SIZE 0 1 2 3 4 5 6 7 8 9 10 5 % Risk of Incorrect Acceptance( RIA or Beta Risk) 25 30 35 40 45 50 55 60 65 70 75 80 90 100 125 150 200 11. 3 9. 5 8. 2 7. 2 6. 4 5. 8 5. 3 4. 9 4. 5 4. 2 3. 9 3. 7 3. 3 3. 0 2. 4 2. 0 1. 5 17. 6 14. 9 12. 9 11. 3 10. 1 9. 1 8. 3 7. 7 7. 1 6. 6 6. 2 5. 8 5. 2 4. 7 3. 1 2. 3 . 19. 5 16. 9 14. 9 13. 3 12. 1 11. 0 10. 1 9. 4 8. 7 8. 2 7. 7 6. 8 6. 2 4. 9 4. 1 3. 1 . . . 18. 3 16. 3 14. 8 13. 5 12. 4 11. 5 10. 7 10. 0 9. 4 8. 4 7. 6 6. 1 5. 1 3. 8 . . 19. 2 17. 4 15. 9 14. 6 13. 5 12. 6 11. 8 11. 1 9. 9 8. 9 7. 2 6. 0 4. 5 . . . 19. 9 18. 1 16. 7 15. 5 14. 4 13. 5 12. 7 11. 3 10. 2 8. 2 6. 9 5. 2 . . . . 18. 8 17. 4 16. 2 15. 2 14. 3 12. 7 11. 5 9. 3 7. 7 5. 8 . . . . 19. 3 18. 0 16. 9 15. 8 14. 1 12. 7 10. 3 8. 6 6. 5 . . 19. 7 18. 4 17. 3 15. 5 14. 0 11. 3 9. 4 7. 1 . . 20. 0 18. 8 16. 8 15. 2 12. 2 10. 2 7. 7 . . . 18. 1 16. 4 13. 2 11. 0 8. 3 62

Sample size ACTUAL NUMBER OF DEVIATIONS FOUND 0 1 2 3 4 5 6 7 8 9 10 10 % Risk of Incorrect Acceptance (RIA or Beta Risk) 20 25 30 35 40 45 50 55 60 70 80 90 100 120 160 200 10. 9 8. 8 7. 4 6. 4 5. 6 5. 0 4. 5 4. 1 3. 8 3. 2 2. 8 2. 5 2. 3 1. 9 1. 4 1. 1 18. 1 14. 7 12. 4 10. 7 9. 4 8. 4 7. 6 6. 9 6. 3 5. 4 4. 8 4. 3 3. 8 3. 2 2. 4 1. 9 . 19. 9 16. 8 14. 5 12. 8 11. 4 10. 3 9. 4 8. 6 7. 4 6. 5 5. 8 5. 2 4. 4 3. 3 2. 6 . . . 18. 1 15. 9 14. 2 12. 9 11. 7 10. 8 9. 3 8. 3 7. 3 6. 6 5. 5 4. 1 3. 3 . . 19. 0 17. 0 15. 4 14. 0 12. 9 11. 1 9. 7 8. 7 7. 8 6. 6 4. 9 4. 0 . . . 19. 6 17. 8 16. 2 14. 9 12. 8 11. 3 10. 1 9. 1 7. 6 5. 7 4. 6 . . . . 18. 4 16. 9 14. 6 12. 8 11. 4 10. 3 8. 6 6. 5 5. 2 . . . . 18. 8 16. 2 14. 3 12. 7 11. 5 9. 6 7. 2 5. 8 . . . . 17. 9 15. 7 14. 0 12. 7 10. 6 8. 0 6. 4 19. 5 17. 2 15. 3 13. 8 11. 6 8. 7 7. 0 . . 18. 6 16. 6 15. 0 12. 5 9. 5 7. 6 63