How Does Attribute Sampling Work?

By Maire Loughran from Auditing For Dummies

Auditors choose from several types of sampling when performing an audit. Attribute sampling means that an item being sampled either will or won’t possess certain qualities, or attributes. An auditor selects a certain number of records to estimate how many times a certain feature will show up in a population. When using attribute sampling, the sampling unit is a single record or document. Auditors typically use attribute sampling to test internal controls.

An example of an attribute sampling feature may be that per the client’s internal control procedures, all purchases over $50 are supposed to be authorized by a purchase order. So every purchase over $50 either will or won’t be authorized by a purchase order — attribute sampling has no gray area.

Here’s how you’d use attribute sampling to see whether the client’s internal control is working properly: Your population consists of all vendor invoices for purchases over $50, and the number of records you sample from that population is set at 75 records. Looking through your sample, you see that 3 of the 75 records aren’t supported by a purchase order. That gives you a population error rate of 4 percent (3/75).

How do you decide if this population error rate is okay? That decision is based on what figures you set for tolerable error, expected error, sampling risk, and confidence level.

For example, let’s say that

The tolerable error rate is 7 percent.
The expected error rate is 5 percent.
The sampling risk is 2 percent.
The confidence level is 98 percent. (Remember that the confidence level plus the sampling risk always equal 100 percent.)
The population error rate is 4 percent (which we just figured out).

The next question is, what do you do with this information? First, remember that you’re looking at a sample of only 75 vendor invoices, not the entire population. Even though the 4 percent population error rate is less than the tolerable error rate of 7 percent, you can’t just use this fact to prove that your sample is sufficient.

When using attribute sampling, to make sure your sample is representative of the whole, you have to add the sampling risk of 2 percent to the 4 percent population error rate. These two figures combined are referred to as the computed upper deviation rate.

So the computed upper deviation rate is 6 percent (2 percent plus 4 percent). That’s good news for you, because it’s below the tolerable error rate of 7 percent. This fact means that you can rely on the purchase order internal control. What’s the big deal about this? Well, when you start your testing of account balances, you rely on this internal control to limit your testing of the purchases account balance.

Suppose the sample size was 50 instead of 75. Your population error rate would change to 6 percent (3/50), making your computed upper deviation rate equal to 8 percent. That’s over the tolerable error rate of 7 percent. Therefore, you must conclude that the purchase order internal controls aren’t operating at an acceptable level. So rather than decreasing your purchases account balance testing, you’d need to increase it. You could also increase your sample, redo your calculations, and see if a larger sample size brings the computed upper deviation rate back down to under the tolerable error rate of 7 percent. Your firm will have field procedures in place to guide you in choosing between the two options.