How to Create the Appropriate Audit Sample
Following are the sampling steps to test internal controls. You start by determining the objective of the control and end with identifying the method you use to select your test sample. Of course, you also have to document in writing your professional opinion regarding the effectiveness of the control.
Eight steps are involved in audit sampling for tests of controls. The following steps use the example of the customer billing process:
Look at your audit objectives.
The objective of tests of controls is to provide yourself with evidence about whether controls are operating effectively. For example, suppose the audit objective of a test (focusing on customer billing) is to find out whether client invoices are correct.
Audit objectives vary between accounts and the purpose of your procedure. Your audit supervisor can provide you with more guidance about what the firm considers to be proper audit objectives in each particular circumstance. Workpapers of a continuing client provide guidance as well.
Describe the control activity.
The control activity is the policy or procedure management uses to provide assurance that material misstatements will be prevented or detected in a timely fashion. For example, your control activity is that the price per unit on the client invoice agrees with the client's standard price list.
Also, the control activity ensures that the expanded line item totals mathematically agree with the number of each unit ordered times the cost per unit. For example, if the customer orders 135 widgets and the cost per widget is $5, the expanded total is 135 x $5 = $675. If all facts reconcile without discrepancy to the records, note your assessment in your workpapers.
Define the population.
Decide on the appropriate sampling unit. A sampling unit can be a record, an entry, or a line item. The sampling unit varies based on what internal control you're sampling and testing. In this case your sampling unit is the client invoice. If you were considering controls relating to sales returns, your sampling unit could be the entries reflected on the general ledger.
What time frame you're testing is also a consideration in defining the population. Usually, you define the period as the entire year under audit. For a calendar year, this means January 1 through December 31.
Consider the completeness of the population. For this example, you compare the client's sales journal to beginning and ending invoice numbers to make sure your sample includes all invoices the client issued during the test period. The sales journal reflects sales on account and can be arranged in order by customer or invoice number.
Define the deviation conditions.
The control is that client invoices are correct. An error or deviation in this control would be if the cost per unit on the client invoices doesn't agree with the standard price list without an explanation for the deviation (such as the fact that the client was given a discount). Even if an explanation exists, you still have a deviation if the proper authority didn't okay the discount.
Think about your expected number of deviations.
Consider the number of errors you anticipate finding. If you're working on a continuing engagement, you can look at last year's audit results. Otherwise, your audit team leader gives you guidance on how to come to an appropriate number.
Determine the planned assessed level of control risk.
This step addresses whether the population is free from material misstatement. You rank the risk as low, moderate, or maximum. Normally, you want a moderate assurance from your test of controls.
Moderate assurance means you obtain sufficient, appropriate evidence satisfying you that the charges on the client invoices are reasonable taking into consideration all circumstances surrounding the sale. Your audit supervisor can provide firm guidance on ranking criteria.
Determine the appropriate sample size.
You know that looking at all your client's customer invoices isn't feasible. So how many customer invoices from the entire population of invoices are you going to test? Your sample size can be a factor of your firm's policy (the number of items your firm normally samples), or you can use sampling software to select the sample size.
Determine the method of selecting the sample.
This describes the method you plan to use to select your sample. A common sampling method for tests of controls is attribute sampling. Attribute sampling means that an item being sampled either does or doesn't have certain qualities, or attributes.
An auditor selects a certain number of records to estimate how many times a specific feature will show up in a population. When using attribute sampling, the sampling unit is a single record or document — in this case, your single record is the customer invoice.