Statistical and non-statistical audit sampling: how is a sample built and how is a misstatement found projected to the whole population?

Auditor Dilnoza is examining the annual sales of the "Shirin Non" trading house. During the year 2 400 sales invoices were issued, totalling 6 000 million soum. There is neither the time nor the need to look at all of them. But the approach "I'll take a few and have a look" will not do either: the sample must be built so that a well-founded conclusion about the whole year can be drawn from it. In this article we answer exactly this "how" question.

In Uzbekistan the international standards on auditing are the standards of auditing activity (Law "On Auditing Activity", Article 9). Among them a separate standard, ISA 530 "Audit Sampling", is devoted to sampling; the concepts below rely on the logic of this standard.

What is the difference between statistical and non-statistical sampling?

Under ISA 530, for sampling to be statistical, two conditions must be met together: items are selected randomly, and the results are evaluated using probability theory, including measuring sampling risk. If either of the two is missing, the sampling is non-statistical.

Important: non-statistical sampling does not mean "bad" sampling. It is also planned, documented and requires projecting misstatements to the population. The only difference is whether the reliability of the conclusion can be expressed as a number.

Which methods are used to select a sample?

Dilnoza split the population in two. First she separated out the key items: 12 invoices over 50 million soum, totalling 1 200 million soum. She tests them in full, this is not sampling. For the remaining 2 388 invoices (4 800 million soum) 60 items are taken. This could have been done with five methods:

Dilnoza chose the monetary unit method: the risk of sales being overstated is higher in large amounts, and this method brings more large documents into the sample.

What does the misstatement found mean for the whole population?

The 60 invoices selected totalled 120 million soum. In three of them the sales amount was overstated by 1.8 million soum. No misstatement was found in the 12 key items.

There are two common calculations for projecting a misstatement to the population:

Both calculations give a projected misstatement of about 72 million soum. There is no misstatement in the key items, so the expected misstatement for the whole population is around this figure.

Now it must be compared with the tolerable misstatement set by the auditor at the planning stage. In the example it is 90 million soum (hypothetical):

72 < 90, but the headroom is small. A sample never fully reflects the population: the probability that the conclusion based on a sample differs from the conclusion that would be reached if the whole population were tested with the same procedure is called sampling risk. The risk here is that the actual misstatement may be larger than projected and exceed the tolerable limit. Because the headroom is small, Dilnoza chooses one of two ways: extend the sample or ask the client to correct the misstatements found and similar ones. She chose the second: management corrected the three misstatements and checked itself whether misstatements of this kind exist in the remaining invoices.

Is there a risk other than sampling risk?

Yes. Even if the auditor makes a correct sample but evaluates a document incorrectly or applies the wrong procedure, a misstatement will slip through. This is non-sampling risk: increasing the sample size does not reduce it; only careful planning, an experienced team and supervision of the work reduce it.