Audit Evidence, Testing Methodologies, and Sampling
What to know
Audit evidence must be sufficient, appropriate, and reliable-original documents and system data generally outrank summaries. Testing approaches include inquiry, observation, inspection, recalculation, reperformance, and analytics. Sampling methods: statistical (probability-based, allows projection with confidence) versus non-statistical (judgmental). Know attribute sampling (compliance rate) versus variables sampling (dollar amounts), and the concepts of sample size, confidence level, tolerable error, and expected error. Understand documentation standards: workpapers must show what was tested, how, by whom, and the conclusion, with cross-references to findings.
Traps
Questions confuse sampling risk (concluding a control works when it doesn't) with non-sampling risk (human error). Another trap: projecting non-statistical results as if statistically valid. Also, relying solely on management inquiry as evidence-it's the weakest form. Watch for auditors who test a control once and declare it effective; frequency drives sample size.
Rule of thumb
Higher risk, higher volume, and lower tolerable error require larger samples. Always document the sampling methodology so results can be defended.
Worked example
An auditor tests 60 claims for a required modifier; 6 fail (10% error). If tolerable error was 5%, the control fails. The auditor reports the exception rate, notes the sampling method, and does not project a dollar amount unless statistical sampling was used.