Audit Sampling and Data Analytics
Audit sampling (ASA/ISA 530) applies when the auditor examines less than 100% of a population to draw conclusions about the whole. Distinguish statistical (probability-based, quantifiable sampling risk) from non-statistical sampling. Understand sampling risk (conclusion differs from full population) versus non-sampling risk (human error, wrong procedures).
Key concepts: population (complete, appropriate), sampling unit, stratification (reduces variability), tolerable misstatement (performance materiality), expected misstatement, and sample size (increases with lower tolerable misstatement, higher expected misstatement, higher confidence). Attribute sampling tests deviation rates (controls); monetary unit sampling (probability-proportional-to-size) is common for substantive testing and is effective for overstatements.
Projection of misstatements from the sample to the population is required when misstatements are found; evaluate whether the projected misstatement plus known misstatement approaches tolerable misstatement. Data analytics (CAATs) enables full-population testing, exception reporting, and pattern detection, but requires completeness and accuracy testing of the data (reconciling to source systems) and consideration of data reliability.
Traps: confusing sampling risk with non-sampling risk; failing to project misstatements; treating a 100% test as sampling; and using analytics without validating data integrity.
Rule of thumb: if you find a misstatement in a sample, you must project it to the population and evaluate it against tolerable misstatement.