F-1 McGraw-Hill/Irwin ©2005 by the McGraw-Hill Companies, Inc. All rights reserved. Module F Attribute Sampling “There are five kinds of lies: lies, damned lies, statistics, politicians quoting statistics, and novelists quoting politicians on statistics.” – Stephen K. Tagg

F-2 McGraw-Hill/Irwin ©2005 by the McGraw-Hill Companies, Inc. All rights reserved. Learning Objectives 1.Identify the objectives of attribute sampling, define deviation conditions, and define the population for an attribute sampling application. 2.Understand how various factors influence the size of an attribute sample. 3.Determine the sample size for an attribute sampling application.

F-3 McGraw-Hill/Irwin ©2005 by the McGraw-Hill Companies, Inc. All rights reserved. Learning Objectives (Continued) 4.Identify various methods of selecting an attribute sample. 5.Evaluate the results of an attribute sampling application by determining the computed upper limit (CUL). 6.Define sequential sampling and discovery sampling and identify when these types of sampling applications would be used.

F-4 McGraw-Hill/Irwin ©2005 by the McGraw-Hill Companies, Inc. All rights reserved. Attribute Sampling Used to estimate the extent to which a characteristic (attribute) exists within a population Used in tests of controls –Estimate the rate at which internal control policies or procedures are not functioning as intended (deviation conditions) –Compare rate to some allowable rate (tolerable deviation rate)

F-5 McGraw-Hill/Irwin ©2005 by the McGraw-Hill Companies, Inc. All rights reserved. Major Steps in Attribute Sampling 1.Determine the objective 2.Define deviation conditions 3.Define the population 4.Determine sample size 5.Select the sample 6.Measure sample items 7.Evaluate sample results Planning Performing Evaluating

F-6 McGraw-Hill/Irwin ©2005 by the McGraw-Hill Companies, Inc. All rights reserved. Major Steps in Attribute Sampling: Planning 1.Determine the objective of sampling Identify key controls that the auditor intends to rely upon 2.Define deviation conditions Instance in which control is not functioning as intended 3.Define the population Should reflect all potential applications of the control during the period being examined

F-7 McGraw-Hill/Irwin ©2005 by the McGraw-Hill Companies, Inc. All rights reserved. Major Steps in Attribute Sampling: Performing 4.Determine sample size Sampling risk (Risk of assessing control risk too low) Expected deviation rate Tolerable deviation rate Population size (not applicable in most instances) 5.Select sample items 6.Measure sample items

F-8 McGraw-Hill/Irwin ©2005 by the McGraw-Hill Companies, Inc. All rights reserved. Sampling Risks in Attribute Sampling

F-9 McGraw-Hill/Irwin ©2005 by the McGraw-Hill Companies, Inc. All rights reserved. Factors Affecting Sample Size

F-10 McGraw-Hill/Irwin ©2005 by the McGraw-Hill Companies, Inc. All rights reserved. How to Determine Sample Size? Select AICPA Sample Size table corresponding to desired risk of assessing control risk too low Identify row related to appropriate expected deviation rate (EDR) Identify column related to appropriate tolerable deviation rate (TDR) Determine sample size at junction of row for EDR and column for TDR

F-11 McGraw-Hill/Irwin ©2005 by the McGraw-Hill Companies, Inc. All rights reserved. Sample Size Example Parameters –Risk of assessing control risk too low = 5% –Expected deviation rate = 2% –Tolerable deviation rate = 7%

F-12 McGraw-Hill/Irwin ©2005 by the McGraw-Hill Companies, Inc. All rights reserved. Sample Size Example (Continued) From AICPA Table (5% risk) Tolerable Deviation Rate EDR2%3%4%5%6%7% 1.00%** %*** %****

F-13 McGraw-Hill/Irwin ©2005 by the McGraw-Hill Companies, Inc. All rights reserved. Major Steps in Attribute Sampling: Performing 4.Determine sample size 5.Select sample items For statistical sampling, use unrestricted random selection or systematic random selection Haphazard selection or block selection are not appropriate for statistical sampling 6.Measure sample items

F-14 McGraw-Hill/Irwin ©2005 by the McGraw-Hill Companies, Inc. All rights reserved. Major Steps in Attribute Sampling: Performing 4.Determine sample size 5.Select sample items 6.Measure sample items Perform appropriate test of controls Calculate sample deviation rate = No. deviations  sample size

F-15 McGraw-Hill/Irwin ©2005 by the McGraw-Hill Companies, Inc. All rights reserved. Major Steps in Attribute Sampling: Evaluating 7.Evaluate sample results Problem with sample deviation rate is that it may result from a nonrepresentative sample Need to “adjust” sample deviation rate to control for the risk of assessing control risk too low Calculate a Computed Upper Limit (CUL)

F-16 McGraw-Hill/Irwin ©2005 by the McGraw-Hill Companies, Inc. All rights reserved. Computed Upper Limit (CUL) There is a (1 minus risk of assessing control risk too low) probability that the true population deviation rate is less than or equal to the CUL There is a (risk of assessing control risk too low) probability that the true population deviation rate exceeds the CUL Example: CUL = 6%, Risk of assessing control risk too low = 5% 95% probability 5% probability 0% 6%

F-17 McGraw-Hill/Irwin ©2005 by the McGraw-Hill Companies, Inc. All rights reserved. Components of the CUL CUL XXX Sample Deviation Rate(XXX) Allowance for Sampling Risk XXX or Sample Deviation Rate XXX Allowance for Sampling Risk XXX CUL XXX

F-18 McGraw-Hill/Irwin ©2005 by the McGraw-Hill Companies, Inc. All rights reserved. How to Determine the CUL Select AICPA Sample Evaluation Table corresponding to desired risk of assessing control risk too low Identify row related to appropriate sample size –If cannot locate exactly, round down to next lowest sample size Identify column related to number of deviations noted Determine CUL at junction of row for sample size and column for deviations

F-19 McGraw-Hill/Irwin ©2005 by the McGraw-Hill Companies, Inc. All rights reserved. CUL Example Parameters –Sample size = 50 –Risk of assessing control risk too low = 5% –No. of deviations = 3 Sample deviation rate 3  50 = 6%

F-20 McGraw-Hill/Irwin ©2005 by the McGraw-Hill Companies, Inc. All rights reserved. CUL Example (Continued) From AICPA Table (5% risk) No. of deviations found n **

F-21 McGraw-Hill/Irwin ©2005 by the McGraw-Hill Companies, Inc. All rights reserved. CUL Example (Continued) Sample Deviation Rate = 6% Allowance for Sampling Risk = 8.8% CUL = 14.8%

F-22 McGraw-Hill/Irwin ©2005 by the McGraw-Hill Companies, Inc. All rights reserved. Making the Decision If CUL > Tolerable Deviation Rate: –Conclude that internal control is not functioning effectively –Options Increase sample size in hopes of supporting planned level of control risk Increase level of control risk, leading to more effective substantive procedures (lower detection risk)

F-23 McGraw-Hill/Irwin ©2005 by the McGraw-Hill Companies, Inc. All rights reserved. Making the Decision If CUL  Tolerable Deviation Rate –Conclude that the internal control is functioning effectively –Options Maintain planned level of control risk, leading to planned effectiveness of substantive tests Consider a further reduction in control risk, leading to less effective substantive procedures (higher detection risk)

F-24 McGraw-Hill/Irwin ©2005 by the McGraw-Hill Companies, Inc. All rights reserved. Sequential (Stop-or-Go Sampling) Select initial (smaller) sample and consider results Decision –Rely on control; discontinue sampling –Cannot rely on control Select additional items; make decision Discontinue sampling Advantage is that evidence may support reliance on control with a relatively small sample size Disadvantage is that auditor may continually extend the sample, creating inefficiencies

F-25 McGraw-Hill/Irwin ©2005 by the McGraw-Hill Companies, Inc. All rights reserved. Discovery Sampling Used when deviations from control are expected to be infrequent but very critical Allows the auditor to –Determine the necessary sample size to find at least one example of a deviation if such deviations exist –Determine the probability that the rate of occurrence of a deviation is less than a specific (low) level