1. An Introduction to Attributes Sampling in Audits
Dr. Donald K. McConnell Jr.
6/30/2019

2. Attributes Sampling Plans
Used typically to test controls in a controls reliance audit scenario
Results are always in terms of a percentage projection
Do not test dollar amounts
More non-stat than stat sampling has been done in practice recently
SOX appears to be changing that!
6/30/2019

3. Assume the following:
Auditor wants to test controls over cash disbursements/acquisitions for 9 month period 1/2/xx-9/30/xx
What is an attribute?
Auditor must define attributes of interest
N=100,000 checks issued in relevant 9 month period
If auditor “intuitively” wants 90% confidence level, what do you think sample size (n) would be?
6/30/2019

4. The Auditor must specify parameters
Risk of assessing control risk too low [risk of over-reliance on internal controls (ARO or ARACR)]
Tolerable error rate (TER)
Expected population error rate (EPER)
Also first check number issued 1/2/xx and last check number issued 9/30/xx
6/30/2019

5. Common Parameters in Practice
would be moderate controls reliance:
ARO=10% [Complement of confidence level is risk]
TER= 5%
EPER=0% for client with good controls
6/30/2019

6. Concerning These Parameters:
How does the auditor determine EPER?
Examples:
What was last year’s actual result?
First time audit: pilot sample of 50 (per AICPA industry audit guide)
Does 5% TER bother you?
Why such a high TER?
Huge sample sizes if a more precise estimate is wanted, e.g. 2% TER!
Year end substantive testing provides further “utils” of evidence
6/30/2019

7. What Attributes Would We Want to Test? Examples:
Does check number and amount agree with entry in CDJ?
Is check supported by a vendor’s invoice in that amount?
Is there an authorized P.O. signed by purchasing agent?
Is there a receiving report from the dock?
Was check coutersigned if in excess of $xx,xxx?
Was final approval for payment authorized?
Etc.
6/30/2019

8. Let’s do the Test Laptop computer and audit software would be used
What if you are in West Texas and your hard drive crashed!
Resort to tables
Recall test parameters were
T 15-8: Sample size calculation
n=45 checks randomly selected
6/30/2019

9. Evaluating Sample Results
Assume no compliance deviations for 9 of 10 tested attributes (T15-9)
5.0% is “upper bound”
What does this mean?
We are 90% certain true rate of controls deviations doesn’t exceed 5.0%
Is this acceptable?
Yes, TER was 5%
6/30/2019

10. Evaluating Sample Results (Con.)
Assume for one disbursement, no supporting P.O. could be found
Can we select another check number randomly as substitute?
NO!!!! It’s a compliance deviation
What is projected error rate upper bound?
8.4%
Is this acceptable?
6/30/2019

11. What Options do we Have? Expand sample size? What would it be?
In real world, probably wouldn’t unless clearly due to sampling error
Unless sampling error, very likely to find at least one more check with no supporting P.O.
What if one more missing P.O. found in expanded sample?
What is projected upper error rate? (assuming sample expanded by 35 checks)
still unacceptable
Many auditors would “drop back ten and punt,” alternatively expanding substantive testing in the area
6/30/2019

12. This was “free.” I will not test you on these details, but you will need to know: Stat sampling apps. allow you to quantify sampling risk That’s the major advantage over non stat sampling
6/30/2019