Audit and Assurance · Assertions and audit evidence

Audit Sampling and Selecting Items for Testing

Q: What is sampling risk in audit?

Sampling risk is the risk that the auditor's conclusion from a sample differs from the conclusion if the entire population were tested. You reduce it by increasing sample size or improving sample design.

Q: What is non-sampling risk?

It is the risk of reaching a wrong conclusion for reasons unrelated to sampling. Examples include using an inappropriate procedure, misinterpreting evidence or failing to spot an error. Good planning, training and review reduce it.

Q: Which sampling methods can I be asked about in ACCA AA?

Expect random, systematic and monetary unit sampling as sampling methods. Also know haphazard and block selection. Haphazard selection is non-statistical and risks bias, and block selection is generally not appropriate for audit sampling because the result cannot be projected to the population. Know how each works and its main strength or weakness.

Updated 11 October 2026

Audit sampling means testing less than 100% of a population and drawing conclusions about all of it. Under ISA 530 you design the sample, select items so each has a chance of selection, test them, then evaluate results. Sampling risk and non-sampling risk both reduce the reliability of conclusions.

Understand Audit Sampling and Selecting Items for Testing

An auditor cannot check every transaction. A population such as 50,000 sales invoices is too large, and the audit has time and cost limits. So the auditor tests a sample and uses the results to reach a conclusion about the whole population.

ISA 530 defines audit sampling as applying procedures to less than 100% of items in a population so that all sampling units have a chance of selection. The aim is a reasonable basis for conclusions about the population. Sampling is used in tests of controls and in substantive procedures.

ISA 500 identifies three means of selecting items for testing: selecting all items, selecting specific items, and audit sampling. You can test all items (100% examination), which suits small populations of high-value items or where the risk is high. You can select specific items, such as large value items, key items, or unusual items. Or you can sample. Specific item selection is not sampling, because you cannot project the result to the rest of the population.

Sampling can be statistical or non-statistical. Statistical sampling uses random selection and probability theory to evaluate results and measure sampling risk. Non-statistical sampling relies on auditor judgement. Either can give sufficient appropriate evidence if designed well.

Two risks matter. Sampling risk is the risk that the conclusion from the sample differs from the conclusion if the whole population were tested. Non-sampling risk is any other risk not caused by sampling, such as using the wrong procedure, misreading a document, or failing to recognise an error. You can reduce sampling risk by increasing sample size. You reduce non-sampling risk through planning, supervision and review.

Key rules to remember

Definition of audit sampling (ISA 530): Sampling = procedures on < 100% of a population, with every sampling unit having a chance of selection; If items are chosen only by judgement for their size or nature, it is item selection, not sampling.
Statistical sampling features: Statistical = random selection + probability theory to evaluate results; Both features are needed. Random selection alone with judgemental evaluation is non-statistical.
Sampling risk types: Tests of controls: risk of overreliance / underreliance. Substantive: risk of incorrect acceptance / incorrect rejection; Overreliance and incorrect acceptance affect audit effectiveness, because they risk an incorrect audit opinion. Underreliance and incorrect rejection affect audit efficiency, because extra work is needed, although the conclusion is eventually corrected.
Factors increasing sample size: Substantive procedures: higher assessed risk, lower tolerable misstatement, higher expected misstatement, more assurance needed → larger sample. Tests of controls: higher planned reliance on controls or higher expected deviation rate → larger sample; A larger population has little effect on sample size unless it is very small.
Selection methods: Sampling methods: random, systematic (interval = population ÷ sample size), monetary unit sampling (MUS). Methods to avoid or use with care: haphazard, block; Haphazard selection is non-statistical and risks auditor bias, so use it only with care. Block selection (a contiguous block of items) is generally not appropriate for audit sampling, because not every unit has a chance of selection and the result cannot be projected to the whole population.

How to solve Audit Sampling and Selecting Items for Testing questions

Use this method for any question on sampling, selecting items or sampling risk.

1Identify the purpose: is the test a test of controls or a substantive procedure? This decides the relevant risks and the population.
2Define the population and sampling unit, making sure it is complete and relevant to the assertion (for example, test completeness from goods despatched notes, not from invoices).
3Decide whether sampling is suitable, or whether testing all items or specific items is better.
4Link sample size to the factors: risk, tolerable misstatement, expected misstatement and population.
5Name the selection method asked for or most suitable and say how it works in the scenario.
6Perform the procedure. For deviations or misstatements, decide if they are anomalies.
7Evaluate: project misstatements to the population and compare with tolerable misstatement.
8Conclude and state the action: accept, extend testing, or ask management to adjust.

Quickest way: Purpose, population, method, risk

When to use it: For Section A and OT case questions where you must pick the right method or risk quickly.

Check whether the question mentions size or risk: large value items point to specific item selection; many similar items point to sampling.
For sample size questions, ask: does it raise or lower risk or tolerable misstatement? Raise risk or lower tolerable misstatement means a bigger sample.
For a method, match the keyword: no pattern means random; fixed gap means systematic; value weighted means MUS.
For risk, ask: wrong conclusion about the population means sampling risk; human or procedural error means non-sampling risk.

Common mistakes in Audit Sampling and Selecting Items for Testing

Calling selection of all large items 'sampling'.
Students treat any subset of items as a sample.
Fix: Sampling needs every unit to have a chance of selection and results projectable to the population. Targeted selection is specific item testing.
Saying a bigger sample removes all risk.
Students overstate the benefit of size.
Fix: A bigger sample reduces sampling risk only. Non-sampling risk remains and needs good procedures and supervision.
Treating haphazard selection as random.
Both look unplanned.
Fix: Random uses random number tables or generators. Haphazard relies on the auditor avoiding bias and is not statistical.
Mixing up overreliance and underreliance.
The terms sound alike.
Fix: Overreliance: controls seem more effective than they are, so too little substantive work. Underreliance: controls seem weaker than they are, so extra work.
Testing the wrong population for the assertion.
Students sample from the ledger for every assertion.
Fix: For completeness, sample from source documents to the ledger. For existence, sample from the ledger to documents.
Ignoring an error found as 'just one'.
Students assume one error is trivial.
Fix: Investigate it. Treat it as an anomaly only if you can show it is not representative; otherwise project it.

Worked examples

Example 1

Trade receivables total ₹4,00,00,000 across 800 balances. The auditor uses systematic selection with a sample of 40 balances and a random start of 7. (a) Calculate the sampling interval and the first three items selected. (b) State one weakness of systematic selection.

Show the solution

Interval = population ÷ sample size = 800 ÷ 40 = 20.
First item = random start = 7.
Second item = 7 + 20 = 27.
Third item = 27 + 20 = 47.
Weakness: if the population has a pattern that matches the interval, the sample may be biased, for example every 20th balance being a particular type.

Answer: (a) Interval is 20; items selected are 7, 27 and 47. (b) A pattern in the population matching the interval can bias the sample.

Example 2

An auditor tests 60 purchase invoices for evidence of authorisation as a test of controls. Three lack authorisation. Management says the controls are working well. Explain the sampling issues and what the auditor should do.

Show the solution

Deviation rate in the sample = 3 ÷ 60 = 5%.
Compare with the tolerable deviation rate set at planning. If 5% exceeds it, controls cannot be relied on as planned.
Sampling risk: the sample may show controls working when they are not (overreliance) or fail when they work (underreliance). The 5% rate is only an estimate of the population rate.
Investigate the three cases to see if they are anomalies or share a cause, such as one staff member or a period of absence.
If not anomalies, reduce reliance on controls and extend substantive procedures on purchases and payables, including a larger sample.
Report the control deficiency to management and those charged with governance.

Answer: The sample deviation rate is 5%. If it exceeds the tolerable rate and the errors are not anomalies, the auditor should not rely on the controls, should increase substantive testing, and should report the deficiency.

Exam tips

Know the definition of sampling and why specific item selection is not sampling. This is often tested in objective questions.
For a written answer, give a clear list of factors affecting sample size and say whether each increases or decreases it.
Match the selection method to the scenario, and name a weakness if asked (systematic pattern bias, haphazard bias).
Do not confuse sampling risk with audit risk. Sampling risk and non-sampling risk are the two parts of detection risk, which is the risk that audit procedures fail to detect a misstatement. Detection risk is one component of audit risk (audit risk = inherent risk × control risk × detection risk).