Audit and Assurance · Audit sampling and other means of testing
Audit Sampling Concepts and Sampling Risk Explained
Updated 11 October 2026 · Fact-checked
Audit sampling means applying audit procedures to less than 100% of items in a population so that every sampling unit has a chance of selection. The auditor then concludes on the whole population. Sampling risk is the risk that the sample leads to the wrong conclusion. Non-sampling risk is any other cause of wrong conclusions.
Understand Audit Sampling Concepts and Risk
Audit sampling (ISA 530) is applying audit procedures to fewer than 100% of the items in a population, so that all sampling units have a chance of being selected. The auditor uses the result to reach a conclusion about the whole population. The population is the full set of data you want to conclude on, for example all trade receivable balances at the year end.
Auditors sample because testing everything is rarely practical. Time and cost limit the work. Audit evidence must be persuasive, not absolute, so a well-designed sample is enough. Sampling is not suitable when you need to test every item, such as a small population of high-value items, or when a test does not involve selecting items, such as an inquiry or an analytical procedure.
Sampling risk is the risk that the auditor's conclusion from the sample differs from the conclusion they would reach if they tested the whole population. It can lead to two wrong conclusions. For tests of controls, the auditor may conclude controls are more effective than they are, or less effective than they are. For substantive tests, the auditor may conclude a material misstatement does not exist when it does, or that one exists when it does not. The first kind in each case hurts audit effectiveness, because the auditor may give the wrong opinion. The second kind hurts efficiency, because extra work is done. You can reduce sampling risk by increasing the sample size.
Non-sampling risk is the risk of reaching a wrong conclusion for reasons unrelated to sampling. Examples are using an inappropriate procedure, misreading a document, failing to recognise an error, or testing the wrong population. A bigger sample does not reduce it. Better planning, training, supervision and review do.
Two more terms matter. Tolerable misstatement (or tolerable rate of deviation for controls) is the maximum error the auditor will accept in the population and still conclude the objective is met. It is set using performance materiality. Expected misstatement is the error the auditor expects to find in the population, based on prior experience and the risk assessment. Tolerable error is a limit. Expected error is a forecast. The higher the expected error, or the lower the tolerable error, the larger the sample needed. An anomaly is a misstatement clearly not representative of the population.
Key rules to remember
- Definition of audit sampling
- Procedures on < 100% of items, each sampling unit with a chance of selection
- Both parts matter. Selecting only the items you choose by judgement, with no chance for others, is not sampling.
- Sampling risk and sample size
- Larger sample → lower sampling risk
- Non-sampling risk is not reduced by increasing sample size.
- Tolerable error and sample size
- Lower tolerable error → larger sample
- Tolerable misstatement is based on performance materiality.
- Expected error and sample size
- Higher expected error → larger sample
- Expected error must be below tolerable error, or sampling is unlikely to be suitable.
- Projected misstatement
- Projected error = (Error found ÷ Sample value) × Population value
- Used when the sample is by value. Compare the result with tolerable misstatement.
How to solve Audit Sampling Concepts and Risk questions
Use this method for any question on sampling concepts, sampling risk or the factors that affect sample size.
- 1Identify what the question asks: definition, type of risk, or effect on sample size.
- 2Name the population and the test objective, for example existence of receivables.
- 3For a risk question, decide if the cause is the sample itself (sampling risk) or something else such as a wrong procedure (non-sampling risk).
- 4For a sample size question, list each factor and state its direction: tolerable error, expected error, assessed risk, population size, stratification.
- 5Link each point to the scenario facts, not just to theory.
- 6Compare any projected or found error with tolerable error and conclude on the population.
- 7State the audit response, such as extending the sample or requesting adjustment.
Quickest way: Direction-of-effect check
When to use it: Use it for Section A and OT case questions on sample size or risk, where you have under two minutes.
- Ask: is the cause the sample size or selection? If yes, it is sampling risk. If no, it is non-sampling risk.
- For sample size, ask: does this make the auditor more cautious? If yes, the sample goes up.
- Remember: lower tolerable error, higher expected error, higher risk all increase the sample.
- Pick the option with the correct direction and discard options that reverse it.
Common mistakes in Audit Sampling Concepts and Risk
Saying a larger sample reduces non-sampling risk.
Students link all audit risk to sample size.
Fix: Only sampling risk falls with sample size. Non-sampling risk is managed by quality of procedures, training and review.
Treating tolerable error and expected error as the same thing.
Both are described as errors in the population.
Fix: Tolerable is the maximum acceptable. Expected is the amount you predict. Expected should be lower than tolerable.
Thinking that a higher tolerable error increases the sample.
Students link higher numbers with more work.
Fix: A higher tolerable error means the auditor accepts more error, so the sample falls.
Calling any selection of items a sample.
Students ignore the requirement that every unit has a chance of selection.
Fix: Testing only selected high-value items by judgement is selective testing, not sampling. Say so if the question suggests it.
Giving a definition only, with no link to the scenario.
Students memorise ISA wording.
Fix: Apply each point to the facts, for example a weak control environment means a higher assessed risk and a larger sample.
Ignoring the effect on efficiency versus effectiveness.
Students describe only one wrong conclusion.
Fix: Explain both: wrongly accepting hurts effectiveness, wrongly rejecting hurts efficiency.
Worked examples
Example 1
An audit junior tests a sample of 40 sales invoices. The junior wrongly accepts one invoice as properly authorised when no authorisation signature is present. Explain whether this is sampling risk or non-sampling risk, and how the firm can reduce it.
Show the solution
- The error arose because the junior failed to recognise a deviation in an item that was tested.
- The sample was selected and sized correctly. The problem is in carrying out the procedure.
- This is therefore non-sampling risk, not sampling risk.
- Increasing the sample would not remove this risk, as the junior could repeat the mistake.
- The firm should give clear test instructions, train juniors, and have a senior review the working paper.
Answer: It is non-sampling risk, caused by human error in applying the procedure. It is reduced by training, supervision and review, not by a larger sample.
Example 2
An auditor tests trade receivables with a population value of ₹10,00,000. Tolerable misstatement is ₹30,000. A sample of ₹2,00,000 by value contains errors of ₹4,000. Project the error and conclude. Then state how sample size would change if the auditor expected more error.
Show the solution
- Error rate in sample = ₹4,000 ÷ ₹2,00,000 = 2%.
- Projected error = 2% × ₹10,00,000 = ₹20,000.
- Compare with tolerable misstatement: ₹20,000 is below ₹30,000.
- The projected error is below the limit, but there is still sampling risk, because the true error could be higher than the projection.
- Also consider the nature of the errors and whether any are anomalies.
- If more error were expected, the auditor would need a larger sample to reach the same level of assurance.
Answer: Projected error is ₹20,000, below tolerable misstatement of ₹30,000. The sample supports the balance, subject to considering sampling risk and the nature of the errors. Higher expected error would increase the sample size.
Exam tips
- Always state whether a risk is sampling or non-sampling and give the reason, using the scenario fact that caused it.
- In sample size questions, give the direction of change for each factor. Examiners mark direction.
- Show a projected error calculation clearly, then compare it with tolerable error. Do not stop at the number.
- Do not state that sampling gives certainty. Say it gives reasonable, not absolute, assurance.
- In objective questions, watch for reversed wording on tolerable error. This is a common trap.
Audit Sampling Concepts and Risk in other exams
The same ground in other exams, if you are preparing for more than one or want another angle on it.
Audit Sampling Concepts and Risk: frequently asked questions
What is the difference between sampling risk and non-sampling risk?
Sampling risk is the chance that the conclusion from a sample differs from the conclusion from testing the whole population. Non-sampling risk comes from other causes, such as choosing the wrong procedure or misreading evidence. A larger sample reduces only sampling risk.
What is the difference between tolerable error and expected error?
Tolerable error is the maximum error the auditor will accept in the population. Expected error is the amount the auditor thinks is in the population. Expected error should be below tolerable error for sampling to work.
Why do auditors use sampling?
Testing every item is usually too costly and slow. Audit evidence only needs to be persuasive. A properly designed sample gives a reasonable basis for a conclusion on the population.
Does a larger sample always mean better audit quality?
No. It lowers sampling risk, but poor procedures or mistakes still cause non-sampling risk. Quality depends on design, execution and review as well as size.