Advanced Audit and Assurance (International) · Audit procedures and obtaining evidence

Audit Sampling under ISA 530 for AAA

Updated 11 October 2026

Audit sampling means testing less than 100% of a population so you can conclude on the whole population. Under ISA 530 you design the sample, choose a selection method, test items, investigate deviations or misstatements, project the results and evaluate them against tolerable misstatement or tolerable deviation rate.

Understand Audit Sampling (ISA 530)

You rarely test every item. A population of 50,000 receivables balances or 200,000 sales invoices is too big. So you test a sample and draw a conclusion about the whole population. ISA 530 sets out how to do this so the conclusion is reasonable.

Sampling needs two things. Every item in the sample must have a chance of selection, and the sample must be large enough and representative enough to support your conclusion. If you hand-pick only risky items, that is not audit sampling. It is selective testing, and you cannot project the result to the rest of the population.

Statistical sampling uses random selection and probability theory to evaluate results and measure sampling risk. Non-statistical sampling relies on judgement for sample size and evaluation. Both are acceptable if they give sufficient appropriate evidence. Statistical sampling requires both random selection of the sample and the use of probability theory to evaluate the results. If either is missing, it is non-statistical.

Sampling risk is the risk that your conclusion from the sample differs from the conclusion if you tested the whole population. You can reduce it by increasing sample size. Non-sampling risk is every other cause of a wrong conclusion, such as using an inappropriate procedure, misreading a document or failing to recognise an error. A larger sample does not fix it. Better planning, supervision and review do.

Tolerable misstatement is the application of performance materiality to a particular sampling procedure. It is used in tests of details, and it may be the same amount as performance materiality or lower. For tests of controls, you use tolerable rate of deviation, the highest rate of control failure you will accept while still relying on the control. Expected misstatement or expected deviation also drives sample size. If you expect more errors, you need a bigger sample. In tests of details, wide variability in item values also pushes sample size up, unless you stratify the population.

If you find misstatements, you investigate their nature and cause, then project them to the population. You also add any anomalies carefully. An anomaly is a misstatement you can show is not representative of the population. This is rare and needs strong evidence. You then compare projected misstatement, plus any other known misstatements, with tolerable misstatement.

Key rules to remember

Projected misstatement (ratio method): Projected misstatement = (Misstatement found in sample ÷ Value of sample) × Total population value; Use when errors are proportional to item size. The ratio applied to the total population value already includes the errors found in the sample, so do not add them again. Add only separately identified misstatements outside the sampled population.
Projected misstatement (average or difference method): Projected misstatement = (Misstatement found ÷ Number of items in sample) × Number of items in population; Use when errors are not related to item value, such as a fixed pricing error per item.
Sampling interval (systematic selection): Interval = Population value ÷ Sample size; Used in monetary unit sampling and systematic selection. Choose a random start within the first interval.
Deviation rate in a test of controls: Deviation rate = Number of deviations ÷ Sample size; Compare with the tolerable deviation rate. If the sample rate is above tolerable, you cannot rely on the control as planned.
Conclusion test for details: Projected misstatement + other known misstatements, compared with tolerable misstatement; If the total is well below tolerable misstatement, the sample may support the balance, subject to sampling risk. Being below tolerable misstatement is not enough on its own, because the projection is only a point estimate. If the total is close to tolerable misstatement, sampling risk is unacceptably high. Extend testing or ask management to adjust. If it exceeds tolerable misstatement, the sample does not support the balance as it stands.
Factors increasing sample size: Larger sample ← lower tolerable misstatement or deviation rate, higher expected misstatement or deviation, higher assessed risk, lower reliance on other procedures, and (tests of details only) larger population variability; Population size has little effect once the population is large. Variability of item values matters in tests of details, not tests of controls. Stratifying the population reduces variability.

How to solve Audit Sampling (ISA 530) questions

Use this approach for any sampling question, whether it asks you to design a sample, explain terms or evaluate results.

1Identify the objective and the population. State the assertion tested, such as existence of receivables or operation of a control, and confirm the population is complete.
2Decide whether sampling is appropriate. Use it where the population has many similar items. Use 100% or targeted testing for key items, unusual items or small populations.
3Define the deviation or misstatement. Say exactly what counts as an error, for example an unapproved invoice or an unconfirmed balance.
4Set the sample size factors. Link tolerable misstatement or deviation rate, expected error and risk assessment to the size of the sample. For tests of details, add population variability.
5Choose the selection method and justify it: random, systematic, monetary unit, haphazard or block selection. Match the method to the scenario.
6Perform procedures and investigate errors. If an item cannot be tested, use alternative procedures or treat it as an error.
7Project the errors to the population and compare them with tolerable misstatement or the tolerable deviation rate. Consider sampling risk.
8Conclude and respond. Say whether evidence is sufficient and appropriate, and what you will do next, such as extending the sample, performing more substantive work or reporting deficiencies.

Quickest way: Project, compare, conclude

When to use it: Use this when the exam gives sample results and asks whether the balance is acceptable.

Pick the right projection method. If errors scale with value, use the ratio method. If they are per item, use the average method.
Project the misstatement to the whole population (this includes sample errors when the ratio is applied to total population value), or project to the untested part and add the errors found in the sample.
Add any other known misstatements, then compare the total with tolerable misstatement. Do not compare with overall materiality.
If the total is below tolerable misstatement but close, say sampling risk remains and consider extending testing.
State the action: accept, extend the sample, propose an adjustment or consider the effect on the audit opinion.

Common mistakes in Audit Sampling (ISA 530)

Calling a sample statistical because the auditor used judgement or a spreadsheet.
Students link statistical sampling to using software or calculations.
Fix: Statistical sampling needs both random selection and probability theory to evaluate results. If either is missing, it is non-statistical.
Confusing sampling risk with non-sampling risk.
Both sound like reasons a conclusion may be wrong.
Fix: Sampling risk comes from testing only part of the population and falls as sample size rises. Non-sampling risk comes from auditor errors or poor procedures and is managed through quality control.
Comparing projected misstatement with materiality instead of tolerable misstatement.
Students forget the threshold that applies to the sampling procedure.
Fix: Use tolerable misstatement, which is performance materiality applied to the sampling procedure and may be the same as or lower than performance materiality, as the benchmark for sample results.
Ignoring errors found because they look isolated.
Students treat any odd error as an anomaly.
Fix: Only treat an error as an anomaly if you have high certainty it is not representative. Otherwise project it and investigate the cause.
Choosing haphazard selection and calling it random.
Both avoid obvious bias, so they seem the same.
Fix: Random selection uses random numbers or a generator. Haphazard selection is unstructured and is always non-statistical, because it is not random. It also carries a risk of unconscious bias.
Saying a larger population always needs a much larger sample.
It sounds logical.
Fix: For large populations, size has little effect on sample size. Risk, tolerable error and expected error matter much more.

Worked examples

Example 1

You test a sample of receivables with a total book value of $400,000 from a population of $4,000,000. You find overstatements of $12,000 in the sample. Tolerable misstatement for receivables is $100,000. The errors are proportional to balance size. Evaluate the result.

Show the solution

Use the ratio method because errors scale with value.
Error rate in the sample = $12,000 ÷ $400,000 = 3%.
Projected misstatement for the population = 3% × $4,000,000 = $120,000.
This already includes the $12,000 found in the sample, so do not add it again.
Compare $120,000 with tolerable misstatement of $100,000. It is higher.
Sampling risk makes the position worse, because the true error could be higher still.

Answer: Projected misstatement is $120,000, which exceeds tolerable misstatement of $100,000. The sample does not support the receivables balance. Investigate the cause of the errors, extend testing or ask management to adjust, and consider the effect on the audit opinion if the misstatement stays uncorrected.

Example 2

An audit of a retailer tests purchase approvals. The auditor selects 60 purchase orders from a population of 12,000. Three have no approval signature. The tolerable deviation rate is 4%. Explain what the result means and what the auditor should do.

Show the solution

Calculate the sample deviation rate = 3 ÷ 60 = 5%.
Compare with the tolerable deviation rate of 4%. The sample rate is higher.
Because the sample rate exceeds the tolerable rate, the control cannot be relied on at the planned level.
Investigate why the approvals are missing. For example, check if they relate to one buyer, one period or one supplier.
Revise the risk assessment for the related assertions and increase substantive testing of purchases and payables.
Consider reporting the control deficiency to management and those charged with governance.

Answer: The deviation rate is 5%, above the 4% tolerable rate, so the control is not reliable as planned. Increase substantive procedures on purchases and payables, investigate the cause of the missing approvals, and communicate the deficiency.

Exam tips

Link every sampling choice to the scenario. Say why a method fits, for example systematic selection for a large uniform population or monetary unit sampling where large values matter most.
Show the calculation and state the comparison. Marks come from projecting the error and comparing it with tolerable misstatement, not just writing the figure.
When asked to evaluate a sample, always add the next step: extend testing, perform alternative procedures, or propose an adjustment.
Separate sampling risk from non-sampling risk with one clear example of each. Examiners often reward clean definitions.
Show professional scepticism: question whether the population is complete and whether an error is truly an anomaly.

Practice questions from Audit procedures and obtaining evidence

Audit Sampling (ISA 530): frequently asked questions

What is the difference between statistical and non-statistical sampling?

Statistical sampling uses random selection and probability theory to evaluate results, so it can measure sampling risk. If either element is missing, the sampling is non-statistical, which uses judgement for size and evaluation. Both can give sufficient appropriate evidence if designed properly.

What is the difference between sampling risk and non-sampling risk?

Sampling risk is the risk that the sample leads to a different conclusion from testing the whole population. Non-sampling risk covers all other causes of a wrong conclusion, such as poor procedures or misinterpreting evidence. Larger samples reduce only sampling risk.

What is tolerable misstatement in audit sampling?

It is the application of performance materiality to a particular sampling procedure. It may be the same amount as performance materiality or lower. You use it to design and evaluate tests of details. If projected misstatement, plus other known misstatements, exceeds it, the sample does not support the balance.

Which sample selection methods does ISA 530 describe?

ISA 530 Appendix 4 describes random selection, systematic selection, monetary unit sampling, haphazard selection and block selection. Random, systematic and monetary unit selection can be used in statistical sampling if the results are evaluated using probability theory. Haphazard selection is non-statistical, because it is not random. Block selection is rarely appropriate, because it is unlikely to be representative of the population.