How does audit risk relate to audit sampling method and sample size?

The auditor must consider four statistical parameters to determine an appropriate sample size to select for the planned control test: confidence level, expected deviation rate, tolerable rate, and population. Although guided by assessed risk, inquiries of the audit client, and prior audit experience, each parameter is ultimately based on professional auditor judgment.

Confidence Level

The sample's confidence level refers to the reliability the auditor places on the sample results. Confidence levels of90 percent to99 percent are common. A95 percent confidence level means the auditor assumes the risk that five out of100 samples will not reflect the true values in the population.

The auditor's assessment of the control environment contributes to the level of risk the auditor is willing to assume. At a95 percent confidence level,5 percent — the complement of the confidence level — reflects the auditor's risk of "assessing control risk too low."

Expected Deviation Rate

The expected deviation rate represents the auditor's best estimate of the actual failure rate of a control in a population. The rate usually is based on client inquiries, changes in personnel, process observations, prior year test results, or even the results of a preliminary sample.

Tolerable Rate

The tolerable rate defines the maximum rate of noncompliance the internal auditor will "tolerate" and still rely on the prescribed control. Many auditors will coordinate with their audit client before establishing a tolerable level. Client control objectives help determine the nature and frequency of deviations that can occur and still allow reliance on the control.

Population

The population contains all items to be considered for testing. Each must have an unbiased chance of selection to ensure the final sample is representative of the population. For large populations containing thousands of items, population size will cause little impact on total sample size and is often irrelevant for audit sample planning.