An Introduction to Attributes Sampling in Audits

1. An Introduction to Attributes Sampling in Audits Dr. Donald K. McConnell Jr.

2. Attributes Sampling Plans • Used typically to test controls in a controls reliance audit scenario • Results are always in terms of a percentage projection • Do not test dollar amounts • More non-stat than stat sampling has been done in practice recently • SOX appears to be changing that!

3. Assume the following: • Auditor wants to test controls over cash disbursements/acquisitions for 9 month period 1/2/xx-9/30/xx • What is an attribute? • Auditor must define attributes of interest • N=100,000 checks issued in relevant 9 month period • If auditor “intuitively” wants 90% confidence level, what do you think sample size (n) would be?

4. The Auditor must specify parameters • Risk of assessing control risk too low [risk of over-reliance on internal controls (ARO or ARACR)] • Tolerable error rate (TER) • Expected population error rate (EPER) • Also first check number issued 1/2/xx and last check number issued 9/30/xx

5. Common Parameters in Practice • 90-5-0 would be moderate controls reliance: • ARO=10% [Complement of confidence level is risk] • TER= 5% • EPER=0% for client with good controls

6. Concerning These Parameters: • How does the auditor determine EPER? • Examples: • What was last year’s actual result? • First time audit: pilot sample of 50 (per AICPA industry audit guide) • Does 5% TER bother you? • Why such a high TER? • Huge sample sizes if a more precise estimate is wanted, e.g. 2% TER! • Year end substantive testing provides further “utils” of evidence

7. What Attributes Would We Want to Test? Examples: • Does check number and amount agree with entry in CDJ? • Is check supported by a vendor’s invoice in that amount? • Is there an authorized P.O. signed by purchasing agent? • Is there a receiving report from the dock? • Was check coutersigned if in excess of $xx,xxx? • Was final approval for payment authorized? • Etc.

8. Let’s do the Test • Laptop computer and audit software would be used • What if you are in West Texas and your hard drive crashed! • Resort to tables • Recall test parameters were 90-5-0 • T 15-8: Sample size calculation • n=45 checks randomly selected

9. Evaluating Sample Results • Assume no compliance deviations for 9 of 10 tested attributes (T15-9) • 5.0% is “upper bound” • What does this mean? • We are 90% certain true rate of controls deviations doesn’t exceed 5.0% • Is this acceptable? • Yes, TER was 5%

10. Evaluating Sample Results (Con.) • Assume for one disbursement, no supporting P.O. could be found • Can we select another check number randomly as substitute? • NO!!!! It’s a compliance deviation • What is projected error rate upper bound? • 8.4% • Is this acceptable?

11. What Options do we Have? • Expand sample size? What would it be? • In real world, probably wouldn’t unless clearly due to sampling error • Unless sampling error, very likely to find at least one more check with no supporting P.O. • What if one more missing P.O. found in expanded sample? • What is projected upper error rate? (assuming sample expanded by 35 checks) • still unacceptable • Many auditors would “drop back ten and punt,” alternatively expanding substantive testing in the area