An Introduction to Attributes Sampling in Audits

1
An Introduction to Attributes Sampling in Audits

• Dr. Donald K. McConnell Jr.

2
Attributes Sampling Plans

• Used typically to test controls in a controls
  reliance audit scenario
• Results are always in terms of a percentage
  projection
• Do not test dollar amounts
• More non-stat than stat sampling has been done in
  practice recently
• SOX appears to be changing that!

3
Assume the following

• Auditor wants to test controls over cash
  disbursements/acquisitions for 9 month period
  1/2/xx-9/30/xx
• What is an attribute?
• Auditor must define attributes of interest
• N100,000 checks issued in relevant 9 month
  period
• If auditor intuitively wants 90 confidence
  level, what do you think sample size (n) would be?

4
The Auditor must specify parameters

• Risk of assessing control risk too low risk of
  over-reliance on internal controls (ARO or
  ARACR)
• Tolerable error rate (TER)
• Expected population error rate (EPER)
• Also first check number issued 1/2/xx and last
  check number issued 9/30/xx

5
Common Parameters in Practice

• 90-5-0 would be moderate controls reliance
• ARO10 Complement of confidence level is risk
• TER 5
• EPER0 for client with good controls

6
Concerning These Parameters

• How does the auditor determine EPER?
• Examples
• What was last years actual result?
• First time audit pilot sample of 50 (per AICPA
  industry audit guide)
• Does 5 TER bother you?
• Why such a high TER?
• Huge sample sizes if a more precise estimate is
  wanted, e.g. 2 TER!
• Year end substantive testing provides further
  utils of evidence

7
What Attributes Would We Want to Test? Examples

• Does check number and amount agree with entry in
  CDJ?
• Is check supported by a vendors invoice in that
  amount?
• Is there an authorized P.O. signed by purchasing
  agent?
• Is there a receiving report from the dock?
• Was check coutersigned if in excess of xx,xxx?
• Was final approval for payment authorized?
• Etc.

8
Lets do the Test

• Laptop computer and audit software would be used
• What if you are in West Texas and your hard drive
  crashed!
• Resort to tables
• Recall test parameters were 90-5-0
• T 15-8 Sample size calculation
• n45 checks randomly selected

9
Evaluating Sample Results

• Assume no compliance deviations for 9 of 10
  tested attributes (T15-9)
• 5.0 is upper bound
• What does this mean?
• We are 90 certain true rate of controls
  deviations doesnt exceed 5.0
• Is this acceptable?
• Yes, TER was 5

10
Evaluating Sample Results (Con.)

• Assume for one disbursement, no supporting P.O.
  could be found
• Can we select another check number randomly as
  substitute?
• NO!!!! Its a compliance deviation
• What is projected error rate upper bound?
• 8.4
• Is this acceptable?

11
What Options do we Have?

• Expand sample size? What would it be?
• In real world, probably wouldnt unless clearly
  due to sampling error
• Unless sampling error, very likely to find at
  least one more check with no supporting P.O.
• What if one more missing P.O. found in expanded
  sample?
• What is projected upper error rate? (assuming
  sample expanded by 35 checks)
• still unacceptable
• Many auditors would drop back ten and punt,
  alternatively expanding substantive testing in
  the area