Audit Sampling, Data Analytics and Decision Models

Introduction

Audit evidence is rarely obtained by examining every transaction. Modern audits therefore depend on disciplined methods for selecting items, evaluating exceptions, analysing complete populations where possible, and converting evidence into defensible conclusions. Sampling and data analytics are not substitutes for professional judgement; they are methods for managing audit risk and improving the relevance, reliability and efficiency of evidence.

This chapter examines statistical and non-statistical sampling, sampling risk, analytical procedures, ratio and trend analysis, exception testing, visualisation, and decision models. It treats these techniques as parts of one risk-based process: understand the population, identify the assertion and risk, design the procedure, evaluate results, and decide whether further work or modification of the audit conclusion is required.

Learning objectives

By the end of this chapter, the reader should be able to:

1. Explain the purpose and limitations of audit sampling.
2. Distinguish statistical from non-statistical sampling and select an appropriate method.
3. Design samples using risk, materiality, expected error and population characteristics.
4. Evaluate sampling risk, exceptions and projected misstatements.
5. Apply analytical procedures, ratio analysis and trend analysis.
6. Use data extraction, visualisation and exception testing to identify audit risks.
7. Integrate quantitative evidence with professional judgement and ethical safeguards.
8. Reach and document risk-based audit decisions.

1. Audit evidence, risk and the role of sampling

Audit sampling is the application of audit procedures to fewer than 100% of the items in a relevant population, such that every sampling unit has a chance of selection. The objective is to provide a reasonable basis for conclusions about the population.

The need for sampling follows from the audit risk model. A conventional planning representation is:

where AR is audit risk, IR is inherent risk, CR is control risk, and DR is detection risk. The model is a planning framework rather than a precise law of probability. Inherent and control risk are assessed risks; detection risk is influenced by the nature, timing and extent of audit procedures. When assessed risks are high, the auditor generally reduces acceptable detection risk by obtaining more persuasive evidence, which may include larger or more targeted samples.

Sampling does not eliminate audit risk. It creates sampling risk: the possibility that a conclusion based on a sample differs from the conclusion that would have been reached if the entire population had been tested. Non-sampling risk includes inappropriate procedures, failure to recognise an exception, inaccurate evaluation, or poor professional judgement. Increasing sample size addresses sampling risk, but not necessarily non-sampling risk.

Important terms include:

• Population: the complete set of data or transactions from which the sample is selected.
• Sampling unit: an individual item capable of selection, such as an invoice or account balance.
• Tolerable misstatement: the maximum misstatement that the auditor is willing to accept without concluding that the financial statement assertion is materially misstated.
• Expected misstatement: the amount of error the auditor expects to find, based on prior audits, preliminary procedures or knowledge of controls.
• Tolerable deviation rate: the maximum rate of control deviations acceptable without reducing reliance on the control.
• Sampling interval: the monetary or numerical distance between selected units in systematic sampling.

A population must be appropriate, complete and relevant to the assertion. For example, testing the sales ledger for completeness may be inappropriate because unrecorded sales are absent from that population; shipping records or cash receipts may provide a better source population.

2. Statistical and non-statistical sampling

Statistical sampling

Statistical sampling has three defining features: random selection, use of probability theory to evaluate sample results, and a measurable basis for assessing sampling risk. Random selection may be achieved through random-number generation or a validated audit-software function.

For a simple attribute estimate, the approximate standard error of an observed proportion is:

where p̂ is the observed exception proportion and n is sample size. The approximation assumes a sufficiently large random sample and a population that is not so small that finite-population effects become material. A confidence interval is commonly expressed as p̂ ± z × SE(p̂), although audit sampling standards often use specialised tables or exact methods, particularly where exceptions are rare or confidence requirements are high. Here z is the selected normal-distribution critical value.

For a mean estimate, the standard error is:

where x̄ is the sample mean, s is the sample standard deviation and n is the sample size. This formula is most useful for random samples and approximately normal sampling distributions; skewed monetary populations may require stratification or monetary-unit sampling rather than reliance on normal approximations.

Non-statistical sampling

Non-statistical sampling uses professional judgement rather than formal probability calculations. It can be rigorous when the auditor documents the population, selection logic, risk assessment and evaluation criteria. Haphazard selection—selection without conscious bias but without a random mechanism—must not be confused with convenience sampling. Convenience samples are generally weak because they may systematically exclude unusual, late, remote or difficult-to-access items.

Common non-statistical approaches include:

A sound audit may combine methods: test 100% of individually significant items, use monetary-unit sampling for the remaining balance, and perform analytical procedures over the complete population.

3. Designing a sample

Sample design should follow the audit objective, not precede it. The auditor should identify the assertion, define the population, determine the sampling unit, specify the deviation or misstatement condition, set tolerable error, estimate expected error, select a method, and document evaluation procedures.

For estimating a population proportion in a simple statistical setting, an approximate planning formula is:

where n₀ is the initial sample size, z is the critical value associated with the desired confidence level, p is the anticipated population proportion, and e is the permitted margin of error. If no reliable estimate of p exists, p = 0.5 gives the largest required sample for a specified z and e. This formula is an estimation formula, not a universal audit sample-size rule; audit-specific factors such as tolerable deviation, expected deviation, stratification and control reliance must also be considered.

For a finite population of size N, a finite-population adjustment may be applied:

This assumes a random sample and is useful where the population is not large relative to the initial sample. If the population is very large, n is approximately n₀.

Worked example: attribute sampling

An auditor plans to estimate an invoice approval-deviation rate. The desired confidence approximation is 95%, so z ≈ 1.96. The auditor has no reliable prior estimate and permits an error margin of 5 percentage points. Thus p = 0.5 and e = 0.05:

The initial sample is therefore about 385 items. If the population contains 2,000 invoices:

A sample of approximately 323 items would be indicated by this simplified estimation approach. In practice, the auditor would adjust for the audit objective, expected deviations, control reliance, stratification, non-response, and the applicable auditing standard. The example demonstrates mechanics, not a mandatory audit sample size.

Stratification and monetary-unit sampling

Stratification divides a population into relatively homogeneous groups. High-value items may be tested entirely, while lower-value items are sampled. This can improve efficiency because variability is reduced within each stratum.

Monetary-unit sampling (MUS) treats each currency unit as a sampling unit. Larger recorded balances have a higher probability of selection. MUS is often useful for overstatement testing where the recorded amount is the starting point. It is less naturally suited to detecting completely unrecorded liabilities, because items with zero recorded value cannot be selected from a recorded-value population. MUS also requires care where negative balances, unusual distributions or individually material items exist.

A common systematic selection procedure is:

where I is the sampling interval, V is the recorded value of the population after appropriate treatment of individually tested items, and n is the planned sample size. A random start between 1 and I is selected, followed by cumulative selections at the interval. The interval is meaningful only when the population is complete and ordered in a way that does not create periodic bias.

4. Evaluating sample results and sampling risk

The auditor must evaluate both the nature of exceptions and their quantitative effect. An exception may indicate a control failure, a monetary misstatement, fraud risk, a population-definition error, or merely an unusual but valid transaction. It should not be dismissed without investigation.

For an attribute test, the observed deviation rate is:

If 6 deviations are found in 200 items, the observed rate is 3%. The auditor must compare the evaluated upper deviation rate—not merely the observed rate—with the tolerable deviation rate. The upper rate reflects sampling risk and may be materially higher than 3%, especially in a small sample.

For substantive tests, a simple ratio projection is often used for homogeneous populations:

Example: a sample contains recorded values of CU 400,000 and identified overstatements of CU 8,000. The population book value is CU 5,000,000:

This projection assumes that the sample relationship is a reasonable representation of the untested population. It is not appropriate without modification where the population is highly skewed, the error is isolated, or sampling is based on monetary units. The auditor must add separately evaluated individually significant items and consider sampling risk, qualitative factors and the applicable reporting threshold.

Decisions may include accepting the population, expanding the sample, performing alternative procedures, reassessing control reliance, requesting adjustment, or concluding that a material misstatement remains. The decision should be linked to materiality and audit risk, not to an arbitrary number of exceptions alone.

5. Analytical procedures and decision models

Analytical procedures evaluate plausible relationships among financial and non-financial data. They are used in risk assessment, as substantive procedures, and near the end of the audit as an overall review. Their persuasiveness depends on the auditor's expectation, the reliability and disaggregation of data, the precision of the expectation, and the threshold for investigation.

Useful procedures include:

• comparison with prior periods and budgets;
• comparison with industry or operational benchmarks;
• analysis of relationships such as payroll cost per employee or gross margin;
• reasonableness tests, such as interest expense derived from average debt and contractual rates;
• investigation of unexpected movements and outliers.

A ratio is meaningful only when its numerator and denominator are consistently defined. Common ratios include:

The 365-day convention is an approximation and should be replaced by the relevant reporting period where appropriate. Ratios do not prove the absence of misstatement. For example, a stable gross margin may conceal offsetting errors in revenue and cost of sales.

Trend analysis examines movement over time. A simple percentage change is:

Trend interpretation should consider seasonality, acquisitions, price changes, foreign exchange, accounting-policy changes and changes in the business model. An unexplained 20% increase in revenue is not automatically evidence of fraud; it is a signal requiring corroboration.

A useful decision model classifies analytical results by magnitude and plausibility:

1. Expected and corroborated: obtain supporting evidence and document why the expectation is reliable.
2. Unexpected but explainable: investigate management's explanation and corroborate it with independent evidence.
3. Unexpected and uncorroborated: increase substantive testing and reconsider risk assessment.
4. Contradictory evidence: evaluate possible misstatement, fraud, management bias or data-quality failure.

The model prevents an attractive explanation from being accepted without evidence.

6. Exception testing, visualisation and audit data analytics

Audit data analytics (ADA) applies automated methods to inspect, transform, model and visualise audit-relevant data. Its greatest advantage is often population coverage: the auditor can test every journal entry against defined rules, while still using sampling for assertions that require source-document inspection or external confirmation.

A disciplined ADA workflow is:

1. define the audit question and relevant assertion;
2. obtain data with appropriate authority;
3. assess completeness and accuracy through reconciliations and control totals;
4. clean and transform data without destroying the audit trail;
5. specify rules or models before reviewing results where possible;
6. investigate exceptions using corroborating evidence;
7. validate conclusions and retain reproducible documentation.

Examples of exception tests include:

• duplicate invoice numbers or identical amounts and dates;
• postings outside normal business hours;
• manual journals posted directly to revenue or retained earnings;
• round-dollar entries or unusual descriptions;
• transactions just below approval thresholds;
• credit notes issued shortly after year-end;
• sequential gaps in invoices or goods-received notes;
• vendors sharing bank accounts, addresses or directors;
• journal entries posted by users with incompatible access rights.

Exception testing is not the same as proving an error. A duplicate amount may represent two legitimate purchases; an after-hours posting may result from an automated time-zone process. Every exception requires classification, follow-up and documented resolution.

Visualisation supports professional scepticism by making patterns visible. Appropriate charts include time-series lines for revenue and returns, box plots for transaction-value outliers, histograms for amount distributions, and network diagrams for relationships among vendors, employees and bank accounts. Dashboards should show population scope, filters, missing data, exception counts and investigation status. A visually impressive chart with an incomplete population is misleading.

A conceptual process is shown below.

Figure: A risk-based audit analytics process linking data quality, testing and decisions.

7. Technology, AI and governance

Automation can improve coverage but introduces risks. Scripts may contain coding errors, data may be truncated, and an algorithm may reproduce biased assumptions. AI-generated explanations or anomaly scores are audit aids, not audit evidence by themselves. The auditor remains responsible for understanding the method, validating inputs, evaluating false positives and false negatives, and retaining sufficient documentation for an experienced reviewer to reproduce the work.

Governance should address access rights, confidentiality, encryption, retention, model versioning, change control and segregation of duties. Client data should not be uploaded to an unapproved public AI service. Where a model ranks transactions by risk, the auditor should understand the variables used and test whether important classes of transactions are systematically excluded. Explainability is especially important when analytics influence the extent of audit work.

Relevant professional principles include professional competence and due care, integrity, objectivity, confidentiality and professional scepticism. Data analytics must comply with applicable privacy, financial reporting and auditing requirements. A complete audit trail should show the source data, extraction date, transformations, parameters, exceptions, follow-up and final conclusion.

8. Illustrative case: Northstar Retail Group

Background

Northstar Retail Group, an illustrative multi-channel retailer, reports revenue of CU 120 million. Online sales grew by 28%, while cash collections grew by only 10%. Management explains the difference as a change in payment terms and increased year-end promotions.

Problem

The audit team must assess revenue occurrence and cut-off, receivables valuation, and the risk that manual journals or post-year-end credit notes inflated reported revenue.

Analysis

The team first reconciles the sales extract to the general ledger and tests record counts, control totals and date ranges. It then performs full-population tests for duplicate order numbers, shipments after year-end recorded before year-end, unusual manual journals, and credit notes issued within 30 days after year-end. It stratifies receivables: individually significant balances are tested in full; the remainder is sampled by monetary unit.

Analytics identify 1,840 transactions recorded on the final two days of the year, including 74 with shipment dates in the following period. Of these, 12 exceed the performance-materiality threshold in aggregate. A sample of 80 ordinary sales transactions finds 3 pricing errors, projected to CU 42,000, below materiality but above the expected-error estimate. Subsequent credit-note analysis identifies CU 310,000 relating to goods returned under a promotion not disclosed to the audit team.

Approach and outcome

The auditors obtain dispatch records, customer contracts, return reports and confirmations. They conclude that CU 275,000 of revenue was recorded before control transferred and propose an adjustment. They expand cut-off testing, reassess the risk of management override, and communicate a control deficiency concerning automated cut-off interfaces. The pricing errors are corrected and the remaining projected error is evaluated with other uncorrected misstatements.

Learning points

The case illustrates that full-population analytics can identify risk concentrations, but source-document testing is still required. A plausible management explanation must be corroborated. Projection is not a substitute for investigating identified exceptions. Finally, sampling, analytics and professional judgement are complementary rather than competing approaches.

9. Limitations and best practices

Sampling conclusions may be unreliable when the population is incomplete, transactions are heterogeneous, selection is biased, or exceptions are not defined consistently. Analytical procedures may fail when data is unreliable, expectations are imprecise or relationships are unstable. Visualisations may encourage confirmation bias, and automated tests may generate too many exceptions to investigate meaningfully.

Best practice is to:

• start with assertions and risks, not available software;
• reconcile data to authoritative records;
• test completeness before interpreting patterns;
• separate individually significant items from the residual population;
• document the rationale for sample size and selection;
• investigate every material or unusual exception;
• evaluate qualitative as well as quantitative effects;
• use independent evidence to corroborate explanations;
• review code, formulas and transformations;
• retain reproducible working papers;
• reassess risk when results contradict the initial assessment.

Chapter Summary

Audit sampling provides a structured basis for drawing conclusions from less than the full population, but sampling risk and non-sampling risk must be distinguished. Statistical sampling uses random selection and probability-based evaluation; non-statistical sampling relies on documented professional judgement. Sample design depends on the assertion, population, materiality, tolerable error, expected error and assessed risk.

Sample results must be projected and evaluated with sampling risk, individually significant items and qualitative considerations. Analytical procedures use expectations, ratios, trends and relationships to identify inconsistencies, while exception testing and visualisation reveal unusual transactions and concentrations. Audit data analytics can examine entire populations, but data completeness, algorithmic reliability, privacy and reproducibility remain essential. Effective audit decisions integrate quantitative results with corroboration, professional scepticism, ethical judgement and clear documentation.

Key Terms

Audit sampling: Applying audit procedures to fewer than all items in a population.

Population: The complete set of items relevant to an audit procedure.

Sampling unit: An individual item capable of selection.

Sampling risk: Risk that a sample-based conclusion differs from a full-population conclusion.

Non-sampling risk: Risk arising from inappropriate procedures, errors or poor judgement.

Statistical sampling: Sampling using random selection and probability-based evaluation.

Non-statistical sampling: Sampling based primarily on professional judgement.

Tolerable misstatement: Maximum acceptable misstatement for an assertion.

Expected misstatement: Misstatement anticipated before testing.

Tolerable deviation rate: Maximum acceptable control-deviation rate.

Stratification: Dividing a population into relatively homogeneous groups.

Monetary-unit sampling: Sampling in which currency units determine selection probability.

Sampling interval: Distance between systematic selections.

Analytical procedures: Evaluations of plausible relationships among data.

Exception testing: Testing designed to identify transactions or records meeting risk indicators.

Projection: Estimating population misstatement from sample results.

Audit data analytics: Automated analysis of audit-relevant data.

Professional scepticism: An alert and questioning mind when evaluating evidence.

Review Questions

Short Answer Questions

1. Distinguish sampling risk from non-sampling risk.
2. What conditions must a population satisfy before sampling begins?
3. Explain why monetary-unit sampling is useful for overstatement testing.
4. State two limitations of analytical procedures.
5. Why must exceptions identified by data analytics be corroborated?

Long Answer Questions

1. Compare statistical and non-statistical sampling, including their advantages, limitations and appropriate uses.
2. Explain the stages of designing and evaluating an audit sample.
3. Discuss how ratio and trend analysis support risk assessment and substantive audit work.
4. Evaluate the governance risks associated with AI-supported audit analytics.
5. Explain how sampling, stratification and full-population testing can be combined in a risk-based audit.

Analytical / Application Questions

1. A sample of 150 invoices contains 5 approval deviations. Explain the additional information needed before deciding whether reliance on the control remains appropriate.
2. Revenue increases by 25%, receivables by 48% and cash collections by 8%. Develop an analytical response, identify possible explanations, and specify corroborating procedures.
3. Design an audit-analytics workflow for detecting management override through journal-entry testing. Include data validation, risk rules, investigation and documentation.

Multiple Choice Questions with Answers

Question 1

Which feature distinguishes statistical audit sampling from non-statistical sampling?

A. It always examines more than half of the population.

B. It uses random selection and probability-based evaluation.

C. It excludes individually significant items.

D. It guarantees that no audit risk remains.

Correct Answer: B. It uses random selection and probability-based evaluation.

Question 2

If 6 deviations are found in a sample of 200 items, what is the observed deviation rate?

A. 0.3%

B. 3%

C. 6%

D. 30%

Correct Answer: B. 3%

Question 3

Which population is most appropriate for testing completeness of recorded sales?

A. The recorded sales ledger alone

B. The list of sales invoices selected by management

C. Independent shipping records compared with recorded sales

D. Only the largest customer accounts

Correct Answer: C. Independent shipping records compared with recorded sales

Question 4

Using the simplified projection formula, a sample misstatement of CU 8,000 in sample book value CU 400,000 and population book value CU 5,000,000 projects to:

A. CU 40,000

B. CU 80,000

C. CU 100,000

D. CU 160,000

Correct Answer: C. CU 100,000

Question 5

What is a principal limitation of monetary-unit sampling?

A. Large recorded balances have a lower chance of selection.

B. It cannot select items with zero recorded value from a recorded-value population.

C. It requires every transaction to be tested.

D. It is designed only for control testing.

Correct Answer: B. It cannot select items with zero recorded value from a recorded-value population.

Question 6

Which ratio is calculated as trade receivables divided by credit revenue multiplied by 365?

A. Current ratio

B. Gross margin

C. Receivables days

D. Debt-to-equity ratio

Correct Answer: C. Receivables days

Question 7

An unexplained analytical fluctuation should normally lead the auditor first to:

A. Ignore it if management provides a verbal explanation.

B. Automatically conclude fraud occurred.

C. Investigate and corroborate the explanation.

D. Delete the underlying data.

Correct Answer: C. Investigate and corroborate the explanation.

Question 8

Which is an example of an audit data-analytics exception test?

A. Testing only the first invoice in the population

B. Identifying journals posted directly to retained earnings

C. Accepting all transactions below materiality without review

D. Replacing source evidence with a dashboard colour

Correct Answer: B. Identifying journals posted directly to retained earnings

Question 9

What is the main purpose of finite-population adjustment in the sample-size formula?

A. To increase the sample when the population is small relative to the initial sample.

B. To eliminate the need for random selection.

C. To convert monetary sampling into attribute sampling.

D. To guarantee a zero misstatement rate.

Correct Answer: A. To increase the sample when the population is small relative to the initial sample.

Question 10

Which governance practice is most appropriate when using AI to rank audit anomalies?

A. Use the model without understanding its inputs.

B. Upload confidential client data to any public AI tool.

C. Validate data, understand the model and retain a reproducible audit trail.

D. Treat the model's ranking as conclusive audit evidence.

Correct Answer: C. Validate data, understand the model and retain a reproducible audit trail.