Audit Sampling - Internal Audit, Auditing and Secretarial Practice Video Lecture | Auditing and Secretarial Practice - B Com

in our lecture today we're going to
focus on sampling sampling is an
important topic for auditors because
generally speaking most of the auditing
that we do involves looking at less than
100 percent of transactions in fact in
the second paragraph the of the audit
opinion letter we explicitly state that
the assessment of internal controls
transactions and account balances is on
a test basis we use sampling for a test
of controls and direct substantive
testing of account balances and
assertions keep in mind that when we're
looking at tests of controls we are
doing this to assess the control risk
and we are looking at transactions when
we are using or doing direct substantive
testing we are measuring monetary in a
statement in account balances and
assessing the assertions each of these
types of testing requires a specific
type of sampling we also have
generalized accept generalized audit
software these are programs designed
specifically for auditors in fact in
your book you have a generalized audit
software which is the ACL program this
actually facilitates and automates
testing of 100% of populations it
focuses attention on specific risk areas
or transactions we're able to identify
duplicate items as well as missing items
and in fact generalize accepted or
generalized auditing software actually
helps facilitate picking a sample within
a population let's talk about the
objectives of sampling and risks
associated with sampling the objectives
are first determining whether controls
are operating effectively whenever you
see the word controls what we're looking
at is we're looking at the control risk
of the organization where we are
attempting to measure the risk of
material misstatement when we're looking
at controls we are looking at
the transactions and determining whether
controls over transactions are operating
effectively the next piece is estimating
the amount of misstatement in account
balances this is our substantive testing
and in the substantive testing is we are
measuring material in a statement or
measuring misstatements in account
balances now we have two types of risks
we have non sampling risk non sampling
risk is simply the auditor reaching and
in an erroneous conclusion for any
reason not related to sampling risk the
auditor may make a mistake
the auditor may assess something
inappropriately but this is a risk that
has nothing to do with sampling sampling
risk is really what we're focusing on
here this is where the auditors
conclusion is based on a sample that is
different from the conclusion if we were
to have tested the entire population so
as we're considering sampling it's very
important that we have a very rigid
structured process to identify the
sample items because it's critical that
the sample population reflects the
overall population of what's taking
place within transactions were account
balances now we have an interesting
table here this is exhibit 8 - in the
book this is related to sampling risk
for tests of controls again what we're
looking at is we are looking at the test
of controls so this is the control risk
what you notice on the side we have the
auditors assessment and on the top we
have the actual state of the controls
for the entire population so what we're
considering is are we actually doing
making a correct conclusion so a so as
you look at this if our assessment is
low and the actual state of controls is
that the controls are effective then we
have the appropriate conclusion
if our assessment of control risk is
high and in fact the controls are not
working appropriately then we also have
a correct conclusion what we're
concerned with specifically related the
sampling risk is our conclusion is
different from the actual state of the
controls of the entire population so you
notice that if the audit assessment of
control risk is low but in fact the
controls are not effective this is
clearly going to lead to ineffective
auditing and control failures in the
population are higher than the sample
indicates so we have the risk of
incorrect acceptance of the internal
control reliability now let's look at
the other side let's say that the
auditor assesses the control risk is
high but in fact the actual state of
controls is just fine is that the
controls are effective what we have here
is the risk of incorrect rejection of
the internal control reliability this
also leads to audit inefficiency we're
considering also the sampling risk for
tests of details of account balances so
again what we're looking at here is we
are measuring the monetary misstatement
within account balances this is our
substantive testing and this is where we
are drawing our conclusions as to the
fair presentation of the financial
statement so we have the two the two by
two matrix the auditors conclusion based
upon the sample evidence and the actual
condition of book value based upon the
entire population so again we could be
right on both counts let's say that the
book value does not contain any material
misstatement and our sampling is correct
there is no material misstatement we are
correct if there is a material
misstatement in actuality and we
identify the material
statement then we're also correct but
what we're concerned with is the
sampling risk where the actual condition
does not contain a material misstatement
but in fact we identify a material in a
statement this is the risk of incorrect
rejection of Book value and on the flip
side if we identify no material
misstatement but in fact there are
material misstatements this is the risk
of incorrect acceptance of the book
value clearly leads to audit efficiency
and this is certainly a risk a
significant risk that the auditor is
concerned with the auditor does not want
to issue an unqualified opinion when in
fact there are material misstatements so
going back to the audit risk model that
we've talked about before this is really
going to be the focus of our attention
when we talk about sampling we need to
understand that there's different types
of sampling strategies we have
statistical sampling and non statistical
sampling statistical sampling is where
we the application of probability theory
and statistical inference along with the
auditor's judgment and experience in a
sample application in statistical
sampling the goal of this procedure is
that we identify a sample that
replicates the entire population so
again the key word is inference so we
can infer what's going on in the sample
to the entire population this is
absolutely the strategy that we're going
to be using in most of our testing of
the account balances on the other side
we have non statistical sampling this is
the application of auditor judgment and
experience in a sample application this
is something that we might consider
doing in certain types of tests of
controls especially when we're
considering fraud or other types of
errors that are specific maybe to a
location to a specific per
into a time of day to a day whatever
we're doing in non statistical sampling
the way I liken it to is attempting to
identify that needle in a haystack
so we carve out the the the population
in such a way that the sample is
reflective of the concerns that we have
and we're trying to identify examples of
the the missing control now this is a
perfectly acceptable strategy the thing
that we need to understand with non
statistical sampling is we do not have
the inference so we cannot go from
identifying something in a non
statistical sampling to the entire
population I think probably this is one
of the biggest misunderstanding
students have and early Auditors is how
important the sampling strategy is in
terms of interpreting the results and
extrapolating these or making inferences
to the entire population attribute
sampling is a type of sampling that we
do generally as it it associated to
internal controls in attribute sampling
what we are doing is we are looking for
specific attributes or characteristics
of the population that is interest to
the auditor so we might be looking at
procedure failures based upon selecting
one sample and performing the
appropriate audit procedure a classic
example of this is the control states
that every check over $10,000 requires
two signatures that is an attribute that
we would be looking at that's a control
procedure so what we would do as an
auditor is we would take a sample of
checks over $10,000 and look for the
attribute of the second signature at
your each sampling is perfectly designed
for the test of controls it's not really
designed for our testing of our
substantive testing where we are in
majoring monetary statements we're going
to talk about some very specific steps
related to attribute sampling number one
is we define the attribute of interest
and what constitutes the failure
critical for us to understand the
control environment and as we are
assessing risk specifically related to
the inherent risk what we need to
understand is where are the risks and
what is management doing in terms of
controlling these risks once we
understand what management is doing is
in our attribute sampling what we're
attempting to do is look for the
attribute that determines the fact that
the controls are working appropriately
we define the population from which the
sample is to be taken we determine the
sample size we determine the method of
selecting the sample we select the
sample items and performing the test of
controls evaluate the sample results and
consider the effect on the planned
substantive procedures so when we're
talking about six item six is what we're
doing is we are using this information
to evaluate the risk of material
misstatement again the key word is risk
obviously we need to document all phases
of the sampling process so that the
reviewer as he or she is looking at this
material understands what's taking place
defining the actuary well we basically
have talked about that is we need to
understand what the controls are why
they're there and what it is that we're
going to look at we need to ensure that
the auditor understands what's what to
look for seems obvious you'd be
surprised how many people attempt to
start a test of attributes I'm not
really sure what to look for this is why
it's absolutely critical that you
understand the process before you start
sampling we need to reduce the risk of
any non sampling risk and again back to
the point of non sampling risk
as we are looking at the right items
we're just not looking at the right
items correctly so non-sampling risk is
critical and again it's part of the
planning to understand what we're
looking for we define the population
from which the sample is to be taken the
period to be covered the sampling unit
and we need to understand the
completeness of the population so if
there's items in the population that are
not there well we're not going to be
able to identify those in our attribute
testing so the completeness becomes a
part of the testing before we actually
identify the population and do the
testing sampling risk we identify the
tolerable rate of deviation what level
we will tolerate and then the expected
population deviation or the expected
failure rate an anticipation of
deviation rate for the entire population
so the key terms are tolerable tolerable
rate of deviation and the expected
population of the deviation so the
tolerable and expected the first item is
the sampling risk so these are three
elements that we consider and in fact
these are the three elements that we
would plug in to the sample selection in
the ACL program simple random sampling
is selecting a random sample by matching
random numbers generated by a computer
or selected from a random number table
this is done with for example document
numbers systematic sampling divide the
number of physical units in the
population and determine a uniform level
so if there's a thousand items in the
population we've determined that the
sample size is a hundred what we would
do is we would take every tenth item
systematic random sample the first item
selected randomly from the interval
systematic random sampling generally
speaking works best when
you have a stack of papers or a stack of
checks and you're attempting to go
through these to look for a specific
attribute random sampling works best
when especially when we're looking at
electronic information so we can extract
that electronic information now keep in
mind that simple random sampling can be
done with the ACL computer once we
identify the sampling risk the expected
and tolerable rates of error is the
system will generate a sample and based
upon the population in the data file it
will actually select the actual sample
for us to use half hazard sampling
attempts to approximate a random
selection by selecting sample units
without any conscious basis or bias or a
special reason for including or omitting
certain items from the sample haphazard
sample works especially when we don't
have a strong basis of understanding the
entire population many times I've
received the stack of documents and you
can sort of estimate how many items are
there but you certainly can't do this in
a very systematic way so in a haphazard
sample we're just randomly pulling
documents out and reviewing these block
sampling is selecting a sample that
consists of a continuous population item
such as selecting transactions by day or
by week selecting sample items and
performing tests of controls when
selecting the sample the auditor decides
how to handle in applicable voided or
unused documents if the in applicable
document does not represent the control
being tested it should be replaced by
another randomly selected item a lot of
times what you'll see is items that are
selected that for whatever reason don't
really have any basis for the control
doesn't reflect any control weakness and
it really should not be a part of the
sample so we basically then just
randomly select another item when the
selected items cannot be located it
should be assessed as a failure if many
failures are found if you conclude that
no reliance can be placed on the tested
control procedure evaluating the sample
results in considering the effect
unplanned substantive procedures again
this is where we are assessing the risk
of material misstatement assessing the
risk of material misstatement is
critical to our testing because this
determines the nature timing and extent
of our substantive testing so we're
looking at our results both
quantitatively and qualitatively
quantitatively is determined whether the
upper limit of possible deviation rate
exceeds the tolerable deviation rate so
again in our sample selection is we
determine the expected and the tolerable
rate if we identify a sample error rate
that's greater than the tolerant won't
rate then we've got a problem
qualitative evaluation which is probably
more effective in many cases is what
we're determining is whether the
failures were intentional or
unintentional were they random or
systematic they had a direct dollar
effect on account balances or were of
such magnitude that a material dollar
amount of errors could could occur and
not be detected one of the interesting
things is when we start doing the
sampling and especially and what we're
talking about here is we are selecting a
random sample if we identify things that
seem suspicious or systematic it's very
possible that we may go back and look at
a judgment sample or a non probabilistic
sample to identify specific issues that
we uncovered in our sampling technique
this is especially critical as we're
looking at internal controls and
especially as we are assessing the risk
of fraud within our audit procedures if
controls are not operating effectively
the auditor will choose to rely less on
substantive analytical procedures more
untested details of those accounts
related to identified control failures
and in an integrated audit and again
remember the integrated audit is the
sarbanes-oxley 404 testing that is
combined with our financial statement
audit where we are providing an opinion
both on the financial statement as well
as the internal controls over financial
reporting so in an integrated audit we
may need to issue an adverse opinion on
the internal control effectiveness this
is a critical point because what we need
to understand is that in a financial
statement audit if the controls are not
effective the end result is this is
going to affect the nature timing and
extent of our substantive procedures in
an integrated audit because the
additional testing that we're doing also
relates to the internal control
effectiveness is what we are concerned
with here is our opinion that we need to
write in regards to the internal control
effectiveness the final point that we
want to talk about and again what we're
what we are dealing with here is the
sampling process for our testing of
controls primarily what we're looking at
is we're looking at attribute sampling
all preceding steps and related
decisions regarding sampling process
should be documented we should allow for
appropriate supervision and provide
adequate support for the conclusions
that are reached and part of the
supervision is a review of the documents
that are the exceptions we may even want
to review some of the documents that are
not added in exceptions just to make
sure that we have identified the
appropriate conclusion based upon our
testing so what we've talked about here
is we're then
five sampling we've identified sampling
risk and then in these seven steps is
we've identified specific steps for the
sampling process related to the testing
of internal controls in our next lecture
we're going to focus specifically about
the testing related to our substantive
testing where we are measuring monetary
misstatement thank you very much for
your time