Discovery sampling in auditing is a statistical technique for confirming that a rare, high-stakes control failure has not occurred anywhere in a large population of transactions. An auditor calculates a sample size from three inputs, pulls that many items at random, and inspects each one for a specific deviation. Finding none supports the conclusion that the control is operating as intended. Finding even one ends the test and forces the auditor to treat the control as ineffective.
The Question Discovery Sampling Answers
Discovery sampling is built for a yes-or-no question: does this specific problem exist at all? It is not trying to estimate whether 3% or 5% of transactions are flawed. The auditor already believes the deviation rate is zero and wants statistical evidence to support that belief, usually because any single failure would be serious enough to investigate on its own.
Dual-authorization on large wire transfers is the textbook case. A company requires two officers to approve any transfer above a threshold, and the auditor expects every transfer to carry both signatures. One missing signature could point to fraud, a systemic breakdown, or both. Regulators and internal audit teams favor discovery sampling here because it gives a defensible statistical basis for saying the population is essentially free of the high-risk error being tested.
The Three Inputs That Set Sample Size
Three numbers drive the calculation. Get any of them wrong and the sample either wastes resources or fails to support the conclusion.
The first is the desired confidence level, sometimes called reliability. It represents the probability that the sample will catch at least one deviation if the true deviation rate exceeds the tolerable threshold. High-risk audits typically use 95% or 99%. A 95% confidence level means the auditor accepts a 5% risk that the sample misses existing deviations, which the PCAOB calls the “allowable risk of assessing control risk too low.”1Public Company Accounting Oversight Board. PCAOB Auditing Standard AS 2315 – Audit Sampling
The second is the maximum tolerable deviation rate. In discovery sampling this is set low, often between 0.1% and 1%, because the whole point is to detect rare events. A lower tolerable rate demands a larger sample.
The third is the expected population deviation rate, which for discovery sampling is assumed to be zero.
Population size matters far less than most people expect. Once the population exceeds a few thousand items, the required sample barely moves whether the pool is 10,000 or 10 million. Confidence level and tolerable rate do almost all the work. Using standard statistical tables or software, 95% confidence with a 0.5% tolerable rate calls for roughly 600 items. Raising confidence to 99% at the same tolerable rate pushes the sample to about 920.
How Items Get Selected
Every item in the population needs an equal chance of being picked. Without that randomness, the statistical conclusion collapses. Two methods are standard.
Random number selection uses software to generate numbers matching transaction identifiers, invoice numbers, or record positions, and the auditor pulls only the matching items. It is clean and defensible, which is why it is the default. PCAOB standards require that items for a statistical sample be selected randomly from the population.1Public Company Accounting Oversight Board. PCAOB Auditing Standard AS 2315 – Audit Sampling
Systematic selection picks a random starting point and then takes every nth item until the sample is complete. For 600 items drawn from 60,000 transactions, the interval is every 100th record. It works well on sequentially organized data, but it can introduce bias if the population carries a hidden pattern that lines up with the interval.
Either way, the auditor records exactly how items were chosen. A poorly documented selection process can undo an otherwise sound statistical conclusion when a reviewer or regulator traces the work.
Reading the Results
The outcome is binary. The sample is clean or it isn’t, and the interpretation has no middle ground.
Zero Deviations Found
When every tested item comes back clean, the auditor can state at the chosen confidence level that the true deviation rate in the population falls below the tolerable rate. At 95% confidence with a 0.5% tolerable rate, the conclusion is that there is no more than a 5% chance deviations occur in more than 0.5% of the population. The tested control is operating effectively.
One or More Deviations Found
A single deviation invalidates the statistical conclusion. The auditor can no longer assert that the deviation rate sits below the tolerable threshold. One exception out of 600 items looks small as a percentage, but the design was built around an expectation of zero, and one is enough to break it.
The practical fallout escalates fast. The auditor typically moves to substantive testing or expands the investigation to determine the scope and cause of the failure. The control gets reported as ineffective, which can lead to classification as a significant deficiency or a material weakness. Under PCAOB standards, a material weakness exists when there is a reasonable possibility that a material misstatement won’t be prevented or detected on a timely basis, and fraud by senior management is specifically listed as an indicator.2Public Company Accounting Oversight Board. PCAOB Auditing Standard AS 2201 – An Audit of Internal Control Over Financial Reporting
When to Use Discovery Sampling Instead of Attribute Sampling
Discovery sampling is technically a special case of attribute sampling, not a separate method. Attribute sampling tests whether a control attribute is present or absent and estimates the actual deviation rate across the population. It is the right tool when the auditor expects some level of error and wants to measure how much.1Public Company Accounting Oversight Board. PCAOB Auditing Standard AS 2315 – Audit Sampling
Discovery sampling narrows that framework to a scenario where the expected deviation rate is zero and the tolerable rate is well under 1%. Attribute sampling might use a tolerable rate of 5% or higher. Using discovery sampling when failures are actually common wastes effort, because the first deviation ends the analysis before any useful rate estimate is possible.
What Discovery Sampling Cannot Do
The method answers a yes-or-no question and nothing more. If the first tested item reveals a deviation, the auditor knows a problem exists but has no statistical basis for saying whether it affects 0.1% or 50% of the population. Scoping the problem requires a different approach.
It also assumes the tested attribute is the right one. A control requiring dual signatures might be followed on every transaction, but if both signatures come from people who never review the underlying documentation, the sample will show zero deviations while the real risk goes undetected. Statistical rigor in sampling doesn’t compensate for a poorly designed audit test.
Nonsampling Risk
The largest threat to any sampling conclusion sits outside the math. Nonsampling risk covers everything that can go wrong even with a perfectly designed sample. An auditor might pick the wrong procedure entirely, or might examine a document and fail to recognize the problem in it. As the PCAOB notes, an auditor can apply a procedure to every single transaction and still miss a material misstatement. Planning, supervision, and well-designed audit programs reduce nonsampling risk but can’t eliminate it through statistical methods alone.3Public Company Accounting Oversight Board. AU 350 – Audit Sampling
Documentation That Has to Back It Up
Every piece of the process needs to be on paper to support the final opinion. That includes the three statistical inputs (confidence level, tolerable deviation rate, expected deviation rate), the method used to select items, the specific items tested, and the results of each examination. The PCAOB expects auditors to have considered the tolerable rate, the likely rate of deviation, and the allowable risk of assessing control risk too low when determining sample size.1Public Company Accounting Oversight Board. PCAOB Auditing Standard AS 2315 – Audit Sampling
The final conclusion, effective or ineffective, must be clearly stated and tied back to the statistical evidence. If deviations were found, the documentation also needs to cover what additional testing was performed, what the root cause analysis revealed, and how the finding affected the broader assessment of internal controls. Reviewers trace the logic from sample design through to the reported conclusion, and gaps in that chain undermine the whole test.