Statistical sampling in auditing is the practice of testing less than 100 percent of the items in an account balance or class of transactions using a randomly drawn sample, then evaluating the results with probability theory so the auditor can state, in numeric terms, how much risk exists that the conclusion is wrong. The volume of data in modern accounting systems makes examining every transaction impractical, and statistical methods give the auditor a measurable level of assurance that the sample reflects the population. The distinction from other sampling comes down to one thing: statistical sampling lets you quantify exactly how much risk you are taking by not looking at everything.
What Makes a Sample “Statistical”
Two requirements separate statistical sampling from non-statistical sampling: the selection must be random, and the results must be evaluated using statistical methods.1Public Company Accounting Oversight Board. AS 2315 – Audit Sampling If either element is missing, the sample is non-statistical regardless of how large it is.
Non-statistical (or judgmental) sampling relies on the auditor’s professional experience to pick items for testing. That approach works in certain situations, but it cannot produce a number representing the probability that the conclusion is wrong. Statistical sampling can. An auditor using statistical methods can say something like “there is no more than a 5 percent chance this sample isn’t representative of the population,” and that statement is mathematically grounded rather than intuitive.2Office of the Comptroller of the Currency. Comptrollers Handbook – Sampling Methodologies That measurability is the point.
The practical payoff is efficiency. Instead of examining tens of thousands of invoices, the auditor tests a scientifically determined number and reaches a conclusion about the entire account. The conclusion carries a known margin of uncertainty, which is disclosed and managed rather than ignored.
The Risks Statistical Sampling Is Designed to Measure
Before pulling a sample, the auditor must confirm the population is complete. The population is the full set of items the conclusion will cover: every sales invoice issued during the fiscal year, every inventory tag in a warehouse, every disbursement from a particular account. Testing a sample from an incomplete population produces conclusions about the wrong universe of transactions.1Public Company Accounting Oversight Board. AS 2315 – Audit Sampling
Sampling Risk
Sampling risk is the possibility that the auditor’s conclusion based on the sample differs from the conclusion that would be reached by testing every item.1Public Company Accounting Oversight Board. AS 2315 – Audit Sampling Increasing sample size reduces this risk but cannot eliminate it without full examination.
In substantive testing, sampling risk takes two forms. The risk of incorrect acceptance is the danger of concluding that an account balance is fairly stated when it actually contains a material misstatement. The risk of incorrect rejection is concluding the balance is misstated when it is fine.1Public Company Accounting Oversight Board. AS 2315 – Audit Sampling Incorrect acceptance is the far more consequential error. Incorrect rejection leads to extra investigative work; incorrect acceptance means a flawed audit opinion goes out the door, which can mean misleading financial reports, regulatory action, and litigation.
For tests of controls, the parallel risks are assessing control risk too low (relying on a control that isn’t working) and assessing control risk too high (distrusting a control that is working, which leads to unnecessary additional testing).1Public Company Accounting Oversight Board. AS 2315 – Audit Sampling
Non-Sampling Risk
Non-sampling risk covers every part of audit risk unrelated to sample size. An auditor can examine every single item in a population and still miss a material misstatement if the wrong procedure was used or the auditor failed to recognize a problem in the documents reviewed. Confirming recorded receivables, for instance, won’t reveal receivables that were never recorded. That’s not a sampling failure; it’s the wrong test for the objective. Adequate planning, supervision, and quality control within the audit firm can reduce non-sampling risk to a negligible level.3Public Company Accounting Oversight Board. AU Section 350.11 – Audit Sampling
Confidence Level
The confidence level is the flip side of sampling risk. A 95 percent confidence level means the auditor accepts no more than a 5 percent risk that the sample isn’t representative of the population.2Office of the Comptroller of the Currency. Comptrollers Handbook – Sampling Methodologies Higher confidence requires a larger sample. For tests of controls where the auditor plans to rely heavily on a control, confidence levels of 90 or 95 percent are typical.4U.S. Department of Housing and Urban Development Office of Inspector General. Appendix A – Attribute Sampling For substantive testing, the auditor may accept a lower initial confidence level when other procedures such as analytical review also address the same assertion.
The Thresholds Set Before Testing Begins
In substantive testing, tolerable misstatement is the maximum dollar-amount error that can exist in an account balance without making the financial statements materially misstated.1Public Company Accounting Oversight Board. AS 2315 – Audit Sampling It flows directly from the auditor’s materiality judgments during planning.
In tests of controls, the equivalent is the tolerable deviation rate: the maximum rate of control failures the auditor can accept while still concluding the control works well enough to rely on.1Public Company Accounting Oversight Board. AS 2315 – Audit Sampling A common threshold is 5 percent, though this varies with the importance of the control.
What Drives Sample Size
Sample size is driven by the interplay of several factors. For substantive tests, the auditor weighs the tolerable misstatement, the allowable risk of incorrect acceptance (which depends on assessments of inherent risk, control risk, and whether other substantive procedures cover the same assertion), the expected size and frequency of misstatements, and the characteristics of the population.1Public Company Accounting Oversight Board. AS 2315 – Audit Sampling The relationships are intuitive once you see them: a smaller tolerable misstatement requires more testing, a higher assessed risk of errors requires more testing, and a population where misstatements are expected to be common or large requires more testing.
For tests of controls, the parallel factors are the tolerable deviation rate, the likely rate of deviations, and the allowable risk of assessing control risk too low.1Public Company Accounting Oversight Board. AS 2315 – Audit Sampling Tighter tolerances and higher expected errors both push sample sizes up. In practice, auditors use published sample size tables or software rather than manual calculations.4U.S. Department of Housing and Urban Development Office of Inspector General. Appendix A – Attribute Sampling
Stratification
One effective way to reduce sample size without losing assurance is stratification. The auditor divides the population into relatively homogeneous subgroups based on characteristics such as recorded dollar value, then samples from each separately.1Public Company Accounting Oversight Board. AS 2315 – Audit Sampling High-value items that individually exceed tolerable misstatement get examined 100 percent and are not part of the sampled population at all. The remaining items are then sampled from a more uniform group, which reduces variability and allows a smaller sample.
Two Families: Attribute Sampling and Variable Sampling
Attribute Sampling for Tests of Controls
Attribute sampling answers one question: how often does a control fail? The auditor defines a specific attribute (a required signature, a matching purchase order number, evidence of a credit check) and counts how many sampled items lack it. The result is a deviation rate, not a dollar amount.
The process runs like this: set the confidence level and tolerable deviation rate, determine the expected deviation rate, pull the sample size from a table or formula, select items randomly, inspect each one, and calculate the upper deviation rate. The upper deviation rate represents the highest likely failure rate in the full population given the sample results. If it falls below the tolerable deviation rate, the auditor concludes the control is working well enough to rely on. If it exceeds the tolerable rate, the auditor cannot rely on that control and must expand substantive testing for the related account assertion.1Public Company Accounting Oversight Board. AS 2315 – Audit Sampling
Variable Sampling for Substantive Tests
Where attribute sampling measures rates, variable sampling measures dollars. The goal is to determine whether an account balance is materially misstated. Two main techniques are used.
Monetary unit sampling (MUS), also called probability-proportional-to-size sampling, is the most widely used statistical method for substantive testing. The sampling unit is the individual dollar rather than the individual transaction. Every dollar in the population has an equal chance of being selected, which means larger transactions are proportionally more likely to be picked. A $100,000 receivable is ten times more likely to appear in the sample than a $10,000 receivable. This built-in stratification is a major practical advantage: high-value items that are most likely to contain material misstatements get the heaviest scrutiny without manually creating strata. MUS also does not require the auditor to estimate the population’s standard deviation before calculating sample size, which simplifies planning. The trade-off is that MUS catches overstatements much more reliably than understatements, because low-value items have low selection probabilities. An item recorded at $500 that should be $50,000 is unlikely to be picked. MUS works best for asset and revenue accounts where overstatement is the primary risk.
Classical variables sampling (CVS) selects physical items (invoices, account balances, journal entries) rather than individual dollars. Each record has an equal probability of selection regardless of its size. CVS uses normal distribution theory to estimate the total population value or total misstatement, employing techniques such as mean-per-unit, difference, or ratio estimation. Because selection probability is independent of recorded value, CVS handles understatements without the structural weakness that affects MUS. It is generally the better choice when the auditor expects many misstatements spread across all value ranges, or when understatement is the primary risk. The price of that flexibility is complexity: CVS requires estimating the population’s standard deviation before calculating sample size, and evaluating results involves more math.
Selecting the Sample
Statistical sampling requires genuine randomness in selection. The auditor cannot grab items that look interesting or convenient. Two selection methods dominate.
With random number selection, the auditor assigns a unique number to each item in the population and uses a random number generator to identify which items to test. This eliminates human bias. Every item has an independently determined chance of being selected, and the selection of one does not affect the probability of selecting another.
With systematic selection using a random start, the auditor calculates a sampling interval by dividing the total population (in units or dollars) by the required sample size. A random number within the first interval becomes the starting point, and every subsequent item at the interval distance enters the sample. Systematic selection is efficient and easy to apply, but the auditor needs to verify the population isn’t arranged in a pattern that coincides with the interval, since a cyclical pattern at the same interval could produce an unrepresentative sample.
Haphazard selection, where the auditor picks items without conscious bias but without a formal random mechanism, does not qualify as statistical. Research has demonstrated that haphazard samples consistently differ from truly random ones because subconscious tendencies cause auditors to over-select certain items and under-select others. Auditing standards permit haphazard selection for non-statistical sampling, but it cannot support the probability-based conclusions that statistical sampling requires.
Evaluating Sample Results
The final step is projecting the sample findings back to the full population. Finding a few errors in a sample doesn’t mean the account is misstated by that exact amount. The auditor must estimate what those errors imply about the population as a whole.
Projecting Dollar Misstatements
For monetary unit sampling, the auditor calculates a projected misstatement by extrapolating each error found in the sample to the sampling interval that produced it. The tainting percentage (the misstatement amount divided by the recorded value of the sampled item) is multiplied by the interval to estimate how much misstatement likely exists in that portion of the population.
The projected misstatement is combined with an allowance for sampling risk to produce the upper misstatement limit, which represents the maximum misstatement likely to exist in the account at the chosen confidence level. The auditor compares this figure to the tolerable misstatement set during planning. If the upper misstatement limit is less than or equal to tolerable misstatement, the account balance is considered fairly stated. If it exceeds tolerable misstatement, the account is considered materially misstated.1Public Company Accounting Oversight Board. AS 2315 – Audit Sampling
Projecting Control Deviations
For attribute sampling, the auditor counts the deviations found and calculates the upper deviation rate using statistical tables or software. The upper deviation rate is compared to the tolerable deviation rate. If a sample turns up two or more deviations in a test designed for a 5 percent tolerable rate, the auditor may well conclude that the risk of the true deviation rate exceeding 5 percent is unacceptably high.1Public Company Accounting Oversight Board. AS 2315 – Audit Sampling
When Results Exceed the Threshold
Unfavorable sample results don’t end the audit. They change its direction.
If a test of controls shows a deviation rate exceeding the tolerable threshold, the auditor must reassess the planned reliance on that control and expand substantive testing for the affected financial statement assertions.1Public Company Accounting Oversight Board. AS 2315 – Audit Sampling In practice this means more detailed transaction-level work to compensate for the control that cannot be trusted.
If a substantive test produces a projected misstatement higher than expected, the auditor should reconsider the risk assessments that shaped the audit plan. Higher-than-anticipated misstatements in one area often signal problems elsewhere, and the auditor may need to modify tests in other areas designed on the same risk assumptions.1Public Company Accounting Oversight Board. AS 2315 – Audit Sampling The auditor can also increase the sample size to narrow the allowance for sampling risk, ask management to investigate and correct the identified misstatements, or, when misstatements remain material and uncorrected, modify the audit opinion.
Because the auditor started with defined thresholds and measurable risk levels, the response to unfavorable results follows a logical path rather than a subjective one. The numbers tell you what happened, and the standards tell you what to do about it.