What Is the Tolerable Deviation Rate in Tests of Controls?

The tolerable deviation rate in tests of controls is the maximum percentage of control failures an auditor will accept and still rely on that control to reduce further testing. Under PCAOB AS 2315, the threshold typically sits at 5% or lower when the auditor plans to lean heavily on a control, and at 10% or higher when other procedures will supplement the sample evidence.{¹} Setting this rate is one of the earliest and most consequential decisions in a controls test, because it dictates how many items the auditor must examine and how strictly the results will be judged.

What a Deviation Is, and Why Some Are Tolerable

Every internal control has a job: approving payments, reconciling accounts, verifying shipping documents, or some other step designed to catch errors or fraud before they reach the financial statements. A deviation is any instance where the control did not operate as designed. A purchase order missing a required signature, a bank reconciliation completed late, an access log showing an unapproved user processed a transaction — each is a deviation.

A deviation does not automatically mean the financial statements are wrong. AS 2315 makes this point directly: a disbursement missing its approval signature may still be a properly authorized and correctly recorded transaction.{¹} Deviations only produce misstatements when the control failure and the accounting error happen to land on the same transaction. That is why auditors can accept some deviation without losing confidence in the underlying numbers, and why the tolerable rate is a threshold rather than a demand for perfection.

How Auditors Set the Rate

Two considerations dominate the decision under AS 2315 paragraph 34: the planned level of control risk, and how much assurance the auditor wants from the sample alone.{¹} When the auditor plans to assess control risk at a low level and the sample is the only evidence supporting that assessment, a tolerable rate of 5% or less is typical. When the auditor either plans a higher control risk assessment or will gather additional evidence through inquiries, observation, or other control tests, a rate of 10% or more may be reasonable.

In practice, most firms work within a range that looks something like this:

Heavy reliance on the control (low control risk): tolerable rates around 3% to 5%, requiring large samples and leaving very little room for observed failures.
Moderate reliance: tolerable rates around 6% to 9%, appropriate when some backup controls exist or the account is not among the highest-risk areas.
Limited reliance (higher control risk): tolerable rates of 10% or above, used when extensive substantive testing is planned regardless of control results.

The nature of the control matters too. A control designed to prevent unauthorized wire transfers from a cash account draws a tighter threshold than a control over office supply purchases. The potential financial impact of failure should be proportional to how strict the auditor sets the bar. Whether other redundant controls cover the same risk also factors in: a single-point-of-failure control with no backup almost always gets a lower tolerable rate than one backstopped by two other procedures catching the same type of error.

How the Rate Determines Sample Size

The relationship between the tolerable deviation rate and sample size is inverse. Cut the tolerable rate in half and the sample roughly doubles. A tighter threshold demands more evidence before the auditor can conclude the control is reliable.

Auditors feed three inputs into attribute sampling tables or audit software to calculate the required sample size:

Tolerable deviation rate: the threshold set during planning.
Expected deviation rate: the auditor’s estimate of how many deviations actually exist in the population, often based on prior-year results or professional judgment.
Confidence level: typically 90% or 95%, representing how certain the auditor wants to be that the sample result reflects reality.{}²

To see how these interact, consider sample sizes from a standard attribute sampling table assuming zero expected deviations:

90% confidence, 5% tolerable rate: minimum sample of about 50 items.
90% confidence, 10% tolerable rate: minimum sample of about 25 items.
95% confidence, 5% tolerable rate: minimum sample of about 65 items.
95% confidence, 10% tolerable rate: minimum sample of about 35 items.{}³

Moving from a 10% tolerable rate to 5% nearly doubles the required sample at the same confidence level. If the auditor also expects some deviations rather than zero, the sample climbs further because the margin between expected and tolerable rates shrinks.

One common misconception: the total number of transactions in the population has little effect on sample size. Whether the company processed 5,000 invoices or 500,000, the required sample stays roughly the same once the population exceeds a few hundred items. The tolerable rate and expected deviation rate drive the math far more than population size does.

Comparing Sample Results to the Tolerable Rate

After testing the sample, the auditor counts the deviations found and divides by items tested to get the sample deviation rate. That raw percentage is not the end of the analysis. A sample is only a slice of the population, so there is always a chance the true deviation rate is higher than what the sample showed. This is where the computed upper deviation rate comes in.

The upper deviation rate is the maximum deviation rate that could plausibly exist in the full population, given the sample results and the chosen confidence level. Auditors look this up in statistical evaluation tables or calculate it with audit software. If 60 items were tested and zero deviations found, the upper deviation rate at 95% confidence might be around 5%. Finding even one or two deviations in that same sample pushes the upper rate significantly higher.

The comparison itself is straightforward. If the computed upper deviation rate falls at or below the tolerable rate set during planning, the auditor can rely on the control as intended. If the upper deviation rate exceeds the tolerable rate, the control cannot support the planned level of reliance.{¹}

The Risk of Overreliance

The danger auditing standards guard against is what AS 2315 calls “the risk of assessing control risk too low,” meaning the auditor concludes a control works well when it actually does not.{} If the auditor wrongly relies on a broken control, the substantive tests that follow may be too limited to catch a material misstatement. Professional guidance suggests quantifying that risk between 5% and 10%.{¹} A 95% confidence level means the auditor accepts a 5% chance that the true population deviation rate exceeds the tolerable rate despite the sample looking clean.

Qualitative Factors Beyond the Numbers

The statistical comparison is necessary but not sufficient. AS 2315 requires the auditor to consider the nature and cause of any deviations found, not just how many there were. A deviation caused by a temporary staffing shortage during one week tells a different story than deviations scattered throughout the year suggesting a persistent breakdown. A deviation that looks like carelessness carries different implications than one suggesting intentional override of the control.{¹}

If the auditor discovers items that could not be tested because documentation was missing, those unexamined items cannot be ignored. If treating them as deviations would change the conclusion, the auditor needs to pursue alternative procedures or reassess the risks for the engagement, including whether the missing records raise fraud concerns.

When a Control Fails the Test

When the upper deviation rate exceeds the tolerable rate, the auditor has a few paths forward, none of them shortcuts.

The most common response is to stop relying on that control and increase substantive testing instead. The audit team shifts to directly verifying account balances and transaction details: confirming more receivable balances with customers, performing additional physical inventory counts, or tracing a larger sample of journal entries back to supporting documents. The additional testing compensates for the absent control assurance by gathering more direct evidence.

Before expanding substantive testing, the auditor should also evaluate whether compensating controls cover the same risk. A compensating control is a different procedure that catches the same type of error the failed control was supposed to prevent. For a compensating control to be useful, AS 2201 requires it to “operate at a level of precision that would prevent or detect a misstatement that could be material.”{⁴} A vaguely related review process does not qualify.

The auditor also cannot ignore the implications for the rest of the audit. If the sample results suggest the original risk assessments were wrong, AS 2315 requires the auditor to reconsider other audit procedures designed on those same assumptions. A control failure in accounts payable, for example, might signal weaknesses in the broader purchasing cycle affecting inventory and cost of goods sold testing too.

Failures serious enough to constitute a significant deficiency or material weakness trigger written communication requirements to management and those charged with governance under both PCAOB and AICPA standards.{⁴}{⁵}

Documenting the Tolerable Rate Decision

The justification for the tolerable rate deserves particular attention in the workpapers. Reviewers and regulators want to see why a specific percentage was chosen, what risk factors were considered, and how the rate connects to the overall audit strategy. Simply writing “5% tolerable rate” with no explanation is the kind of documentation gap that quality reviewers flag routinely.{⁶} Tying the rate to the planned control risk assessment and the availability of corroborating evidence gives the conclusion a defensible foundation, and lets a later reviewer trace the logic from planning judgment through sample size to the final reliance decision.

1
Public Company Accounting Oversight Board (PCAOB). AS 2315 Audit Sampling
2
Office of the Comptroller of the Currency. Comptrollers Handbook – Sampling Methodologies
3
U.S. Department of Housing and Urban Development OIG. Attribute Sampling Appendix
4
Public Company Accounting Oversight Board (PCAOB). AS 2201 An Audit of Internal Control Over Financial Reporting That Is Integrated with An Audit of Financial Statements
5
AICPA. AU-C 265 Communicating Internal Control Related Matters Identified in an Audit
6
Council of the Inspectors General on Integrity and Efficiency (CIGIE). Good Practices for Quality Assurance Reviewers – Audit Sampling Planning Documentation and Reporting