IS Standards, Guidelines and Procedures for Auditing and Control ...

G10 Audit Sampling continued• The risk of incorrect rejection - the risk that material misstatement is assessed as likely, when in fact the population is notmaterially misstated2.2.9 Sample size is affected by the level of sampling risk that the IS auditor is willing to accept. Sampling risk should also beconsidered in relation to the audit risk model and its components, inherent risk, control risk, and detection risk.2.2.10 Tolerable error - Tolerable error is the maximum error in the population that IS auditors are willing to accept and still concludethat the audit objective has been achieved. For substantive tests, tolerable error is related to the IS auditor’s judgment aboutmateriality. In compliance tests, it is the maximum rate of deviation from a prescribed control procedure that the IS auditor iswilling to accept.2.2.11 Expected error - If the IS auditor expects errors to be present in the population, a larger sample than when no error is expectedordinarily has to be examined to conclude that the actual error in the population is not greater than the planned tolerable error.Smaller sample sizes are justified when the population is expected to be error free. When determining the expected error in apopulation, the IS auditor should consider such matters as error levels identified in previous audits, changes in theorganisation’s procedures and evidence available from an evaluation of the system of internal control and results fromanalytical review procedures.2.3 Selection of the Sample2.3.1 There are four commonly used sampling methods:Statistical Sampling Methods• Random sampling - ensures that all combinations of sampling units in the population have an equal chance of selection• Systematic sampling - involves selecting sampling units using a fixed interval between selections, the first interval havinga random start. Examples include Monetary Unit Sampling or Value Weighted selection where each individual monetaryvalue (e.g., $1) in the population is given an equal chance of selection. As the individual monetary unit cannot ordinarilybe examined separately, the item which includes that monetary unit is selected for examination. This methodsystematically weights the selection in favour of the larger amounts but still gives every monetary value an equalopportunity for selection. Another example includes selecting every ‘nth sampling unitNon Statistical Sampling Methods• Haphazard sampling - in which the IS auditor selects the sample without following a structured technique, howeveravoiding any conscious bias or predictability. However, analysis of a haphazard sample should not be relied upon to forma conclusion on the population• Judgmental sampling - in which the IS auditor places a bias on the sample (e.g., all sampling units over a certain value,all for a specific type of exception, all negatives, all new users, etc.). It should be noted that a judgmental sample is notstatistically based and results should not be extrapolated over the population as the sample is unlikely to berepresentative of the population2.3.2 The IS auditor should select sample items in such a way that the sample is expected to be representative of the populationregarding the characteristics being tested, i.e., using statistical sampling methods. In order to maintain audit independence,the IS auditor should ensure the population is complete and control the selection of the sample.2.3.3 For a sample to be representative of the population, all sampling units in the population should have an equal or knownprobability of being selected, i.e., statistical sampling methods.2.3.4 There are two commonly used selection methods: selection on records, and selection on quantitative fields (e.g., monetaryunits).For selection on records, common methods are:• Random Sample (statistical sample)• Haphazard Sample (non statistical)• Judgmental Sample (non statistical; high probability to lead to a biased conclusion)• For selection on quantitative fields, common methods are:• Random Sample (statistical sample on monetary units)• Fixed Interval Sample (Statistical sample using a fixed interval)• Cell Sample (statistical sample using random selection in an interval)2.4 Documentation2.4.1 The audit workpapers should include sufficient detail to describe clearly the sampling objective and the sampling processused. The workpapers should include the source of the population, the sampling method used, sampling parameters (e.g.,random start number or method by which random start was obtained, sampling interval), items selected, details of audit testsperformed and conclusions reached.2.5 Evaluation of Sample Results2.5.1 Having performed, on each sample item, those audit procedures which are appropriate to the particular audit objective, the ISauditor should analyse any possible errors detected in the sample to determine whether they are actually errors and ifappropriate the nature and cause of the errors. For those that are assessed as errors, the errors should be projected asappropriate to the population , if the sampling method used, is statistically based.35