Sampling made simple: successful attributes sampling starts with a well-laid plan

Internal Auditor, August, 2004 by John R. Martin

AUDITORS ARE OFTEN CALLED upon to test internal controls through attributes sampling. The process involves selecting a sample of transactions from a population of data and testing for the presence or absence of certain attributes or qualities. For instance, an auditor may select a sample of accounts payable transactions and test to see whether each record contains a signature of approval by an authorized signer. Or, an auditor may select a sample of customer records from a database to check for correct address information.

Attributes sampling is simple, or so it may seem. Although modern computer-assisted audit tools have added considerable efficiency to the data extraction, testing, and recording processes associated with sampling, auditors risk making critical errors by relying too heavily on this technology and failing to invest enough time in developing a solid sampling plan. Consequently, results can become questionable at best, and invalid at worst.

The popular saying, "If you fail to plan, you plan to fail," certainly applies to attributes sampling. A sampling plan supports the validity of the work performed and is key to defining the test objective and selecting a sample that is representative of the total population. A thorough plan provides detailed information about the population and minimizes the overall audit risk. In particular, effective planning reduces methodology risks such as testing the wrong population or testing a sample that is not representative.

Before plugging numbers into audit software for testing procedures, internal auditors should take the time to build an effective attributes sampling plan. The following 10 steps can be used as a model for developing a plan that will mitigate the risk of error and help increase the validity of testing data.

1. CONDUCT PRE-SAMPLING RESEARCH Before initiating sampling routines, internal auditors must understand what they're testing. Preparation should include reviewing the procedures to be tested, listening to audit clients, and documenting system controls. For example, suppose an audit client suggests that the customer address database is not being maintained correctly, thereby causing excessive undeliverable postage costs and reducing opportunities to inform customers about new product offerings. The auditor would need to learn how address information is entered into the customer database, how often information is updated, and who or what is involved in this effort. In general, pre-sampling research is complete when the auditor understands all of the variables impacting the population to be tested.

2. DEFINE THE OBJECTIVE Although some practitioners may be inclinde to skip this step to expedite testing, failing to define the test objective adequately can be a costly mistake, leading to poor sample selection and weakened support for work performed.

Consider what you will say when the audit is complete. Although you can't necessarily predict the final outcome at this point, consider what type of information will be presented in the testing conclusion. In the customer database example above, for instance, management would likely receive little benefit from a conclusion that simply states that problems exist within the database. Instead, they find more value in a report that identifies the specific problems that exist in the database such as variances in the address error rate by customer type or location. Considering clients' needs up front can help auditors craft a focused objective and tailor the testing to produce value-added results.

3. DEFINE THE POPULATION A well-defined, complete population is a key building block for a solid attributes sampling plan. Specifically, auditors need to decide what to include in--and exclude from--the population. The time period examined, for example, is an important consideration. Establishing exact beginning and ending dates for all population items improves the precision of the population and later helps ensure the validity of the sample.

If the population is maintained on a computer database, be sure to specify the field definitions that comprise the population and any querying language used to extract your data. These details will provide a clear path to the population and enable others to identify the population's source quickly, if necessary.

4. EXAMINE THE POPULATION To ensure the validity of testing data, auditors must verify that their samples are representative of the population examined. An auditor cannot make this determination, however, without first knowing what the population looks like.

To gain a better understanding of the target population, internal auditors can begin by identifying the population's largest and smallest items. Auditors should then calculate the average, as well as the average spread, and examine the dates on which population items were created. For example, are items distributed evenly throughout the period or skewed toward the beginning, middle, or end?

5. DEFINE A SAMPLING UNIT A sampling unit represents an individual piece of the population selected for sampling. The total population count, then, is the sum of all sampling units.