- An auditor is evaluating the results of an attribute sample for a test of controls. The tolerable deviation rate is 6%, and the sample results indicate an achieved upper deviation rate of 5.5%. Which conclusion is most appropriate?
Answer: The auditor can rely on the control as planned because the upper deviation rate is less than the tolerable rate.
The decision rule in attribute sampling is to compare the achieved upper deviation rate to the tolerable deviation rate. Since the upper deviation rate (5.5%), which includes an allowance for sampling risk, is less than the tolerable rate (6%), the sample results provide sufficient evidence to support the auditor's planned reliance on the control.
- You are the auditor of a nonissuer healthcare clinic in a financial statement audit. The clinic processes 22,000 cash receipts annually, and a key control requires daily independent review of the bank reconciliation; the reviewer signs and dates the reconciliation. The auditor intends to test whether the review control operated effectively throughout the year. What factors should the auditor consider in determining sample size?
Answer: Tolerable deviation rate, expected deviation rate, and the frequency of the control (daily) as it affects the population size and coverage period
AU-C 530 establishes that sample size for tests of controls depends on tolerable deviation rate, expected deviation rate, and the desired level of assurance, with population size being a relevant consideration for frequently performed controls. The key facts are that this is a daily control (creating approximately 365 occurrences annually), and the auditor wants to test operating effectiveness throughout the year. Answer A correctly identifies all relevant factors including how control frequency affects population size and coverage. Answer B incorrectly focuses on dollar values which are irrelevant for attribute sampling of controls, Answer C incorrectly suggests IT controls replace manual control testing requirements, and Answer D inappropriately links control testing to tax compliance timing. The professional judgment framework for controls performed multiple times per period is: consider the standard sample size factors while ensuring the sample provides appropriate coverage across the entire period being tested.
- In an audit of a nonissuer healthcare clinic, the auditor is testing controls over patient billing adjustments. The population is 3,300 adjustments, and the auditor expects deviations because supervisors sometimes approve adjustments after posting; the auditor plans moderate reliance on the control. What factors should the auditor consider in determining sample size for this test of controls?
Answer: Expected deviation rate, tolerable deviation rate, and the risk of assessing control risk too low given planned reliance
AU-C 530 emphasizes expected and tolerable deviation rates plus risk of assessing control risk too low for sample size in attribute sampling. The 3,300 adjustments with expected deviations and moderate reliance drive size determination. These factors align with standards for controls testing. Population number or value alone, or control frequency solely, misapplies guidance. Auditors calibrate to reliance and expectations. A framework is to heighten size for higher expected deviations or reliance.
- Which of the following is a primary disadvantage of using classical variables sampling techniques compared to probability-proportional-to-size (PPS) sampling?
Answer: It may require manual stratification of the population to achieve an efficient sample size if account balances are highly variable.
Classical variables sampling bases its calculations on the standard deviation of the population's values. If the population has a wide range of values (high variability), the standard deviation will be large, which can lead to an inefficiently large sample size. To overcome this, the auditor often needs to manually stratify the population into more homogeneous subgroups, which adds complexity to the sampling plan. PPS sampling avoids this issue by automatically stratifying based on monetary value.
- Which of the following sample selection methods is generally considered to have the highest risk of intentional or unintentional auditor bias, making it the least desirable method?
Answer: Block selection.
Block selection involves choosing a sequence of contiguous items (e.g., all transactions for the month of May). This method is generally not recommended because the block chosen may not be representative of the characteristics of the entire population, leading to a high risk of bias. For example, if a company's business is seasonal, a block from one month would not be representative of the entire year.
- In the audit of a nonissuer e-commerce company, you performed a substantive sample of 80 refund transactions (population 6,400 refunds) to test authorization and accuracy. You found 1 refund processed without required approval and a separate $1,200 over-refund due to data entry error; the control environment is otherwise stable. What is the most appropriate way to evaluate misstatements based on sample results?
Answer: Treat the unapproved refund as a control deviation and the $1,200 over-refund as a misstatement, then consider whether each indicates a systemic issue requiring expanded procedures and whether projected misstatement could exceed tolerable misstatement
AU-C 530 requires separate evaluation of control deviations and monetary misstatements, with consideration of whether findings indicate systemic issues requiring expanded procedures. The key facts are that one control deviation (missing approval) and one monetary misstatement ($1,200 over-refund) were identified in different transactions. Answer A correctly requires treating these as separate issues - the control deviation for evaluating control effectiveness and the misstatement for projecting to the population and comparing to tolerable misstatement. Answer B inappropriately attempts to offset current year findings with prior year results, Answer C fails to project the identified misstatement to the population, and Answer D incorrectly dismisses the relevance of authorization controls to financial reporting. The professional judgment framework is: evaluate control deviations and monetary misstatements separately, project each type of finding appropriately, and consider whether the nature of errors indicates broader issues requiring additional audit procedures.
- An auditor is performing a test of controls on purchase order approvals. The auditor set the tolerable deviation rate at 7% and the desired confidence level at 95% (risk of assessing control risk too low of 5%). After testing a sample, the auditor found two deviations and calculated the sample's upper deviation rate to be 8%. What is the most appropriate conclusion?
Answer: The assessed level of control risk should be increased.
The conclusion in attribute sampling is based on comparing the upper deviation rate to the tolerable deviation rate. Because the upper deviation rate (8%) exceeds the tolerable deviation rate (7%), the sample results do not support the planned level of reliance on the control. Therefore, the auditor should increase the assessed level of control risk and modify planned substantive procedures accordingly.
- An auditor is using systematic selection to choose a sample of 200 items from a population of 10,000 numbered shipping documents. The auditor randomly chooses the 45th document as the starting point. Which document will be the third item selected for the sample?
Answer: The 145th document.
First, calculate the sampling interval: Population size / Sample size = 10,000 / 200 = 50. The selection process starts with the 45th document. The subsequent items are found by adding the interval. The first item is 45. The second item is 45 + 50 = 95. The third item is 95 + 50 = 145.
- You are auditing a nonissuer financial services company. For a test of controls over new vendor setup, you selected 50 vendor additions and found 2 instances where required independent approval was missing. The control is important to mitigating fraud risk, and the auditor's tolerable deviation rate was set low. Based on the results, how should the auditor extrapolate the findings?
Answer: Evaluate the sample deviation rate in relation to the tolerable deviation rate, consider sampling risk, and determine whether reliance on the control remains appropriate or whether additional testing or a revised audit approach is needed
AU-C 530 requires that control test results be evaluated by comparing the sample deviation rate to the tolerable deviation rate while considering sampling risk, particularly when the control addresses fraud risks. The key facts are that 2 deviations were found in 50 items (4% deviation rate), the control is important for fraud prevention, and tolerable deviation rate was set low. Answer B correctly requires evaluation against tolerable rate with consideration of sampling risk and potential need for revised audit approach. Answer A fails to properly evaluate results against tolerable rate, Answer C incorrectly attempts to convert control deviations to dollar misstatements, and Answer D incorrectly claims controls testing is irrelevant to fraud risks. The professional judgment framework for evaluating control deviations is: calculate the sample deviation rate, consider sampling risk (especially for low tolerable rates), and determine whether planned reliance remains appropriate or whether the audit approach needs modification.
- During the audit of a nonissuer construction contractor, you selected a non-statistical sample of 60 job cost transactions to test classification between cost of sales and capitalized costs. You identified 3 misclassifications totaling $18,000, and the population consists of 6,000 transactions totaling $9.0 million. What is the most appropriate way to evaluate misstatements based on sample results?
Answer: Project the sample misstatement to the population on a reasonable basis and consider sampling risk, then compare the result to tolerable misstatement for the relevant assertion
AU-C 530 requires that even when using non-statistical sampling, the auditor must project sample misstatements to the population and consider sampling risk when evaluating results against tolerable misstatement. The key facts are that non-statistical sampling was used, misstatements were identified (3 out of 60 items), and evaluation is needed. Answer B correctly requires projection of the sample misstatement rate to the population and consideration of sampling risk, which can be done judgmentally in non-statistical sampling. Answer A incorrectly suggests non-statistical samples cannot be evaluated, Answer C fails to project misstatements to the untested population, and Answer D inappropriately suggests manipulating audit thresholds to avoid addressing identified issues. The professional judgment framework is: non-statistical sampling still requires projection of sample results and consideration of sampling risk, though these are based on professional judgment rather than statistical calculation.
- Based on this information, what is the projected misstatement for the entire population?
Answer: $20,000
Difference estimation projects the average misstatement per item in the sample to the entire population. First, calculate the total misstatement in the sample: $52,000 (book value) - $50,000 (audited value) = $2,000. Next, calculate the average misstatement per sample item: $2,000 / 100 accounts = $20 per account. Finally, project this to the population: $20 per account * 1,000 accounts = $20,000 projected misstatement.
- You are auditing a nonissuer nonprofit organization and testing controls over cash disbursement approvals. The control is performed weekly, and the auditor plans to rely on it to reduce substantive testing of expenses. What factors should the auditor consider in determining sample size for this test of controls?
Answer: Frequency of the control, expected deviation rate, tolerable deviation rate, and the risk of assessing control risk too low
AU-C 530 identifies frequency, expected and tolerable deviation rates, and risk of assessing control risk too low as key for sample size in tests of controls. The weekly cash disbursement control requires reliance, so these factors determine sample size to ensure adequate evidence. This aligns with guidance for attribute sampling in recurring controls. Basing on weeks alone, materiality, or inherent risk only overlooks deviation and risk considerations. Auditors should scale samples to control frequency and risk for effective testing. A decision rule is to increase samples for frequent controls with higher planned reliance.
- An auditor plans to use a single sample to perform both a test of controls and a substantive test of details. When designing the sample for this dual-purpose test, the auditor's primary consideration should be that:
Answer: The sample size should be the larger of the samples that would otherwise be designed for the two separate purposes.
For a dual-purpose test to be appropriate, the sample must be designed to meet the objectives of both the test of controls and the substantive test. This requires calculating the sample size needed for each test individually based on their respective parameters (e.g., tolerable deviation rate for controls, tolerable misstatement for substantive tests). The auditor must then use the larger of the two calculated sample sizes to ensure the sample is sufficient for both purposes.
- You are the auditor of a nonissuer manufacturing company in a financial statement audit. The entity has 18,000 sales invoices for the year, and controls over sales invoice approval are automated but the auditor noted prior-year deviations due to manual overrides. The engagement partner wants a sampling approach for testing the operating effectiveness of the invoice-approval control that allows quantification of sampling risk and supports projecting results to the population. Which sampling method should the auditor use?
Answer: Statistical attribute sampling because it permits quantifying sampling risk and evaluating deviations against a defined tolerable deviation rate
AU-C 530 requires that when an auditor needs to quantify sampling risk and project results to the population, statistical sampling methods must be used. The key facts are that the engagement partner specifically wants quantification of sampling risk and the ability to project results, which are hallmarks of statistical sampling. Statistical attribute sampling (Answer B) is the correct choice because it provides a mathematical basis for measuring sampling risk and allows the auditor to make quantitative statements about the population based on sample results. Non-statistical attribute sampling (Answer A) cannot provide quantified sampling risk conclusions, monetary-unit sampling (Answer C) is designed for substantive testing of monetary amounts rather than control deviations, and judgmental selection (Answer D) violates the fundamental sampling principle that all items must have a chance of selection. The professional judgment framework is: when quantification of sampling risk is required for controls testing, use statistical attribute sampling with proper random selection methods.
- Which of the following audit situations is most likely to be associated with non-sampling risk rather than sampling risk?
Answer: Failing to recognize a misstatement in a sales invoice selected for examination.
Non-sampling risk is the risk of human error, such as failing to apply an audit procedure correctly, misinterpreting evidence, or failing to recognize an error. It is not caused by the process of sampling. Failing to recognize a misstatement on a document being examined is a classic example. The other options describe aspects of sampling risk, which is the risk that the auditor's conclusion based on a sample might be different from the conclusion if the entire population were subjected to the same audit procedure.
- In the context of audit sampling for substantive tests, tolerable misstatement is best described as:
Answer: The maximum monetary misstatement in an account balance or class of transactions that the auditor is willing to accept without modifying the audit opinion.
Tolerable misstatement is the application of performance materiality to a specific audit sampling procedure. It represents the maximum amount of misstatement the auditor can tolerate in the population being tested and still conclude that the account balance is not materially misstated when combined with other likely misstatements.
- You are auditing a nonissuer manufacturer and performing substantive testing over prepaid expenses. The sample identifies several items that appear to be operating expenses incorrectly recorded as prepaid; management proposes reclassifying only the specific items found. Based on the results, how should the auditor extrapolate the findings?
Answer: Project the misclassification rate or misstatement identified in the sample to the remaining population, consider sampling risk, and evaluate whether additional misstatements likely exist beyond the items found
AU-C 530 requires projecting sample misstatements or rates to the population in substantive testing, considering sampling risk and likely additional errors. Misclassified items in prepaid expenses necessitate projection and evaluation beyond identified, rejecting management's limited correction. This follows extrapolation guidance. Accepting proposal or concluding isolated ignores potential, and converting to controls misapplies. Auditors project for complete assessment. A rule is to estimate total misstatement including unsampled portions before concluding.
- An auditor's sample results support a conclusion that a control is operating effectively when, in fact, it is not. This situation illustrates which type of sampling risk?
Answer: The risk of assessing control risk too low.
The risk of assessing control risk too low occurs when an auditor concludes, based on a sample, that a control is more effective than it actually is. This risk relates to the effectiveness of the audit because it can lead to insufficient substantive testing and a failure to detect a material misstatement.
- In a nonissuer audit, the auditor plans a test of controls over credit memo approval. The auditor sets a low tolerable deviation rate because revenue is a significant account and the control is key; however, the auditor expects a higher deviation rate due to decentralized processing. What factors should the auditor consider in determining sample size for this test of controls?
Answer: A lower tolerable deviation rate and higher expected deviation rate generally increase the required sample size
AU-C 530 states that lower tolerable deviation rates and higher expected rates increase sample size in controls testing. Low tolerable for key revenue control and higher expected from decentralization drive larger samples. This aligns with attribute sampling guidance. Lower tolerable does not decrease size, expected rate does affect planning, and population drives minimally. Auditors adjust for risk factors. A framework is to scale size inversely with tolerable and directly with expected.
- In a nonissuer audit, the auditor tests controls over bank reconciliation review. The control is performed monthly, and the auditor plans to test 2 months because there were no issues in prior years; however, this year there was a change in the controller and several late reconciliations were noted. What factors should the auditor consider in determining sample size for this test of controls?
Answer: Increase sample size because expected deviation risk is higher due to personnel change and noted late reconciliations
AU-C 530 requires considering control frequency, expected deviations, and risk in sample size for tests of controls. The monthly bank reconciliation with personnel changes and late instances raises expected deviations, warranting increased size beyond initial 2. This aligns with standards to adjust for current risks. Keeping or decreasing ignores changes, and eliminating testing forfeits reliance. Auditors reassess based on evidence like delays. A framework is to expand samples when indicators suggest higher deviation risk.
