Attribute Sampling in Auditing
Also known as: Statistical Attribute Sampling, Compliance Testing, Control Testing Sampling
Attribute sampling is a statistical sampling method used primarily in testing the operating effectiveness of internal controls. Rather than measuring the dollar impact of errors (as in substantive sampling), attribute sampling answers a yes/no question: 'Does this control exist and is it operating as designed?' By determining the sample size and evaluating test results statistically, auditors can reach defensible conclusions about control effectiveness.
Key highlights
- Provides statistical precision about the rate at which a control is operating, expressed as an upper precision limit
- Efficient for testing numerous transactions without examining each one
- Results are defensible and can withstand audit committee and regulatory scrutiny
- Works well with automated controls and system-generated evidence
Intuition
This section is available to Pro members. Upgrade to Pro
How it works
This section is available to Pro members. Upgrade to Pro
When to use it
Use attribute sampling when testing the design and operation of internal controls over accounting transactions. It is ideal when controls can be clearly observed (e.g., authorization signatures, reconciliation approvals, system-enforced restrictions). Use when the control is expected to operate at a high rate of effectiveness. Less useful when deviations are difficult to identify, when controls are preventive (no evidence of operation), or when the auditor intends to test every transaction.
Strengths & limitations
- Provides statistical precision about the rate at which a control is operating, expressed as an upper precision limit
- Efficient for testing numerous transactions without examining each one
- Results are defensible and can withstand audit committee and regulatory scrutiny
- Works well with automated controls and system-generated evidence
- Measures only whether a control is present and operating, not the magnitude of failures
- May require large sample sizes when controls have very low expected deviation rates
- Requires clear definition of what constitutes a deviation
- Does not work well for preventive controls that leave no evidence of operation
Common pitfalls
This section is available to Pro members. Upgrade to Pro
Applications
This section is available to Pro members. Upgrade to Pro
Frequently asked
What is the difference between a deviation and a misstatement?
A deviation is any time a control does not operate as designed (e.g., a transaction is not approved). A misstatement is an error in the financial statements. A control deviation may not result in a misstatement (if the transaction is correct anyway), but material deviations often indicate misstatement risk.
How many deviations can I tolerate?
The tolerable deviation rate depends on the significance of the control and the auditor's planned reliance. Typically, auditors specify a tolerable deviation rate (e.g., 2-5%) before sampling; if more deviations are found, the control is deemed unreliable.
What does 'upper precision limit' mean?
The upper precision limit is the highest deviation rate the auditor can be confident (at the specified confidence level) exists in the population based on the sample results. If the upper limit is below the tolerable rate, the control is deemed effective.
Can I use attribute sampling for transactions with different risk levels?
Typically, separate attribute sampling is performed for high-risk and low-risk transactions, as they may have different tolerable deviation rates and control expectations.
Sources
- 1.American Institute of Certified Public Accountants (AICPA). (2015). Audit Sampling. AU-C Section 530. AICPA Professional Standards.
- 2.Arens, A. A., Elder, R. J., & Beasley, M. S. (2014). Auditing and assurance services (15th ed.). Pearson Education.
You have read it. What now?
Cite this page
ScholarGate. (2026, June 3). Attribute Sampling in Auditing. ScholarGate. https://scholargate.app/accounting/attribute-sampling-audit