Auditing

Any other mistakes by the auditor other than sampling risk not a direct consequence of using a sampling approach

Application of an audit procedure to less than 100% of the items within an account balance or class of transactions for the purpose of evaluating some characteristic of the balance or class

• Attributes sampling
• Variables sampling

• The risk of under-reliance on controls or incorrect rejection
• Relates to efficiency of audit

• Statistical
• Nonstatistical

The risk that the sample may not be truly representative of the population

• The risk of over-reliance on controls or incorrect acceptance
• Relates to effectiveness of audit

• Identify Sampling Objective
• Define what Constitutes an Occurrence
• Identify Relevant Population
• Determine Sampling Method
• Determine Sample Size
• Select the Sample
• Evaluate Results
• Document Sampling Procedures

Only if the error rate, based on the upper bound of the confidence interval is less than or equal to the stated "tolerable error" rate

Arbitrary selection, with no "conscious" biases

• Random Number
• Systematic

• Tolerable error rate
• Risk of over-reliance
• Risk of under-reliance

e.g., selecting every nth item

A group of contiguous items

• Relevant time period
• Specific sampling unit

Each transaction has the same probability of being selected

(# errors)/n

• Expected error rate
• Population size

• Block
• Haphazard

• Allowance for sampling risk
• Risk of incorrect acceptance
• Risk of incorrect rejection

• Estimated population standard deviation
• Population size

Sample Size = (Estimated population standard deviation x coefficient of reliability x number of items / allowance for sampling risk) squared

• Identify sampling objectives
• Identify relevant population
• Select specific sampling technique
• Calculate the sample size
• Determine selection method
• Conduct the sample
• Evaluate sample and project to population
• Document the sampling procedures

• Mean
• Variance

Reduces overall variability within a population

• Difference estimation
• Ratio estimation
• Mean-per-unit estimation
• Probability proportionate to size

• Systems analyst
• Programmer
• Operator
• Librarian
• Security

• Organization and operation
• Systems development and documentation
• Hardware and systems software
• Access
• Data and procedures

• Limit tests
• Validity checks
• Missing data checks
• Check digits

Related to the specific computer processing applications

A check digit is an arithmetic manipulation of a numerical field that captures the information content of that field and then gets "tacked" onto the end of that numeric field

• File labels
• File protection rings
• File protection plans

• Segregation of duties may be undermined
• Audit trail may be lacking
• Computer processing is uniform

Totals that actually mean something

• Parity check
• Echo check
• Diagnostic routines
• Boundary protection

• Batch totals
• Hash totals
• Record count

Totals that have no meaningful interpretation

That the processing of data is accurate and as authorized

That the input of data is accurate and as authorized

Keeping track of the number of records processed to determine that the appropriate number was accounted for

Controls that have pervasive effects on all the specific applications

That the output of data (and the distribution of any related reports) is accurate and as authorized

Are the data recognized as legitimate possibilities

Are there any omissions from any fields in which data should have been present

Are the data all within some predetermined range