What it means
The question attribute sampling answers is how often, not how much. Auditors reach for it whenever a control is either applied or not applied, such as whether every purchase order above a threshold carries the required second approval.
Three inputs set the sample size before any testing begins: the tolerable deviation rate, meaning the highest failure rate you could accept and still rely on the control; the expected deviation rate, meaning what you think you will actually find; and the risk of over-reliance, the chance of wrongly concluding the control works. Tighten any one of the three and the required sample grows.
After testing, you calculate the sample deviation rate and then add an allowance for sampling risk to reach an upper deviation limit. If that upper limit sits below your tolerable rate you can rely on the control, and if it sits above, you cannot, which usually means testing the underlying transactions far more heavily.
Population size matters much less than people expect. Above roughly two thousand items the required sample is essentially the same whether you hold five thousand invoices or five hundred thousand, because sample size is driven by the rates you set rather than by the total count.
The main practical trap is confusing a deviation with a monetary error. A missing signature on an invoice that was correctly priced, correctly coded and correctly paid is still a control deviation and still counts, even though not a cent was lost.
In practice
Real-world examples.
Example
An internal audit team tests whether new starters at a hotel group had a signed contract on file before their first shift. They sample 60 files, find 2 without a contract, and report a 3.3% deviation rate to the human resources director. The finding triggers a change to the onboarding checklist rather than any monetary adjustment.
Example
A bank's compliance team checks whether identity verification was completed before each account was opened. Because the tolerable rate for a regulatory control is set very low at 2%, the required sample size is far larger than for an ordinary financial control, and a single deviation is enough to fail the test.
Example
An auditor tests whether every customer refund at an online retailer was authorised by a supervisor. The sample of 100 refunds shows 6 deviations, all from the same two-week period when a supervisor was on leave and nobody covered the role. The auditor abandons reliance on the control and tests refund amounts directly instead.
Formula
Calculation
Sample deviation rate = number of deviations / sample size
Upper deviation limit = sample deviation rate + allowance for sampling risk
A company requires a second approval on every purchase invoice above $5,000, and there were 18,000 such invoices during the year. The auditor sets a tolerable deviation rate of 5%, a risk of over-reliance of 5% and an expected deviation rate of 1%. The sampling tables give a required sample of 100 invoices.
Testing 100 invoices finds 1 missing approval.
Sample deviation rate = 1 / 100 = 1%.
The allowance for sampling risk at this sample size and confidence level is 3.7%.
Upper deviation limit = 1% + 3.7% = 4.7%.
Because 4.7% is below the tolerable rate of 5%, the auditor can rely on the control.
Now change one number. If the same sample of 100 had produced 3 missing approvals, the sample deviation rate would be 3 / 100 = 3%, the allowance for sampling risk would widen to 4.6%, and the upper deviation limit would be 3% + 4.6% = 7.6%. That sits above the 5% tolerable rate, so the control could not be relied upon despite 97 of the 100 invoices being perfectly approved.Case study
Seen in the real world.
Northgate Cabinetry is an illustrative and entirely fictional joinery manufacturer. Its finance director was convinced the purchase approval control was working because he had never seen an unauthorised invoice come across his desk. The internal auditor proposed a proper test rather than an impression.
The auditor set a tolerable deviation rate of 5%, selected 100 invoices above the $5,000 approval threshold and found 4 without the second signature. The sample deviation rate of 4% looked comfortable against the 5% tolerance until the allowance for sampling risk was added, pushing the upper deviation limit past the tolerable rate and making reliance unsupportable.
What made the exercise worthwhile was not the arithmetic but the pattern behind the four deviations. Every one of them was an invoice from a single long-standing supplier that the purchasing manager had quietly treated as pre-approved. In this fictional case, a technique designed to measure frequency ended up revealing a habit that nobody had thought to mention.
Watch out
Common mistakes.
- Choosing the sample size by feel rather than from the three inputs. Picking twenty-five items because it feels reasonable gives a result that cannot be projected onto the population in any defensible way.
- Ignoring the allowance for sampling risk. Comparing the raw sample deviation rate straight to the tolerable rate overstates how much comfort a small sample actually provides.
- Replacing a deviation with a fresh item once one is found. Swapping out awkward items destroys the randomness of the sample and makes the whole projection meaningless.
Questions
People also ask.
Why does population size barely affect the sample?
Above a couple of thousand items the statistics depend on the deviation rates and confidence level you choose, not on the total, so a much bigger population needs almost no extra testing.
What is the difference between attribute and variables sampling?
Attribute sampling counts how often something happens and produces a rate, while variables sampling measures amounts and produces an estimate of misstatement in dollars.
Do deviations always mean the financial statements are wrong?
No, a control can fail without any money being misstated, but repeated deviations raise the risk that a real error would go undetected next time.
From the founder's library
Take it further with the book.
Build your financial confidence beyond this definition. Shihan's full-length guide, Accounting Fundamentals, takes the same plain-English approach and turns it into a complete, practical playbook for non-finance managers, business owners and students - with chapter-end quiz answers and presentation slides included.
25% off with code MMHQ25, applied at checkout. Priced in USD - checkout may show the equivalent in your local currency.
View the book and save 25%Related