Auditors rarely test every transaction in a population. Instead, they select a sample and use the results to draw conclusions about the larger group of items. This approach is efficient, but it introduces uncertainty: the conclusion reached from the sample may differ from the conclusion the auditor would have reached by applying the same procedure to the entire population. This is known as sampling risk.

This matters as transaction populations grow larger, evidence becomes distributed across systems and file formats, and audit teams face persistent time pressure. A poorly designed sample or a poorly managed evidence-collection process can make testing less reliable and create additional rework.

In this article, I will explain what audit sampling risk is, what causes it, how it differs from non-sampling risk, and how auditors can manage it during substantive testing and tests of controls.

What Is Audit Sampling Risk?

Audit sampling risk is the risk that the auditor’s conclusion based on a sample differs from the conclusion that would have been reached if the same audit procedure had been applied to the entire population.

Because the sample represents only part of the population, it may contain a different rate of misstatements or deviations than the population as a whole. According to PCAOB AS 2315, sampling risk decreases as sample size increases.

Sampling risk and nonsampling risk are distinct sources of risk that can affect audit conclusions. Sampling risk arises from examining less than the entire population, while nonsampling risk can arise from factors such as inappropriate audit procedures, misinterpretation of evidence, or failure to recognize a misstatement.

What Are the Types of Sampling Risk?

According to PCAOB AS 2315, sampling risk is evaluated in the context of substantive testing and control testing.

Risk of Incorrect Acceptance

There is a possibility that a sample of a class of transactions may not contain a misstatement and, thus, lead to the acceptance of a balance as being properly stated when, in fact, it is materially misstated.

Risk of Incorrect Rejection

There is a possibility that a sample indicates that a population is materially misstated when the population is not materially misstated. This can lead the auditor to perform additional procedures or expand testing unnecessarily, reducing audit efficiency.

Risk of Assessing Control Risk Too Low

In tests of controls, sampling risk exists when the sample indicates that a control is more effective than it actually is. This may cause the auditor to assess control risk too low and perform less substantive testing than would otherwise be appropriate.

Risk of Assessing Control Risk Too High

In tests of controls, sampling risk exists when the sample indicates that a control is less effective than it actually is. This may cause the auditor to assess control risk too high and perform additional or unnecessary substantive procedures.

What Causes Sampling Risk in an Audit?

There are various reasons for sampling risk. Adequate planning and execution of the audit will help minimize these risks.

Inadequate Sample Size

The size of the sample relates to the tolerable misstatement, the allowable sampling risk, and the expected misstatement. Sample size also relates to the characteristics of the population. Sampling risks can occur even with the use of an appropriate selection method.

Poorly Defined Population

A sample will not help address an audit objective if the population does not adequately reflect the objective. The PCAOB states that sampling recorded items does not address the issue of unrecorded items, which may include transactions. Testing recorded items will not help address the omissions in the population.

Biased Sample Selection

Selecting items from the top of a list, choosing the easiest items to retrieve, or intentionally selecting favorable items may introduce selection bias. The selection method should provide an appropriate basis for drawing conclusions about the population. See these common control testing mistakes and how auditors avoid them.

High Variability Within the Population

A population containing both high-value and routine transactions may not be appropriately represented by a sample that does not account for those differences. Stratification or separate examination of higher-value or unusual items may be appropriate depending on the audit objective and population characteristics.

Unexpected Exceptions

Unexpected exceptions identified during sampling may require the auditor to reconsider the nature and extent of testing. The auditor may need to investigate the cause of the exception, determine whether similar issues exist elsewhere in the population, and evaluate whether additional procedures are necessary.

Incomplete or Unreliable Audit Evidence

A sample design does not operate independently of evidence quality. Circumstances that result in an inadequate population may lead to sampling design issues. For example, insufficient or absent supporting documentation may require the performance of additional audit procedures.

How Do Auditors Manage Sampling Risk

Minimizing sampling risk involves various activities throughout the sampling process, not just those related to establishing an appropriate sample size.

1. Define the Audit Objective Before Selecting the Sample

Auditors are obligated by the PCAOB to consider the population being sampled and to evaluate whether the sample will allow them to draw conclusions about the population (or the assertions being made about the population) within the tolerable limits of sampling risk. Audit sample design should be based on the audit objective and should not be based on using a predetermined, default sample size.

2. Validate the Population Before Sampling

The reliability of the population being sampled affects sampling risk. Before a sample is drawn, the auditor should evaluate the following:

• Reconcile the population to the general ledger or underlying system.

• Confirm the period covered by the population.

• Confirm the total record count.

• Document inclusion and exclusion criteria.

• Identify duplicates or missing records.

• Confirm the population supports the audit objective.

How to avoid rework: Request that the client submit a short population-validation summary alongside the raw population data, source system, period covered, reconciliation to the general ledger, and inclusion rules. This reduces the likelihood of discovering a population problem midway through testing.

3. Use an Appropriate Sample Size

A sample size taken from prior years' workpapers is inappropriate. Factors affecting the determination of sample size for substantive tests of details include the tolerable misstatement, the risk that the audit conclusion will be incorrectly accepted, the nature and the size of the population, as well as the nature and the size of the misstatements. In the case of tests of controls, the factors include the tolerable exception rate, the expected exception rate, and the risk of assessing control risk too low.

4. Use Representative Selection Methods

The selection method should give the auditor a reasonable basis for drawing conclusions about the population. PCAOB standards describe random and haphazard selection as appropriate and favorable techniques in relevant circumstances. Random selection gives each item a known opportunity for selection, while haphazard selection is performed without deliberate bias. Selecting the easiest items to retrieve or intentionally choosing favorable items does not provide an appropriate basis for sampling.

5. Consider Stratification

Dividing a population into more homogeneous groups before sampling can improve sampling efficiency. Common bases for stratification include transaction value, risk level, transaction type, business unit, and geography. High-value or unusual items may warrant separate examination rather than being left entirely to a general sample.

6. Make Sure the Sample Covers the Audit Period

The sampling approach should provide appropriate coverage of the period relevant to the audit objective. Auditors should consider the timing and frequency of the control or transactions being tested and ensure that the population and sample provide a reasonable basis for conclusions about the relevant period.

7. Plan for Missing Evidence Before Testing Begins

If supporting evidence for a sampled item is not available, the auditor should determine why the evidence is missing and whether alternative procedures can provide appropriate evidence. When a planned control test cannot be performed for a sampled item, the auditor should evaluate the reason and determine the appropriate response under the applicable audit methodology.

How to avoid delays: For every sampled item, define an evidence owner, evidence location, expected document type, backup evidence source, and escalation path before testing starts. This turns a reactive scramble into a more predictable process.

Sampling Risk vs. Non-Sampling Risk

These two risks are related but distinct, and confusing them can lead to the wrong corrective action.

PCAOB is explicit that nonsampling risk can arise from selecting procedures that are not appropriate for the audit objective or from failing to recognize a misstatement in evidence that was examined.

Common Audit Sampling Problems and How to Fix Them

• Fixed sample size: Base sample size on the audit objective, risk, tolerable misstatement or deviation, and population characteristics.

• Incomplete population: Reconcile and validate the population before selecting the sample.

• Convenience-based selection: Use an appropriate, documented selection method to reduce selection bias.

• Missing evidence: Confirm evidence availability and ownership before testing begins.

• Isolated exceptions: Evaluate the nature and cause of exceptions and whether similar issues exist elsewhere in the population.

• Poor documentation: Document the objective, population, methodology, selection, results, exceptions, and conclusion.

How AI Can Help Auditors Manage Sampling Risk

AI is increasingly supporting parts of the sampling and evidence-handling workflow, while underlying professional judgment remains with the auditor.

• Validate and organize populations: AI can help identify potential duplicates, inconsistencies, or missing information before sample selection.

• Match evidence to sampled items: AI can help locate supporting documentation and connect evidence to relevant controls or testing attributes.

• Perform first-pass testing: AI-assisted testing can evaluate predefined attributes and surface potential exceptions for auditor review.

• Identify patterns across exceptions: AI can help identify recurring characteristics across exceptions that may warrant further investigation.

• Keep the auditor in control: AI supports analysis and first-pass work, while sampling methodology, professional judgment, evaluation, and final conclusions remain with the auditor.

How Roz Supports Audit Sampling and Control Testing

Roz is an AI-native audit fieldwork and control-testing platform built for auditors, not the companies they audit. Isolated client workspaces keep evidence organized within each engagement, while evidence-to-control mapping connects supporting documentation to relevant controls, testing criteria, and sample entries.

Roz can accelerate the first pass of control testing by running defined or AI-suggested attribute checks against evidence and sample sets, returning PASS, FAIL, N/A, or INFO results for auditor review. It can also surface potential exceptions or insufficient evidence for investigation.

Completed control activities can be exported as formatted workpapers with supporting evidence, annotations, and audit trails. Auditors can use quote highlighting to verify results, rerun tests, or override them where appropriate.

Roz accelerates the repetitive first pass of evidence review and control testing. It does not replace sampling methodology, auditor judgment, or final conclusions.

Conclusion

Sampling risk cannot be eliminated, but it can be managed. A clear audit objective, a validated population, an appropriately designed sample, and disciplined exception review are practices that help auditors manage sampling risk.

Many sampling problems originate before testing begins, through an unreconciled population, an inappropriate sample size, or an undocumented selection method. Treating sampling as a deliberate audit process rather than a mechanical step can help auditors reach conclusions that are appropriately supported by the evidence.

Frequently Asked Questions 

How does sample size affect sampling risk?

Sampling risk generally decreases as sample size increases. For a given sample design, a smaller sample generally carries greater sampling risk because the sample may differ more from the population as a whole.

What is sampling risk in control testing?

In tests of controls, sampling risk takes two forms: the risk of assessing control risk too low and the risk of assessing control risk too high. The first may cause the auditor to overestimate control effectiveness, while the second may cause the auditor to underestimate it.

How do auditors handle exceptions found in a sample?

Auditors evaluate both the frequency and nature of an exception, including whether it appears isolated or may indicate a broader issue. An exception is a starting point for investigation and evaluation, not necessarily a conclusion about the entire population.

What is risk-based audit sampling?

Risk-based sampling designs the sample around the specific audit objective, assessed risk, tolerable misstatement or deviation, and relevant population characteristics rather than applying a uniform sample size across all engagements.