An auditor is using non-statistical sampling for tests of controls. The auditor selects a sample of 40 items and finds 3 deviations. The tolerable deviation rate is 5%. Which of the following is the auditor's MOST appropriate conclusion?
- AThe control is effective, as the sample deviation rate is less than the tolerable rate.
- BThe control is likely not effective, and the auditor should increase the scope of substantive procedures.
- CThe auditor can conclude the control is effective if the projected deviation rate is within tolerance.
- DThe sample size was too small, and the auditor should expand the sample.
Show answer & explanationAnswer & explanation
Correct answer: B. The control is likely not effective, and the auditor should increase the scope of substantive procedures.
For non-statistical sampling, when the observed deviation rate (3/40 = 7.5%) exceeds the tolerable deviation rate (5%), the auditor cannot conclude that the control is effective. Even without statistical projection, a rate higher than tolerable often indicates the control is not operating effectively, requiring increased substantive procedures.
Why the other options are wrong
- A. The sample deviation rate (7.5%) is *greater* than the tolerable rate (5%), so the control is not effective.
- C. For non-statistical sampling, there isn't a formal 'projected deviation rate' in the same way as statistical sampling; the direct comparison to the tolerable rate is key. Also, 7.5% is already above 5%.
- D. While a larger sample might provide more precision, if the current rate is already unacceptable, simply expanding the sample won't change the conclusion about the control's effectiveness in its current state.
Non-Statistical Sampling Conclusion
In non-statistical sampling for tests of controls, if the observed deviation rate significantly exceeds the tolerable deviation rate, the auditor concludes that the control is not operating effectively and must increase the scope of substantive procedures.
- Direct comparison of observed rate to tolerable rate.
- No formal allowance for sampling risk (as in statistical sampling).
- If observed > tolerable, control is ineffective.
- Requires increased substantive testing.
Memory trick: If the count is too HIGH, the control must DIE.