Information Systems Auditing Process · Topic 3 of 5
Audit Project Management and Sampling
Managing an IS audit engagement, compliance and substantive tests, statistical and judgmental sampling, attribute and variable sampling and sample size.
- 3 min
- Includes a diagram
- Compliance tests check controls; substantive tests check data.
- Attribute sampling measures rates; variable sampling measures amounts.
- Higher confidence or expected error means a larger sample.
What it is
An IS audit is a project: it has objectives, a scope, a budget, a team and deadlines. Audit project management keeps the engagement on track. Testing and sampling decide how the auditor checks controls when the population is too large to examine item by item, and how far the results can be relied on.
How it works
Running the engagement
- Set objectives, scope and criteria, and agree them with the auditee.
- Write the audit program: the steps, tests and evidence needed.
- Assign skilled staff and allocate time.
- Perform fieldwork, supervise the team and review work papers.
- Track progress, raise issues early and communicate with the auditee.
- Close with an exit meeting and the report.
Work papers document what was planned, done, found and concluded. Another auditor should be able to follow them and reach the same conclusion.
Compliance and substantive testing
| Test | Question it answers | Example |
|---|---|---|
| Compliance test | Is the control operating as designed? | Check that changes in a sample have approval before release |
| Substantive test | Is the data or transaction itself correct? | Recalculate interest on a sample of accounts |
If compliance testing shows controls are strong, the auditor can reduce substantive testing. Weak controls mean more substantive work.
Sampling methods
| Method | Use |
|---|---|
| Statistical sampling | Random or systematic selection with mathematically defined confidence; results can be projected objectively |
| Nonstatistical (judgmental) sampling | Auditor chooses items by judgment; useful but cannot measure sampling risk |
| Statistical type | Measures | Variants |
|---|---|---|
| Attribute sampling | How often a control fails (a rate), used in compliance testing | Stop-or-go, discovery sampling |
| Variable sampling | A monetary amount or quantity, used in substantive testing | Mean per unit, stratified mean per unit, difference estimation |
Discovery sampling is used when the auditor needs to find at least one example of something rare, such as fraud. Stop-or-go sampling stops early when very few errors are expected and none are found.
What drives sample size
| Factor | Effect on sample size |
|---|---|
| Higher required confidence level | Larger sample |
| Higher expected error rate | Larger sample |
| Higher tolerable error rate | Smaller sample |
| Larger population (beyond a point) | Little effect |
Stratification divides a population into groups, for example high-value and low-value transactions, so the sample can focus on the riskier stratum.
A statistical sample is only valid if every item in the population had a chance of selection. Before sampling, confirm the population is complete, for example by reconciling the record count to the source system.
Sampling risk
Sampling risk is the chance that the sample does not represent the population. Statistical sampling lets the auditor measure and control this risk; judgmental sampling does not.
How the exam asks about this
- "The auditor needs to detect even one fraudulent transaction." Discovery sampling.
- "Testing whether approvals were obtained." Attribute sampling in a compliance test.
- "Expected error rate increases. What happens to sample size?" It increases.
What to remember for the exam
- Compliance tests check controls; substantive tests check data.
- Attribute sampling measures rates; variable sampling measures amounts.
- Higher confidence or expected error means a larger sample.
- Confirm the population is complete before you sample.
- Work papers must support every conclusion.
Extrapolating a judgmental sample to the whole population is not statistically valid. Report it as a judgment, not a projection.
Common mistakes
Mixing up compliance and substantive tests. Ask whether the test checks a control or the data.
Sampling from an incomplete population. The result says nothing about the missing items.
Assuming a bigger population always needs a much bigger sample. Beyond a certain size it barely changes.
Check yourself
Which sampling type is suited to testing a control's failure rate?
Attribute sampling.
What does a substantive test examine?
The correctness of the data or transactions themselves.
What happens to sample size if tolerable error is increased?
It decreases.
Topic 3 of 5 in Information Systems Auditing Process
Test yourself on Information Systems Auditing Process
The full ISACA CISA question bank has 1,050 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by ISACA. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.