Practical examples when determining sample sizes

for tests of controls

This includes examples when determining sample sizes for tests of control procedures.
When determining our sample sizes we consider the:
 Objectives of the audit procedure (SM_3.1)
 Minimum sample sizes required (SM_3.3)
 Other factors that influence the sample size (SM_3.4)
These examples are for illustrative purposes only. Engagement teams consider the facts and
circumstances specific to their situation when determining the appropriate sample size. All
of the examples assume that there is more than one control being tested for a relevant
assertion.
Example 1
An entity has a three-way match control that compares the purchase order, receiving report
and invoice. The system provides an exception report each time a match cannot be made.
The three-way match control is an application control and therefore a “test of one” is an
appropriate sample size to confirm the application control is operating effectively.
The exception reports are generated and reviewed daily; this is a separate control to the
three-way match itself and is an IT-dependent manual control. For this control, we select a
sample of 25 exception reports (as they are produced daily) to test that the exception
reports are being reviewed and individual items are followed up and select a sample of
transactions included in the exception report. We perform procedures to verify that the
entity is making the appropriate adjustments when an exception is noted.
Example 2
An entity has a three-way match control that compares the purchase order, receiving report
and invoice. In this example, the IT application that generates purchase orders does not
automatically interface with the IT application that generates the receiving reports. Instead,
an accounts payable clerk obtains the necessary documentation from the various IT
applications to create the voucher package. On a daily basis, the accounts payable clerk
manually compares the number of items per the purchase order, receiving report and
invoice and follows up on any exceptions noted. We discuss with the clerk how they perform
the control, for example we ask what they are looking for as they match the documents,
how they indicate they have performed the control (do they initial the documents?) and how
they address exceptions identified. This three-way match control is an IT-dependent manual
control so we select a sample of 25 voucher packages, examine evidence of the clerk
performing the control and verify that the information on the purchase order, receiving
report and invoice agree. If the information does not agree, we test that the accounts
payable clerk followed up on unmatched transactions and made the appropriate
adjustments.
Example 3
Assume the same facts as Example 2. However, in this example there is an accounts
payable manager who reviews, on a weekly basis, the voucher packages that have been
identified by the accounts payable clerk as having exceptions. In this situation, we identify
the weekly review performed by the accounts payable manager as the control to test. We
understand the process in place for making sure that all voucher packages with exceptions
are provided to the accounts payable manager. We then select a sample of 5 weeks to
verify that the exceptions were investigated by the accounts payable manager and

30 November 2012
appropriate documentation exists evidencing the follow-up. We discuss with the accounts
payable manager the procedures they perform and how they satisfy themselves that the
accounts payable clerk is performing the matching correctly.
For the 5 weeks selected, we select a sample of individual voucher packages and review
documentation that adjustments were made as a result of the exception noted. In addition,
to gain evidence that the matching is performed correctly by the accounts payable clerk, we
discuss with the clerk the procedures they perform and how they address exceptions
identified. We also select a sample of transactions and reperform the three-way match. In
this situation, even though the three-way match is an IT-dependent manual control, the
sample size for reperforming the three-way match is a matter of professional judgment
since the three-way match is performed in combination with the detect and correct control
performed by the accounts payable manager. In this situation, we do not require the same
level of evidence as we would if this was the only control being tested and relied upon.
Therefore, in this situation we decide to select a sample of 5-10 transactions to verify that
the three-way match is occurring.
Example 4
An entity has one bank account that it reconciles on a monthly basis. As this control
operates monthly, we select 2 months to test the operation of the control. For each month
selected, we perform the following:
 Agree the book balance per the general ledger to the book balance per the bank
reconciliation
 Agree the bank balance per the bank statement to the bank balance per the bank
reconciliation
 Select a sample of reconciling items. For those normal reconciling items, such as
unpresented checks and outstanding deposits, we select a sample (say those greater
than a percentage of TE, but sufficient to follow through a sample of items) and
review supporting documentation that the reconciling item is appropriate. We may
also follow these through to the following period to confirm they clear appropriately.
For unusual reconciling items we may follow up on a greater number of these to
understand why they have occurred and that they subsequently clear the bank
account or are appropriately adjusted.
 Review all other reconciling items for reasonableness (review of supporting
documentation is not required)
Example 5
An entity has 20 bank accounts that are each reconciled on a monthly basis. We test this
monthly control covering an interim period of 7 months of the audit period. We select 14
reconciliations out of the total of 140 reconciliations (i.e., 7 months x 20 bank accounts).
The total number of occurrences of this control is within the range of 50 to 250, we
therefore select 10% of the number of occurrences to test. In this situation, we would then
perform procedures to update our tests of controls. Our update procedures would include
inquiry, observation, inspecting a sample of reconciliations performed for the last 5 months
of the year to see that they were performed on a timely basis and a consideration to
perform an additional walkthrough of the bank reconciliation control (refer to E04_2 for
further requirements and guidance on updating tests of controls).
Alternatively, it would also be appropriate to determine our sample size by projecting the
total number of bank reconciliation that will be completed throughout the period of reliance
(i.e., 240 occurrences and therefore a sample size of 24 (or 10% of the total population)).
In this situation, we would then select 12 bank reconciliations in the first 6 months of the
year and the remaining 12 bank reconciliations in the last 6 months of the year. As testing

30 November 2012
has taken place up to the period end, there is no need to perform update procedures as we
will have evidence throughout the period that the control operated effectively.
Example 6
Assume the same facts as Example 5 except an entity has 50 bank accounts. In this
example, our sample size is 25 reconciliations since the total number of occurrences
exceeds 250 occurrences (regardless of whether we select our sample of reconciliations
covering a period of 7 months or project the total reconciliations that will be performed
during the period of reliance). We perform update procedures based on the timing of when
the bank reconciliations were tested.
Example 7
An entity has 30 bank accounts and each month a clerk performs a reconciliation for each
bank account. A supervisor then performs a detailed review of each of these bank
reconciliations on a monthly basis to determine that the reconciliation was accurately
completed, including that all reconciling items have been listed and unusual reconciling
items have been appropriately investigated. We decide to test the detect and correct control
performed by the supervisor covering an interim period of 11 months of the audit period.
Since this is a monthly control, we select 2 months to test the operating effectiveness of
this control. Our procedures include:
 Obtaining evidence that the supervisor performed the reviews in accordance with the
design of the control and on a timely basis. Such evidence may include reviewing
documentation that shows the supervisor’s annotations, or through observation and
inquiry, including inquiry of staff members who perform the individual bank
reconciliations, to confirm that the supervisor does perform the control; and
 Reviewing a sample of individual bank reconciliations (e.g., 5) for each of the two
months selected, to confirm the reconciliation has been performed and that
supporting documentation shows the reconciling items and that the appropriate
details have been reported to the supervisor. The procedures performed will be the
same as in Example 4 and includes reviewing the bank reconciliation and supporting
documentation in enough detail to confirm that the reconciliation was completed
appropriately.
The operation of the supervisory control provides audit evidence that the reconciliations for
each of the 30 bank accounts have been properly performed throughout the period.
Example 8
An entity has 15 retail branches at different locations. Each branch is managed by a
different retail manager who is responsible for preparing, in accordance with corporate
policy, the daily reconciliation between cash collected to total daily sales. This reconciliation
is reported to the head office when, on a weekly basis, the finance manager at head office
reviews a summary exception report for all 15 branches. This exception report highlights
variances between total cash collected and total daily sales. The finance manager is
responsible for investigating variances and ensuring appropriate action has been taken at
the branch. She achieves this by reviewing the exception report, selecting those with a
variance of greater than $1,000 (our TE is $1 million), reviewing the variance analysis and
following up with the local branch manager.
In this situation, we may decide to select a sample of 25 daily reconciliations across the 15
branches to test the control operated by the retail manager at the branch level. We test the
reconciliation by tracing the details of the reconciliation to source documents (e.g., cash
register tape and the bank account to verify daily deposits of cash).

30 November 2012
Alternatively, we may decide to test the detect and correct control performed by the finance
manager at the head office. The control performed by the finance manager is a weekly
control so we test a sample size of 5 weeks, by performing the following:
 Inquire of the finance manager how she completes her review and vouch evidence of
follow up being performed, for example through email correspondence or notation on
the exception report
 Inquire of branch managers as to whether they have reported a variance and the
procedures employed by the finance manager to follow up on the variance
 Gain evidence of the completeness of the exception report by either reviewing the
underlying system code, or by tracing through one reported variance from the
branch to the exception report to verify an exception was reported and one reported
non variance from the branch to the exception report to verify there was no
exception reported
 Test a small sample of cash reconciliations performed at the branches. The sample
size is a matter of professional judgment since the branch cash reconciliations are
performed in combination with the detect and correct control performed by the
finance manager. In this situation, we do not require the same level of evidence as
we would if this was the only control being tested and relied upon. Therefore, in this
situation the sample size may be to select 5-10 reconciliations.
Example 9 - Inventory cycle counts
An entity has a perpetual inventory system that tracks inventory quantities. The entity has
concluded that it can rely on the quantities recorded in the inventory system for the
purposes of its financial reporting without conducting an annual wall-to-wall physical.
Instead of performing an annual physical inventory the entity performs cycle count
procedures throughout the year to test the accuracy of the quantities recorded in the
inventory system.
The entity performs daily cycle count procedures for items selected by a cycle count module
of the inventory system using an ABC type designation. That is, ‘A’ items are larger value
items and/or turn most frequently and are selected for counting more frequently, ‘B’ are
counted less frequently than ‘A’ but more frequently than ‘C.’ The entity keeps a record of
the daily counts taken and any adjustments recorded to document the accuracy of the
inventory system.
In order to obtain assurance over the completeness and existence of inventory, we
determine that we will test the cycle count procedures to test the entity’s perpetual
inventory control. In most cases, we design our tests of control procedures to be performed
concurrently with our tests of details (i.e., a dual purpose test). The audit objectives for the
‘dual purpose’ tests are:
 Tests of controls – evaluate the operating effectiveness of the controls related to the
cycle count methodology
 Tests of details – to test the completeness and existence assertions for inventory
To test the design of the cycle count controls, we first understand the entity’s methodology
for determining when and where the cycle counts are performed and how the entity
determines the items selected for testing achieve their objective of testing inventory
quantities over the agreed period of time. We gain this understanding through discussion
with relevant personnel, reviewing IT applications, reading the entity’s written procedures
and performing a walkthrough of the procedures/controls by which items are selected for
testing in the cycle counts. We perform testing of the application as appropriate to obtain

30 November 2012
evidence that the application is selecting the items to be counted in accordance with the
entity’s policy.
We also inquire about how the entity responds to differences identified during the cycle
count (e.g., do they extend the sample selected when errors are identified) and how
differences are resolved.
To test the operating effectiveness of the cycle count control, we select a sample of cycle
counts performed by the entity up to an interim date. If the cycle counts are performed
daily, the extent of testing guidance in SM_3.3 Consider the minimum sample size indicates
that our sample size is 25. In this situation, we select a random sample of 25 days
throughout the year. For some of those days selected (for this example, we determined 3
days to be an appropriate number) we physically observe and test a sample of the cycle
counts performed on that day to reinforce our understanding of how the cycle count controls
operate and obtain evidence that the control is functioning.
For each of the days selected for physical observation, we select a sample of inventory
items:
 From the ‘floor’ (i.e., those items that the entity is counting on that day), count the
items, agree to the entity’s cycle count and agree to the perpetual records; and
 From the ‘book’ (i.e, the perpetual record), select items from the perpetual inventory
records, and count the items on the ‘floor’ to determine whether they are in
agreement
[Note: The selection from ‘floor’ to the entity’s cycle count sheets is a reperformance test to
determine that the entity’s cycle counting control is operating effectively. This also provides
substantive evidence of the completeness of inventory. The ‘book’ to floor test is not
necessary for evidence of the operation of the control, but provides substantive evidence of
the existence of inventory.]
The number of inventory items that we count ‘floor to book’ and ‘book to floor’ on the
sample days is a matter of professional judgment. A sample size of 25 inventory items may
be appropriate when there is a large population of items being cycle counted. However, we
consider the factors in SM_3.4 as well as the following specific factors in determining the
number of days we will observe and the number of items to select for each of those days:
 The number of items that the entity counts on a given day
 The complexity of the counts (i.e., are the items weighed or determined by an
estimate?)
 The method the entity uses to select which items to count during the cycle count
proceedings
 If an ABC type designation is used, how many times per year each of these
designations or high value items counted (e.g., all ‘A’ items counted 5 times per year
but ‘C’ items are counted annually)
 Whether internal audit or others observed cycle count procedures
[Note: Since this test is a dual purpose test, i.e,. providing evidence of the operating
effectiveness of the cycle counting controls as well as substantive evidence of the
completeness and existence of inventory, we consider the extent of testing to achieve both
objectives. Typically, we achieve substantive evidence of the completeness and existence of
inventory through a number of procedures, including testing the reconciliation of book to
physical adjustments recorded in the financial statements, substantive analytical review of
margins and completeness testing of liabilities. This, together with the dual purpose testing
of inventory cycle count controls, may provide sufficient appropriate audit evidence. As a

30 November 2012
result it may not be necessary to obtain the level of coverage, by value, of the inventory
account balance through physical verification, as would be necessary if this was the only
procedure providing audit evidence of completeness and existence. Therefore, when
determining the extent of reperformance of inventory cycle counts we consider the evidence
obtained from other procedures to determine the extent of testing required.]
For the 25 sample days, we obtain evidence of the:
 The entity’s performance of the cycle counts,
 The count differences noted
 Resulting adjustments posted in the system
 The reflection of those differences in the cycle counting accuracy reports (i.e., the
year-to-date summary of the error rates noted throughout the period)
By combining our observations of the physical counts with the evidence from our inquiries
and inspection of the operation and results of client performance of the controls, we reach a
conclusion on the effectiveness of the cycle count controls. We review the cycle counting
accuracy reports at year end, and assuming that the accuracy reports show the perpetual
inventory records to be highly accurate, we are able to rely on the perpetual inventory
records to support the quantities of inventory on hand.
If the entity’s cycle count controls are performed less frequently than daily (e.g., weekly),
we adjust our required sample size in accordance with the guidance in SM_3.3 Consider the
minimum sample size. As a result, we select a minimum of 5 weeks to test. We also obtain
evidence of the entity’s performance of the cycle counts as discussed above and physically
observe their performance. The determination of how many weeks to observe is a matter of
professional judgment. When determining how many weeks to observe and how many items
to count for each of those weeks, we consider the factors in SM_3.4 as well as the specific
factors above. However, our testing within each of these weeks would be more than what
we might have done in the daily testing example above, such that the extent of our total
testing would be similar.
When our testing procedures are performed up to an interim date we perform update
procedures to confirm the cycle count control continues to operate throughout the period.
We follow guidance in E04_2 Update our tests of controls procedures and evaluate the
results. Our update procedures may include:
 Inquiry of personnel whether there have been changes in the cycle count
methodology and procedures since the interim date
 A review of a sample or all of the cycle count accuracy reports to confirm that counts
have continued to take place
 Where the interim testing was performed more than 3 months from the period end,
we may perform additional testing of the cycle counts.
Multilocation cycle counts
If the entity has physical inventory at multiple locations, we consider whether the following
are similar at the various locations:
 The procedures performed to complete the cycle count
 The personnel involved in the cycle count process (i.e., those individuals that
perform and review the cycle counts)
 The IT systems

30 November 2012
If the entity performs the same procedures, uses the same personnel and has one IT
system for all locations, we may consider this to be one population when determining how
many locations to physically observe. If each location has different personnel performing
the cycle counts but the count is overseen by a representative of a central team, then we
may still consider this to be one population. However, if each location has different
personnel performing the cycle counts, and no oversight by a central team, we cannot treat
the locations as one population and we consider observing more locations. In determining
the number of locations to observe, we consider if the individuals performing the cycle
counts have similar knowledge, experience and training. The more similar the knowledge,
experience and training of the personnel involved in the cycle counting process, the less
locations we may decide to physically observe.

We also consider the following for group audits:

 The extent of group-wide controls over inventory; in particular whether group

management has developed controls which provide additional assurance over the
completeness and existence of inventory. These may include spot checks by internal
audit, or the monitoring of key performance indicators (KPIs). If these group-wide
controls are operating effectively and are sensitive enough to identify misstatements
in inventory quantities that could be material to the financial statements, we may be
able to test and rely on these group-wide controls to reduce the number of locations
we observe and test cycle counting procedures.
 If there are a large number of locations and we assess group-wide controls are
operating effectively, we may consider rotating the locations that we observe each
year.
 If the value of inventory held varies between different locations, we may focus our
audit procedures on those locations that have more material inventory balances as
these are more likely to contain a higher risk of material misstatement due to their
size.
For further guidance on performing physical inventories, refer to AS_4 Standard account-
specific guidance.

30 November 2012