Audit Sampling: How 40 Invoices Speak for a Year

What is audit sampling?

Audit sampling is how an auditor reaches a view on a whole year of transactions by testing only some of them: they pick a few dozen supplier invoices out of thousands, ask you for the records behind each one, and work out from the errors they find how wrong the whole year might be. The rules for it in a private company audit are in AU-C 530, the AICPA’s standard on audit sampling. For the bookkeeper the job is simple to say and hard to do in a hurry: when the list of picked invoices arrives, have the invoice, the approval and the payment ready for every line on it, because an item you cannot support counts against the books just as a wrong amount does.

What does AU-C 530 ask of the auditor?

AU-C 530 applies when the auditor has chosen to test part of a group, such as the year’s supplier invoices, in order to reach a conclusion about all of it. It does not cover the few items an auditor follows through your process just to see how it works. Four of its requirements decide what the bookkeeper sees.

1. The sample has to stand for the whole group. The auditor picks items so the sample can be expected to look like the year it comes from and to give solid grounds for judging that year. That is why the list rarely matches the invoices you would have chosen.
2. Every item picked is tested. No line on the list is skipped because it is awkward, old or hard to find.
3. An item the test does not fit is replaced. If a picked item is not the kind of item the test is for, such as a credit note pulled from a list of invoices, the auditor swaps in another properly chosen item and tests that one instead.
4. An item that cannot be tested counts as an error. When the records are missing, the auditor first tries other evidence. If nothing works, the item is treated as a failure, not dropped.

The last rule has two forms. In a test of controls, which checks whether your own routines worked, such as an approval before payment, an untestable item counts as a control failure. In a test of details, which checks the amounts and records themselves, it counts as a misstatement: something wrong in the figures, in how an item is grouped, or in what the statements say about it.

What are the audit sampling methods?

There are two families. Statistical sampling in auditing picks items at random and uses probability to measure how far the sample’s answer could be from the truth. Nonstatistical sampling relies on the auditor’s judgment for the size and the reading of the result, though the items must still be chosen so the sample can stand for the year. Both are in common use, and both end the same way, with the errors found projected across the whole group.

Within those families, the common ways of choosing items are these:

• Random selection: every invoice has the same chance of being picked, usually drawn by software from your full list.
• Interval selection: the auditor starts at a random point and takes every so many items, such as every 50th invoice, or every so many dollars down the list.
• Dollar-weighted selection: each dollar of spend has the same chance, so an invoice for $20,000 is twenty times as likely to be picked as one for $1,000. This method is often called monetary unit sampling, and it is why the list leans toward your larger bills.
• Haphazard selection: the auditor picks without a set method but tries to avoid any pattern. It suits only a nonstatistical sample.

Many auditors also test every invoice above a size they set, outside the sample, because a single large error there would matter on its own. If your list holds more big invoices than you expected, that is usually the method doing its job, not a sign of suspicion.

What sets the audit sample size?

The auditor sets the audit sample size from a few judgments, not from the number of invoices you have. The larger the risk that the year’s expenses are wrong, the larger the sample. The smaller the error the auditor could accept before the statements mislead a reader, the larger the sample. The more errors they expect to find, the larger the sample. And the more comfort they already have from other work, such as tests of your approval controls, the smaller it can be.

The size of the year matters less than people think. Once a group runs to more than a few hundred items, a sample of 40 can speak for 2,300 invoices about as well as it could for 23,000. What moves the number is how clean your records have been and how much the auditor already trusts your controls, which is why a company with tidy records and working approvals often sees a smaller request the following year.

Worked example: AU-C 530 applied to a year at Ferrygate

Ferrygate Plumbing & Heating is an invented company, one of the Demo companies Ressura uses to show its checks, and its suppliers are invented too, so every figure below is made up for the example. It is a plumbing and heating contractor in Tacoma with about forty staff, its year ends on 31 December, and Dana Whitlock, its Office Manager and Bookkeeper, pays the supplier invoices.

Last year Ferrygate paid 2,300 supplier invoices, about $4.1 million in all. Testing the expense amounts under AU-C 530, the auditor uses dollar-weighted selection and picks 40 invoices that together come to $310,000, an average of $7,750 each against about $1,780 across the year, because larger invoices were likelier to be picked. For each one Dana is asked for three things: the invoice, who approved it and when, and the payment that settled it.

Here is how the 40 came out:

• 36 ticked straight away. Each had its invoice, an approval with a name and a date, and a bank payment for the same amount.
• One was a credit note, a $2,400 credit from Cascade Pipe & Supply that sat in the invoice list. The test was built for invoices, so the auditor swapped in another invoice chosen the same way, and that one ticked.
• One had no approval on file. The email approving a $5,600 boiler order had been deleted. The auditor turned to other evidence: the supplier’s statement, the delivery note signed when the boiler arrived and the bank payment. Together they showed the purchase was real and the amount right, so the expense passed. Had the auditor also been testing approvals, that same item would have counted as one control failure.
• One had the wrong amount. A Cascade Pipe & Supply invoice for $12,450 had been entered as $14,250, two digits swapped, so expenses were overstated by $1,800.
• One could not be tested at all. A $7,500 payment to Narrows Equipment Rental had no invoice, no approval and no delivery record, and the rental company had closed and could not send a statement. The bank shows money went out, but nothing shows what Ferrygate received for it, so the auditor cannot confirm the expense really happened. With no other evidence left, it counts as a $7,500 error.

The two errors come to $9,300. Projected misstatement is the auditor’s estimate of the error across everything they did not test. The auditor’s method sets the exact figure, and a statistical one adds an allowance for the chance that the sample misleads, but the simplest way to see it is to apply the sample’s error rate to the year. The $9,300 is 3% of the $310,000 tested, and 3% of $4.1 million is about $123,000.

What does the projected misstatement mean for you?

The two known errors are corrected: Ferrygate reduces its expenses by $1,800 for the swapped digits, and it either finds the papers for the $7,500 or agrees with the auditor how to treat it. The $123,000 is not an entry anyone books. It is the auditor’s best estimate of what may be wrong across the part of the year nobody looked at, and the auditor sets it against the error they could accept for Ferrygate’s statements.

If the projection sits well inside that limit, the test is done. If it comes close or goes over, the auditor may test more invoices, ask Ferrygate to search a part of the year for the same kind of mistake, such as every payment to a supplier with no invoice on file, or treat the result as a reason to look harder elsewhere. Either way the bookkeeper hears about it as more requests, which is why the cost of one missing invoice is never just its own amount.

Notice which error hurt most. The swapped digits were $1,800 of the $9,300, and the missing papers were the other $7,500, so about four fifths of the $123,000 comes from one payment that may well have been fine. A record you cannot produce is the most expensive error on the list, and it is also the one most fully in your hands.

How do you have the 40 ready before they are picked?

You cannot know which 40 the auditor will pick, so the only sure way to be ready is to have every invoice ready. The habit is the same one auditors look for, that every transaction above a small threshold has a document behind it:

• Keep the three records together. For each invoice, file the invoice, the approval with its name and date, and the payment, so one search finds all three.
• Keep supplier statements. A month-end statement from each main supplier is the other evidence an auditor reaches for when an approval or an invoice goes missing.
• Label credit notes as credit notes. A credit filed as an invoice will be picked from an invoice list and swapped out, which costs both of you time.
• Check amounts as they are entered. A swapped pair of digits is easy to catch the day an invoice arrives and costly to explain a year later.

This is where Ressura helps the bookkeeper show that everything is in order. The Procure-to-Pay Module checks every supplier invoice against the agreement behind it as it comes in, including its prices and its arithmetic, and flags any invoice that repeats another. The Cash & Bank Module matches every bank transaction to an entry in your books and flags a payment above the limit you set that has no recorded approver. So by the time the auditor’s list arrives, the amounts and approvals behind it have already been checked, and the line you take upward is the one every bookkeeper wants to say: “40 invoices asked for, 40 found with their approval and payment.”

For what the rest of the audit asks for, read what auditors actually look for, and for the order the work runs in, what happens in a financial statement audit.

Sources

1. AU-C 530, the AICPA’s standard on audit sampling