Almost no audit tests every transaction. Whether you are testing payment approvals at a parastatal, loan files at a bank or grant expenditure at an NGO, you will usually examine a sample and draw a conclusion about the whole population. ISA 530, Audit Sampling, sets out how to do that so the conclusion is defensible. Here is what it requires, where files fall short, and a checklist for your next engagement.
What ISA 530 covers and when it applies
ISA 530 applies when the auditor has decided to use audit sampling in performing audit procedures. It is effective for audits of financial statements for periods beginning on or after 15 December 2009. It works alongside ISA 500 (audit evidence) and ISA 330 (responses to assessed risks).
The standard defines audit sampling as applying procedures to less than 100% of the items in a population relevant to the audit, in such a way that every sampling unit has a chance of selection. That last condition matters: picking only the largest ten invoices is not audit sampling in the ISA 530 sense. It is specific item testing: valid, but no basis for projecting results to the rest.
Key definitions:
- Sampling risk – the risk that your conclusion from a sample differs from the conclusion you would reach if you tested the whole population.
- Tolerable misstatement – a monetary amount the auditor sets, aiming for appropriate assurance that actual misstatement does not exceed it (for controls, the equivalent is the tolerable rate of deviation).
- Anomaly – a misstatement or deviation that is demonstrably not representative of the population.
The core requirements, step by step
1. Design the sample
When designing the sample, the auditor must consider the purpose of the procedure and the characteristics of the population from which the sample will be drawn. Be clear on what you are testing for and whether the population is complete.
2. Determine a sufficient sample size
The sample size must be sufficient to reduce sampling risk to an acceptably low level. ISA 530 does not prescribe numbers. Its appendices list factors that influence size: for example, a higher assessed risk, a lower tolerable misstatement or deviation rate, a higher expected error and a desire for more assurance from the test all push the sample size up. Stratification can reduce it.
3. Select items so each unit has a chance of selection
Items must be selected so that every sampling unit in the population has a chance of being chosen. The application material describes random, systematic and monetary unit selection, and haphazard selection free of conscious bias. Block selection is generally not appropriate when you intend to draw conclusions about the whole population.
4. Perform the procedures
The auditor performs procedures appropriate to the purpose on each item selected. If the procedure cannot be applied to a selected item (such as a properly cancelled cheque), the auditor performs it on a replacement item. If the auditor cannot apply the designed procedure, or a suitable alternative, to a selected item, that item is treated as a deviation or misstatement. “Supporting document not available” is therefore an exception, not a reason to pick another invoice.
5. Investigate deviations and misstatements
The auditor must investigate the nature and cause of every deviation or misstatement identified and its possible effect on other areas of the audit. Calling an error an anomaly is only allowed in extremely rare circumstances, and requires a high degree of certainty that it does not represent the population, supported by additional procedures.
6. Project and evaluate
For tests of details, the auditor must project the misstatements found in the sample to the population. Finally, the auditor evaluates the results and whether the use of sampling has provided a reasonable basis for conclusions about the population. If not, the auditor may extend testing or perform alternative procedures.
A worked illustration of projection
Suppose a supplier payments population of USD 2,400,000 is tested with a sample of items totalling USD 300,000, and the sample shows overstatements of USD 4,500. Using a simple ratio approach, projected misstatement is 4,500 ÷ 300,000 × 2,400,000 = USD 36,000.
| Item | Amount |
|---|---|
| Population value | USD 2,400,000 |
| Sample value tested | USD 300,000 |
| Misstatement found in sample | USD 4,500 |
| Misstatement rate (4,500 ÷ 300,000) | 1.5% |
| Projected misstatement (1.5% × 2,400,000) | USD 36,000 |
Against a tolerable misstatement of USD 40,000, this is close enough that sampling risk becomes a real concern and further work is likely. Where items were tested individually because they were key or high value, misstatements in those items are added at face value rather than projected.
Why it matters in the Zimbabwean context
Many Zimbabwean entities hold records in both ZiG and USD, sometimes across separate ledgers or systems. Combining these into one population without converting to a common basis, or without stratifying by currency, can distort both sample selection and projection. Public sector entities and NGOs often have many low-value transactions alongside a few large ones; stratifying and testing the high-value stratum in full is usually more efficient and more defensible.
For large ledgers that strain Excel, a tool such as ProDataTool lets you summarise, stratify and filter millions of rows before you select your sample.
Common gaps seen in practice
- No population reconciliation. The sample is drawn from a listing that was never agreed to the general ledger, so completeness is not established.
- Sample size with no rationale. No link to risk, tolerable misstatement or expected error.
- Replacing missing items. Items without support are swapped out instead of being treated as exceptions.
- Errors waved away as anomalies. Exceptions are labelled one-offs without the additional work the standard expects.
- No projection. Misstatements found in a test of details are reported as the sample amount only, understating the potential problem.
Practical ISA 530 checklist
- State the objective of the test and define a deviation or misstatement before selecting anything.
- Define the population and sampling unit, and reconcile the population to the ledger.
- Consider stratification, including by value and by currency (ZiG/USD).
- Document tolerable misstatement or tolerable deviation rate, expected error and assessed risk.
- Record how sample size was determined.
- Use and document a selection method that gives every unit a chance of selection.
- Treat items you cannot test as exceptions; replace only items where the procedure does not apply.
- Investigate the nature and cause of every exception and consider its effect on other areas.
- Project misstatements to the population for tests of details and compare with tolerable misstatement.
- Conclude on whether sampling provided a reasonable basis, and record any extended work.
Conclusion
ISA 530 is short, but it underpins much of the evidence in a typical audit file: define the population, size and select the sample with a clear rationale, treat untestable items as exceptions, investigate every error, and project before you conclude. Building these steps into standard working papers makes conclusions easier to defend before an audit committee, regulator or donor.
Bring structure to your sampling work. Auditors Track GRC helps audit teams across Africa digitise their work: risk assessments, audit reviews, findings and report writing, evidence attachments, dashboards by department and engagement type, and multi-user department assignments. Built-in libraries of controls, audits, working papers and risks give every engagement a consistent start. Book a free demo of Auditors Track GRC.