Audit Sampling for CISA: Attribute, Variable, Discovery and Stratified
Sampling questions are reliable points on the CISA exam once you match each method to its purpose.
Statistical vs non-statistical
- Statistical sampling uses random selection and probability, so you can quantify sampling risk and project results to the population.
- Non-statistical (judgmental) sampling relies on auditor judgment. It can find issues but cannot produce statistically projected conclusions.
The four methods to know
| Method | Use it to | Typical test |
|---|---|---|
| Attribute sampling | Estimate how often something occurs | Compliance tests, such as missing approvals |
| Variable sampling | Estimate a monetary amount or quantity | Substantive tests of balances |
| Discovery sampling | Find at least one occurrence when the expected rate is very low | Searching for fraud |
| Stratified sampling | Split a varied population into groups and sample each | When a few large items dominate |
Two related ideas also appear:
- Stop-or-go sampling allows testing to stop early when few or no errors are found.
- Testing the whole population with data analytics removes sampling risk for that test.
Sample size rules
Required sample size increases when:
- the tolerable error rate decreases;
- the confidence level increases;
- the expected error rate increases.
Population size matters far less than people expect once populations are large.
What the auditor must control
- Select the sample yourself from a complete population. Never let the auditee choose.
- Confirm the population is complete and accurate before sampling — especially system-generated reports.
- Sample from actual changes, not approved tickets, when testing for unauthorized changes.
- Evaluate every exception. Do not replace an exception with another item to get a clean result.
When results exceed tolerance
If the deviation rate in a statistical sample exceeds the tolerable rate, the control cannot be relied on as designed. Assess the impact and increase substantive testing.
Related on Auditor Path
Sources
ISACA CISA exam content outline, Domain 1 Part B — Audit Testing and Sampling Methodology; ITAF evidence standard.