Short answer
For testing whether a control operated effectively, auditors usually size samples by how often the control runs: one for an annual control, two for quarterly, two to five for monthly, five to fifteen for weekly, and twenty to sixty for daily or more frequent controls. Larger samples give more assurance. Agree the approach with your audit firm, because practice varies.
Key takeaways
- Control frequency drives sample size for tests of operating effectiveness.
- Automated controls can often be tested once, with evidence the logic did not change.
- Select samples so every item in the population had a chance to be picked.
- One exception can mean extending the sample or concluding the control failed.
Commonly used sample sizes
The table reflects sizes widely used in practice for tests of controls, where you expect no exceptions. Your audit firm's methodology decides the final numbers.
| Control frequency | Typical population in a year | Common sample size |
|---|---|---|
| Annual | 1 | 1 |
| Quarterly | 4 | 2 |
| Monthly | 12 | 2 to 5 |
| Weekly | 52 | 5 to 15 |
| Daily | About 250 | 20 to 40 |
| Many times a day | Hundreds or more | 25 to 60 |
Automated controls
A control performed by a system, such as a password policy enforced by configuration, behaves the same way every time. Auditors often test it once and then rely on change management evidence that the configuration did not change during the period.
Choosing the sample
- Define the population first: every occurrence of the control in the period.
- Confirm the population is complete, for example by reconciling to a system report.
- Select randomly or systematically so every item could be chosen.
- Avoid letting the audited team pick the sample.
When you find an exception
One exception in a sample sized for zero exceptions does not automatically mean failure, but it needs a response. Find out why it happened. If it was a one-off with a clear cause, the auditor may extend the sample to show it was isolated. If the cause could affect other occurrences, the control is not operating effectively and the finding should say so.
Checklist
Sampling working paper
0 of 6 done
Frequently asked questions
How many samples should be tested for a monthly control?
Commonly two to five occurrences out of twelve for a test of operating effectiveness, depending on the audit firm's methodology and the risk of the control.
Sources
- AS 2315: Audit Sampling, PCAOB