This template documents sample size calculation using classical sampling method for OSP (Overall Sampling Procedure) in accordance with International Auditing Standards.
Client & Engagement Information
Population Parameters
Starting serial number of the population
Ending serial number of the population
Calculated as: (Last Voucher - First Voucher) + 1
$
Materiality & Exclusions
$
Tolerable misstatement for this audit area
$
High-value items tested 100% (excluded from sampling)
$
Items excluded for specific reasons (e.g., negative balances)
Account Balance - (Key Items + Other Exclusions)
Assurance Considerations & Factors
Consideration
Assessment
Impact Factor
IRAM Level
i
Inherent Risk Assessment at the Assertion Level
Higher inherent risk requires more audit evidence. Significant risk = 3.0, Moderate = 2.0, Low = 1.0
ISA 240 Consideration: Revenue recognition is a common area for fraud risk and manipulation.
Medium
Based on professional judgment considering client, users, and regulatory environment
ISA 200: Overall Audit Risk Considerations
Audit Risk is the risk that the auditor expresses an inappropriate audit opinion when the financial statements are materially misstated. Consider these professional judgment factors:
Lower Risk Tolerance
Consider when:
Public company with regulatory scrutiny
Complex transactions and estimates
History of material misstatements
Going concern issues identified
Medium Risk Tolerance
Consider when:
Standard private company audit
Moderate business complexity
Average control environment
No significant prior audit issues
Higher Risk Tolerance
Consider when:
Limited scope engagement
Strong historical audit evidence
Excellent control environment
Well-established entity with consistent results
Professional Judgment Required
Always apply:
Professional skepticism
Consideration of financial statement users
Regulatory requirements
Materiality considerations
ISA 315 Inherent Risk Assessment
Assess susceptibility to material misstatement before considering controls
ISA 315 Inherent Risk Factors
Inherent risk is the susceptibility of an assertion to material misstatement before considering controls. Assess based on:
Estimation uncertainty: Accounting estimates with high measurement uncertainty
Susceptibility to fraud: Assets vulnerable to misappropriation
Judgment involved: Areas requiring significant management judgment
Recent changes: New accounting requirements or business changes
Professional Judgment Required: Inherent risk assessment requires consideration of both likelihood and potential magnitude of misstatement, not mathematical calculation.
Likelihood of Misstatement
Moderate
L
Low
L-M
Low-Mod
M
Moderate
H
High
How likely is a misstatement to occur?
Magnitude Potential
Moderate
L
Low
L-M
Low-Mod
M
Moderate
H
High
How material could a misstatement be?
Assessed Inherent Risk (IR)
MODERATE
Moderate Inherent Risk
Based on professional judgment combining likelihood and magnitude assessments
ISA 315 Control Risk Assessment
Evaluate control design and implementation for selected account
ISA 315 Control Risk Assessment
Control risk is the risk that a material misstatement will not be prevented or detected by the entity's internal controls.
Key Principles:
Evaluate both design and implementation of controls
Ineffective key controls relevant to significant assertions elevate overall control risk
Consider both entity-level and transaction-level controls
Assess whether controls operate consistently throughout the period
ISA 315 Requirement: When the auditor intends to rely on controls, tests of controls must be performed.
Bank Reconciliation
Key Control
ExistenceCompleteness
Monthly reconciliation by independent person with review
Effective
Partially Effective
Ineffective
Payment Authorization
Key Control
AccuracyAuthorization
Dual authorization for large payments with documented approval
Effective
Partially Effective
Ineffective
Cash Handling Procedures
ExistenceSecurity
Segregation of duties for cash handling and physical security
Effective
Partially Effective
Ineffective
Assessed Control Risk (CR)
MODERATE
Moderate Control Risk
Based on evaluation of control design and implementation
ISA Risk Assessment Results
Audit Risk Tolerance
MEDIUM
Professional Judgment
Inherent Risk (IR)
MODERATE
ISA 315 Assessment
Control Risk (CR)
MODERATE
ISA 315 Assessment
Risk of Material Misstatement (RMM)
MODERATE
Combined IR & CR
ISA Risk Assessment Explanation
Step 1: Inherent Risk Assessment (ISA 315)
IR assessed qualitatively based on susceptibility to misstatement considering:
Complexity of transactions
Estimation uncertainty
Susceptibility to fraud
Degree of judgment involved
Current assessment: MODERATE based on moderate likelihood and magnitude
Step 2: Control Risk Assessment (ISA 315)
CR assessed based on evaluation of control design and implementation effectiveness:
Effectiveness of key controls for significant assertions
Consistency of control operation
Weakest link principle for key controls
Current assessment: MODERATE based on control evaluation
Step 3: Risk of Material Misstatement (ISA 200)
RMM is a conceptual combination of inherent risk and control risk:
Inherent Risk
+
Control Risk
=
RMM
Current assessment: MODERATE RMM (Moderate IR + Moderate CR)
Step 4: Detection Risk Determination (ISA 200)
Detection Risk is determined by the inverse relationship with RMM:
Higher RMM → Lower acceptable Detection Risk
Lower RMM → Higher acceptable Detection Risk
Based on MODERATE RMM: MODERATE DETECTION RISK is acceptable
ISA 330 Audit Response & Strategy
Recommended Audit Approach (ISA 330)
Based on MODERATE RMM and MODERATE acceptable detection risk, implement a BALANCED AUDIT APPROACH combining control testing and substantive procedures.
Nature of Procedures (ISA 330.6)
Combine tests of controls with substantive procedures. Test operating effectiveness of key controls while performing substantive analytical procedures and tests of details for higher risk assertions.
Timing of Procedures (ISA 330.20)
Consider interim testing of controls with update procedures at period-end. Perform substantive procedures closer to period-end, particularly for higher risk areas.
Extent of Procedures (ISA 330.7)
Apply moderate sample sizes with emphasis on higher risk transactions. Increase extent of testing for areas with identified control deficiencies or higher inherent risk.
Control Reliance Decision
Moderate reliance on controls after testing operating effectiveness. Supplement with substantive procedures for significant assertions.
Key Audit Procedures to Consider
Test operating effectiveness of identified key controls
Perform substantive analytical procedures on material accounts
Execute tests of details for higher risk transactions