CPA Audit Sampling Notes: Attributes vs Variables Sampling [Worked Examples]

These CPA audit sampling notes answer the core AUD question in one line: attributes sampling tests whether a control works, and variables sampling tests whether a dollar balance is right. Pick the method from the purpose, not the size, of the procedure. Attributes sampling gives a yes or no answer per item, judged against a tolerable rate of deviation. Variables sampling measures dollar amounts and is judged against a tolerable misstatement. Both methods follow under AU-C 530, with two worked examples, in the CPA notes hub.

The AICPA Blueprints effective 1 January 2026 place sampling in AUD Area III, Performing Further Procedures and Obtaining Evidence, at 30 to 40 percent. The other areas carry 15 to 25, 25 to 35, and 10 to 20 percent. AUD runs four hours: 78 multiple choice questions and 7 task based simulations, each worth 50 percent, and 75 passes on a 0 to 99 scale. All dollar figures in the worked examples are illustrations only.

CPA audit sampling: attributes vs variables in one picture

Exam snippet: CPA audit sampling splits into two methods. Attributes sampling tests controls with yes or no answers and is judged by a tolerable rate of deviation. Variables sampling tests dollar balances and is judged by a tolerable misstatement. Pick the method by the question the procedure asks.

A test of controls asks whether the control operated every time, so the auditor counts failures and reports a rate. A test of details asks whether the recorded amount is correct, so the auditor measures errors and projects a dollar amount. A tolerable rate means attributes sampling. A tolerable misstatement in dollars means variables sampling.

CPA audit sampling: what AU-C 530 actually requires

AU-C 530 governs sampling for nonissuer audits; AS 2315 is the issuer equivalent. AU-C 530 defines audit sampling as the application of audit procedures to less than 100 percent of items within a population of audit relevance such that all sampling units have a chance of selection, in order to provide the auditor with a reasonable basis on which to draw conclusions about the entire population. Sampling means less than 100 percent, and every unit must have a chance of selection, so block selection does not meet the definition.

Sampling risk is the risk that a sample conclusion differs from a whole-population conclusion. Nonsampling risk is every other error, such as choosing the wrong procedure or misreading evidence. For tests of controls, the risks are overreliance and underreliance. For substantive tests, the risks are incorrect acceptance and incorrect rejection. Only the effectiveness risks, overreliance and incorrect acceptance, can leave a material misstatement undetected, and the exam tests those far more often. Sampling does not apply to risk assessment procedures or analytical procedures, or when the auditor examines 100 percent of a population.

CPA audit sampling: attributes sampling for tests of controls

Attributes sampling is the standard method for a test of controls. The auditor defines the population, all items the control processed, and the attribute tested, for example whether a sales invoice carries an authorized approval signature. Then the auditor sets three planning inputs: the tolerable rate of deviation, the maximum failure rate accepted while still relying on the control; the expected population deviation rate, the best estimate of actual failures, usually from prior years; and the risk of overreliance, which sets confidence, commonly 95 percent.

The sample size comes from the AICPA Audit Guide sampling tables, not from a formula the exam expects you to memorize. The gap between the tolerable rate and the expected rate is the planned allowance for sampling risk, and a narrow gap needs a larger sample. Evaluation follows one formula: sample deviation rate plus allowance for sampling risk equals the upper deviation limit. If that limit is at or below the tolerable rate, the auditor may rely on the control; above it, the auditor may not rely and must extend substantive testing.

CPA audit sampling: worked example 1, attributes sampling of invoices

A client processes 5,000 sales invoices a year, and the control is that each invoice must carry an authorized approval signature before shipment. The auditor plans a test of controls with a tolerable rate of deviation of 5 percent, an expected population deviation rate of 1 percent, and 95 percent confidence. From Table A-1 of the AICPA Audit Guide, at 5 percent risk of overreliance, the sample size is 93 items. The auditor selects 93 invoices at random and finds 2 deviations, both missing approval signatures.

Step	Calculation	Result
Sample size from Table A-1	95% confidence, 5% tolerable, 1% expected	93 items
Expected deviations planned	1% of 93	0.93, about 1
Sample deviation rate	2 divided by 93	2.2%
Allowance for sampling risk	6.6% minus 2.2%	4.4%
Upper deviation limit	2.2% plus 4.4%	6.6%
Conclusion	6.6% exceeds tolerable 5%	Do not rely on the control

The sample deviation rate is 2 divided by 93, which is 2.2 percent. The upper deviation limit is about 6.6 percent, the one sided 95 percent upper confidence bound for 2 deviations in 93 items. The allowance for sampling risk is therefore 6.6 percent minus 2.2 percent, which is 4.4 percent. Because 6.6 percent exceeds the tolerable rate of 5 percent, the auditor may not rely on the approval control. Note how close the line is: with only 1 deviation, the sample rate would be 1.1 percent and the upper limit about 5.0 percent, right at the tolerable rate.

CPA audit sampling: variables sampling and monetary-unit sampling

Variables sampling is used for tests of details, where the auditor measures dollar amounts. Classical variables sampling estimates the total misstatement from the sample, by ratio projection or by mean per unit estimation. Monetary-unit sampling, also called probability-proportional-to-size sampling, is the variables method the exam tests most often. Every dollar is a sampling unit, so larger items are more likely to be selected, and the method is built to catch overstatement. Sample size equals book value times reliability factor, divided by tolerable misstatement minus expected misstatement times an expansion factor. The reliability factor with zero expected errors is about 3.00 at 95 percent confidence. The companion note on the audit risk model shows where this choice sits: a failed control test raises detection risk.

CPA audit sampling: worked example 2, projecting a misstatement

A client reports accounts receivable of $2,000,000, tolerable misstatement is $60,000, which is 3.0 percent of the recorded balance, and the sample size is 100 items. That size also follows from the monetary-unit sampling formula: $2,000,000 times 3.00 divided by $60,000 equals 100 items. The auditor tests the 100 items and finds a total overstatement of $1,000 in a sample with a recorded total of $50,000.

Step	Calculation	Result
Sample misstatement rate	$1,000 divided by $50,000	2.0%
Projected misstatement	2.0% of $2,000,000	$40,000
Tolerable misstatement	3.0% of $2,000,000	$60,000
Sampling interval	$2,000,000 divided by 100	$20,000
Conclusion	Projected $40,000 is below tolerable $60,000	No material misstatement shown yet

The sample misstatement rate is $1,000 divided by $50,000, which is 2.0 percent, so ratio projection gives 2.0 percent of $2,000,000, which is $40,000. The projected misstatement of $40,000 sits $20,000 below tolerable misstatement of $60,000, so the sample result alone does not show a material misstatement. But projected misstatement is not the conclusion: the auditor must add an allowance for sampling risk to reach the upper limit, and only if that limit is also below $60,000 can the balance be accepted.

CPA audit sampling: exam traps to avoid

First, choosing the method from the population instead of the purpose. A test of a control is attributes sampling even if the population is a dollar balance, and a test of a balance is variables sampling even if the population is a count of items. Second, comparing the sample deviation rate with the tolerable rate instead of the upper deviation limit. In worked example 1 the sample rate of 2.2 percent looks safe, but the upper limit of 6.6 percent fails. Third, treating the projected misstatement as the conclusion in variables sampling, when the upper limit is the number that decides. Fourth, using the expected deviation rate as if it were the tolerable rate. The expected rate is a planning estimate, and the tolerable rate is the acceptance line. Fifth, calling block selection a sample, when AU-C 530 requires every unit to have a chance of selection.

One-page revision box

Question	Attributes sampling	Variables sampling
Purpose	Test a control	Test a dollar balance
Answer per item	Yes or no	Dollar misstatement
Judged against	Tolerable rate of deviation	Tolerable misstatement
Planning inputs	Tolerable rate, expected rate	Book value, tolerable misstatement
Sample size source	AICPA Audit Guide Table A-1	MUS formula, factor 3.00 at 95%
Evaluation	Sample rate plus allowance	Projected plus allowance
Pass test	Upper limit at or below tolerable rate	Upper limit at or below tolerable misstatement
Worked example	93 invoices, 2 deviations, upper limit 6.6%, do not rely	$40,000 projected vs $60,000 tolerable

The upper limit, never the sample result alone, decides. Return to the CPA notes hub for the rest of the AUD series.

Sources

AICPA Blueprints 2026, AUD Area III 30 to 40 percent, via Becker at https://www.becker.com/blog/cpa/new-cpa-exam-exposure-draft and CPA Bear at https://book.cpabear.com/aud. AU-C 530 Audit Sampling, as quoted at https://linfordco.com/blog/audit-sampling/. AICPA Audit Guide Tables A-1 and A-3, sample size 93, at https://www.scribd.com/document/407003314/Statistical-Sampling-Table-Attribute-Sampling, confirmed at https://www.pyalm.com/blog/audit-sampling-methods-explained and https://www.coursehero.com/file/199908397/5125-Midterm-2-Review-2023/. Monetary-unit sampling formula, reliability factor 3.00 at 95 percent, from https://www.pyalm.com/blog/audit-sampling-methods-explained. Upper deviation limit 6.6 percent computed as the one sided 95 percent upper confidence bound for 2 deviations in 93 items. CPA notes hub: https://www.studyfromnotes.com/cpa-notes/.