What Is ISA 530 Audit Sampling? Selecting and Testing Audit Samples

ISA 530 — Audit Sampling — governs one of the auditor's most-used techniques: testing a selection of items and concluding about the whole population. No audit tests every transaction; the economics of auditing depend on sampling done properly. ISA 530 ensures 'properly' by requiring the auditor to consider the purpose of the procedure and the characteristics of the population when designing the sample, to select items representatively, and to evaluate results — including projecting misstatements and investigating anomalies.

The standard rests on two risk concepts. Sampling risk is the chance the sample misleads — concluding the population is fine when it contains material misstatement (the dangerous direction) or doing unnecessary extra work. Non-sampling risk is everything else that can go wrong: choosing the wrong procedure, misreading evidence, human error. ISA 530 manages sampling risk through design; professional competence manages the rest.

A critical boundary: ISA 530 applies when sampling is used to draw conclusions about a population. Selecting a few items to understand a process (walkthroughs) or to follow up a specific risk is not sampling — no projection is involved. The distinction matters because projection discipline is what separates audit evidence from anecdote.

ISA 530 sampling follows a disciplined sequence.

Design. Define the objective (test of controls vs test of details), the population (complete and appropriate — the receivables ledger, not just the aged report), the sampling unit (invoice, balance, or monetary unit), and tolerable misstatement/deviation rate. Consider stratification: splitting receivables into high-value, medium and low strata lets the auditor test 100% of the top stratum and sample the rest efficiently.

Selection. Every sampling unit must have a chance of selection. Random selection (random number generators), systematic selection (every nth item from a random start), and monetary-unit sampling are statistical; haphazard selection is non-statistical but still must avoid bias — 'picking the easy ones' invalidates the sample. Block selection (e.g. all of March's transactions) is generally not representative and ISA 530 cautions against it.

Performance. Apply the planned procedures to each item. Document deviations. For untestable items, perform alternative procedures — and if those fail, treat the item as a deviation.

Evaluation. Project misstatements to the population using an appropriate method, aggregate with other uncorrected misstatements, and compare to tolerable misstatement. Investigate causes: isolated error or systematic failure? A systematic cause (e.g. a software posting bug) demands extended procedures beyond the sample. Document anomalies rigorously if excluding them from projection.

UAE audit practice leans on ISA 530 more heavily than many jurisdictions, for a structural reason: controls reliance is often impossible. Many SMEs run on accounting software with weak segregation of duties, override-prone approval workflows, and incomplete documentation. When controls cannot be relied upon, substantive sampling carries the entire audit — and sample design quality becomes the audit's quality.

Three UAE-specific patterns recur. First, related-party populations. Intercompany and shareholder balances are high-risk and often commingled with third-party transactions; auditors stratify them out and test at lower tolerable misstatement, effectively oversampling the riskiest stratum.

Second, confirmation response rates. UAE suppliers and customers respond to confirmation requests less reliably than in some markets, so ISA 530's alternative-procedure requirements get heavy use — subsequent cash receipts/payments, shipping documents, and contracts substitute for unreturned confirmations, with the evaluation treating persistent non-response as a risk signal.

Third, Corporate Tax populations. New tax-sensitive populations — entertainment expenses (50% disallowance), related-party charges, provisions — are now sampled with tax objectives in mind. A sample designed purely for financial-statement misstatement may miss the tax-characterisation errors the FTA cares about; UAE auditors increasingly dual-purpose their samples.

Noor Building Materials LLC has 2,400 supplier balances totalling AED 48 million. Performance materiality is AED 420,000; the auditor sets tolerable misstatement for payables at AED 300,000 and stratifies: 40 balances above AED 200,000 (totalling AED 28 million) are tested 100% via confirmations; the remaining 2,360 balances (AED 20 million) are sampled.

From the lower stratum, a systematic sample of 60 balances is selected. Testing finds two misstatements: AED 18,000 (unrecorded invoice) and AED 25,000 (duplicate payment). Projected to the stratum: (43,000 ÷ tested value) × 20,000,000 — assume the sample covered AED 2 million, giving projected misstatement of AED 430,000. Combined with the top stratum's clean result, the projected payables misstatement of AED 430,000 exceeds tolerable misstatement of AED 300,000.

The auditor cannot accept the population. Investigation reveals the cause: a goods-received-not-invoiced cut-off weakness at the Sharjah warehouse — systematic, not isolated. Response: extend cut-off testing, propose adjustment, and increase professional scepticism over completeness. The sample did its job — not by finding two errors, but by revealing the systematic weakness behind them.

Biased selection. Letting the client 'suggest' items, picking only clean-looking balances, or testing the same familiar suppliers yearly. If selection is not representative, projection is fiction.

Dropping untestable items. Excluding non-responses or missing documents from evaluation instead of applying alternative procedures or treating them as deviations. This is the most common ISA 530 breach in UAE files.

No projection. Reporting '2 errors found in 60 items' without projecting to the population. Findings without projection cannot support a conclusion about the balance.

Ignoring the cause. Treating each deviation as isolated without investigating whether a systematic issue (software bug, control failure, cut-off weakness) affects the whole population.

Wrong population. Sampling the aged receivables report (which may exclude credit balances or written-off accounts) instead of the complete ledger. The sample is only as good as the population it comes from — completeness of the source data is step zero.

Confusing statistical with representative. A haphazard 40 can be representative; a poorly drawn 'random' 40 from a corrupt population list is not — representativeness is about the method and the population, not the label.

Testing after the population moved. A year-end ledger sampled in January while the balance shifted in February — re-perform on the final population or bridge the movement.

Insufficient documentation of the method. 'Judgmental sample' without the judgment recorded — the file must show how items were chosen and why the method fits the objective.

Sampling risk is the chance the sample conclusion differs from full-population testing — the risk ISA 530 exists to manage. Tolerable misstatement is the maximum population error acceptable without further action. Monetary unit sampling selects monetary units (dirhams) as the sampling unit, automatically weighting toward larger balances. Stratification splits populations into homogeneous groups for efficient, risk-focused testing. Anomaly is a provably isolated misstatement excludable from projection — with heavy documentation. And non-sampling risk is the human-error side: wrong procedures, misread evidence, the risks no sample-size formula can fix.

Haphazard selection is the non-statistical method ISA 530 permits — genuinely pattern-free choice, not convenience sampling in disguise. Block selection picks adjacent items — efficient but rarely representative, and ISA 530 warns against relying on it alone. Tolerable deviation rate is the controls-testing analogue of tolerable misstatement. And the evaluation conclusion is the endgame: projected misstatement plus the sampling-risk allowance, compared against tolerable — the only conclusion the sample can support.