April 5, 2022

Strategic Audit Sampling

As a best practice, sampling should be a CPA’s last line of defense! Here’s why.

Do we always need to sample? That’s a question many CPAs ask themselves when getting ready to conduct audit engagement.

An important aspect of planning an audit is deciding the extent of which audit procedures to perform. Decisions about the extent of testing may be dependent on the number of client locations or components to be tested and/or the cutoff amount for individually significant items (ISI) and sample sizes.

Authoritative guidance applies when audit engagement teams decide to use audit sampling in performing audit procedures which can be found in Professional Standards of the American Institute of Certified Public Accountants (AICPA) - AU-C 530B, Audit Sampling. AU-C 530B addresses the engagement team’s use of statistical and nonstatistical sampling when: (a) designing and selecting the audit sample, (b) performing tests of details and tests of controls and (c) evaluating the sampling results.

Guidance requires that when audit engagement teams design tests of controls and/or tests of details, they should determine an approach to selecting items for testing that is effective in meeting the purpose of the audit procedure. Approaches to selecting items for audit testing are as follows: (a) selecting all items in the population (100% testing), (b) target items and (c) audit sampling. Engagement teams may apply any one or a combination of these approaches to selection depending on the facts and circumstances.

Audit sampling enables conclusions to be drawn about an entire population based on tests of a sample taken from that population. The ability to draw valid conclusions based on a sample depends on determining an appropriate sample size, having an appropriate sampling approach and method of selection, and appropriately following up on exceptions.

So, the answer to our opening question regarding whether auditors need to always sample, the answer is (drumroll, please); no! The biggest mistake we make as auditors is to automatically select a sample and perform detailed testing. We have to think about more efficient ways of gaining assurance over an account balance (or a class of transaction) and still ensure the risk is eliminated or appropriately mitigated to an acceptable level. As a best practice, sampling should be used as our last resort. However, in some situations, there may be no alternative but to sample. So, for example, where a population (or part of a population) is material to the audit, consisting of only low value similar items (or transactions), and where the nature of the account is such that analytical review procedures cannot be used, then audit sampling may be our only option in the absence of any suitable controls that could be tested.

Here are some upfront questions we should be asking ourselves:

Are there any controls at the client we can rely on?
What procedures are we performing on the account?
What is the level of assurance we will obtain from these procedures?
What is the remaining balance amount of the account?
Is the remaining balance a significant risk?

So, before sampling, it’s advisable to conduct target testing on high-risk transactions first. If you separate and test account balances identified as high risk (e.g., accounts that belong to customers the client has had difficulties with in the past or have unusually high dollar amounts), you may be able to reduce the sample size, or forgo audit sampling altogether. When you complete this type of target testing, you’re taking the inherent risk—the susceptibility of an account balance or class of transactions to material misstatement— from a high risk and bringing it down to a moderate risk.

Often, auditors forgo target testing and leave the inherent risk high, which in turn, causes your sample size to be higher. By target testing high-risk transactions first, you’ll achieve a greater efficiency in coverage.

Remember, you don’t always need to sample. Assess what additional procedures you can perform first before sampling. Your audit approach needs to be tailored based on the nature of the balance you’re testing and the related risks. If the remaining balance is immaterial and you have not raised a significant risk, then no further audit work is needed. It is important to reassess inherent risk over the remaining population in order to obtain sufficient appropriate audit evidence in the most efficient manner.

Collemi Consulting has significant expertise in the nuances of deciding whether engagement teams should perform audit sampling and if so, how to properly determine an adequate sample size. We recommend CPA firms and auditors to contact us before or during audit planning so we can assist with the sampling process to maximize efficiency and help ensure that you’ll able to issue an appropriate opinion under Professional Standards.

Learn More

< Older Post

Newer Post >

Looking up at a group of tall buildings with a blue sky in the background.

The Siren Song of Private Equity Acquisitions

By Jennifer Ruf • April 30, 2025

The wave of mergers and acquisitions in the accounting industry over the past five years or so shows no sign of abating as small and mid-size public accounting firms seek to gain the size that lets them invest in new technology and recruitment, and gain other advantages of economies of scale. While there are lots of arguments to be made in favor of joining forces with other CPA firms, it’s still a fraught process with many potential hurdles. And it’s not just other public accounting firms doing the merging and acquiring. The private equity firms that have been rolling up small and mid-size CPA firms into larger ones come with plenty of benefits, notably the ability to make the investments needed to compete at a time when automation and artificial intelligence (AI) are bringing a sea change into the accounting business, and competitors are getting bigger. But they also come with their own baggage, such as questions of conflicts of interest and compliance with the auditor independence rules, as well as a focus on the more profitable tax and advisory service side of the firms. The money from an acquisition can be enticing, but it’s important to go into it knowing that there’s a price to be paid for it, and what that price is. And how to go about paying it if you do decide to join forces with a private equity firm. Private equity pros Private equity firms have been competing to invest in large public accounting firms, but also to buy out and roll up small and mid-size firms for two core reasons. One is a steady and predictable revenue stream, particularly on the audit side, which is very enticing to them. The other is the revenue potential of expanding the more lucrative tax and consulting side of the business. But they also see the opportunity to grow the CPA firms and make them more profitable by investing in things like staff training, recruitment and cutting edge technology like AI that can transform the accuracy and efficiency of audit processes. And, of course, strategic acquisitions that can further strengthen the business. Another thing they can do is centralize certain auditing tasks like data processing or routine testing, even moving it offshore for cost efficiency. This can give the core auditing team more time for the deep dive and the ability to focus on more value-added services. Private equity cons On the con side, the focus on consulting can lead to the auditing quality side being given less priority for investment and growth. With a focus on short-term profit, private equity funding can come with pressure to focus attention on the higher margin consulting side of the business. Private equity firms are often eager to scale up the tax and consulting sides of the business, to the point of sometimes creating an alternative practice structure (APS) by investing in or acquiring just those parts of a firm and leaving the audit side, with its need for independence and smaller margins, alone. Which calls into question the benefits of a private equity investment, at least on the auditing side of the business. Then there’s the threat to auditor independence of having an owner or partner with a large portfolio of companies like tech firms that can provide other services to audit clients. And even when there is no actual threat, these perceived conflicts of interest can be a red flag to audit regulators and standard-setters. Private equity questions When you’re looking at an investment or acquisition by private equity there are questions to be asked that aren’t always obvious, or at least that don’t have simple answers. It’s easy enough to start a conversation about auditor independence and the appearance of impairment or conflicts of interest with the auditing side of the business, but it’s also easy enough to promise that these issues won’t be a problem. You have to be aware of the other types of services that they're planning to provide to that same client, because that could have an impact on whether or not you can perform the audit or the review work that you’re doing without violating the AICPA’s Code of Professional Conduct. That’s particularly true with small CPA firms focused on the auditing side of the business instead of consulting, which will suddenly find themselves paired with a large and aggressive tax and consulting business. But whatever size your practice is, you’ll have to update policies and procedures and be cognizant of the need to create an infrastructure that acknowledges the potential conflicts that come with a private equity firm’s offer. Collemi Consulting leverages nearly three decades of experience to provide trusted technical accounting and auditing expertise when you need it the most. We regularly work with CPA firm leadership to help them reduce risk and maximize efficiencies.

Testing of Non-Standard Journal Entries to Identify Questionable Transactions

By Jennifer Ruf • March 24, 2025

As audit season is in high gear, it’s important for auditors to step back and plan how they are going to audit a client’s books and records. What are the red flags you’re looking for when it comes time to throw open the books and look through a huge swath of journal entries to pluck out the ones that are questionable, and need to be questioned? First off, it’s important to understand how journal entries are created at the company being audited. For an auditor, that means looking at the internal control environment to understand how a journal entry is created: Who’s authorized to create one and who can create one. You have to understand the process. How does it start and how is the entry eventually recorded onto the financial reporting system? Once you know that, you can determine whether someone can come in and override the system, or if someone can pretend to be someone else and start recording journal entries onto the system. That will help you figure out what to look for to decide what entries to pull out and ask management to get back up information to support and validate those entries. Finding the needle The key here is not to just go through the mechanics, but to really go through the exercise so you can determine if management is playing games in the recording of those transactions. You have to be able to get comfortable with that, and that means you need to be able to document what you’re looking for. Because what the auditor is really doing is looking for a “needle in the haystack”, to identify the transactions that don’t look right, that don’t make sense in the ordinary course of business. For example, if the business is not open on weekends, are transactions being posted on a Saturday or Sunday, or even on holidays? If you see rounded numbers or accounts that are seldom used, those can be red flags as well. Sometimes it can be as simple as asking managers and others like accounting, data entry and IT personnel if they’ve observed any unusual accounting entries. Depending on the size of the company and scope of the work, you might need to use computerized audit software program — some of them with AI built in — that can scan the entries to identify anomalies. Red flags When an auditor is looking for evidence of management override of controls, they can look for some of these 12 red flags indicators: ● Top-side entries ● Entries made to unrelated, unusual or seldom-used accounts ● Entries made by individuals who typically don't make entries. ● Entries recorded at the end of the period ● Post-closing entries with no explanations ● Entries made before or during the preparation of financial statements with no account numbers ● Entries that contain rounded numbers or a consistent ending number ● Entries processed outside the normal course of business ● Accounts that contain transactions that are complex or unusual in nature ● Accounts that contain significant estimates and period-end adjustments ● Accounts that have been prone to errors in the past ● Accounts that contain intercompany transactions When testing non-standard journal entries and other adjustments, you should look for documentary evidence indicating that they were properly supported and approved by management. Finally, remember that while most fraudulent entries are made at the end of a reporting period, you shouldn't ignore the rest of the year Collemi Consulting leverages nearly three decades of experience to provide trusted technical accounting and auditing expertise when you need it the most. We regularly work with CPA firm leadership to help them reduce risk and maximize efficiencies. To schedule an appointment, contact us at (732) 792-6101.