Attribute sampling is a statistical method used by internal auditors to test whether internal controls are working effectively. It focuses on the presence or absence of a specific attribute (or characteristic) in a population—such as whether a document was properly authorized or whether a transaction includes required supporting documentation.

The sampling road map includes:

• Set the Sampling Objective – Define what control you are testing (e.g., are purchase orders properly approved?).

• Define the Attribute and Occurrence Rate – Identify what qualifies as a “pass” or “fail” (e.g., a purchase order with manager approval is a pass).

• Identify the Population – This is the total group of items eligible for testing, such as all purchase orders over the fiscal year.

• Select Sampling Method – Use methods like random, systematic, or stratified sampling.

• Calculate Sample Size – Based on desired confidence level, tolerable deviation rate, and expected deviation rate.

• Select Sample & Test – Apply the test to each item and record results.

• Evaluate Results – Compare actual deviation rate to the tolerable rate to decide whether the control can be relied upon.

Example: An internal auditor wants to test the control requiring managerial approval for expense reimbursements over $1,000. The population consists of 2,000 such reimbursements from the past year. Using attribute sampling, the auditor randomly selects 80 items. If 3 are missing approvals, and the tolerable deviation rate is 4%, the observed 3.75% (3/80) would be acceptable, and the control can be considered effective.

Attribute sampling allows internal auditors to form a reliable conclusion about a control’s operation without examining every item, supporting efficient, evidence-based assurance