Considerations for firms when calculating a sample size in ISAE Attestation

Published: 11/09/2023

What do I, as a firm, need to consider when calculating a sample size in ISAE Attestation?

Answer:

The calculation of sample sizes must be done in accordance with your firm’s methodology in a way that is consistently applied to all similar assurance engagements. The firm may also have a methodology which prescribes a minimum or maximum sample size, where the result of a sample calculation is too small to give sufficient evidence, or too large and results in inefficiencies. These limits are set by the firm itself if they are used.

Examples of how sample sizes are commonly calculated are:

The use of a formula that considers materiality, the risk assessment applicable to an area and the value of the population being sampled. To use this formula to calculate a sample size, you will need to have established at least the following:
1. Materiality level for the item you are testing.
2. A risk factor, which is determined based on the risk assessment (for example, a high risk may have a factor of more than 1, for example 1.5, a low risk factor may be less than 1, for example 0.75. The factors associated with the risk levels is determined at the firm level in the firm’s sampling methodology).
3. The total of the population you are sampling. If, in a specific procedure, you are selecting specific items based on non-statistical sampling methods, then this amount will be the remaining population that has not already been subject to other selection methods.
4. An example of the formula that can be applied is:
  1. Risk factor × remaining balance ÷ materiality
The use of predetermined sample sizes for predetermined risk levels. These predetermined amounts also are determined on a firm level as part of the firm’s sampling methodology. An example of how this is used, in principle, is included in the following table. This is purely an example illustrating the relationship between the assessed level of risk and possible sample sizes associated with the level of risk and the desired level of risk – do not make use of the data in this table, and ensure that if your firm uses this approach, that your firm’s methodology is applied to your sample size determination.