Auditing Internal Controls in Small Populations

Julian E. Jacoby, MBA, CPA, and Neal B. Hitzig, PhD, CPA

An infrequently performed control—such as one that is performed quarterly, monthly, semimonthly, or weekly—is often essential to the objective of preparing financial statements that are free of material misstatement. Such a control is typically detective in nature; that is, it is intended to detect misstatements in transactions that have been processed and recognized in the period since the previous performance of that control. When auditors test a control that is performed infrequently, they will often do so by selecting and examining a sample. To plan properly such a test of an infrequently performed control still requires a consideration of risk and tolerable deviation rate in order to determine an appropriate sample size. If, for example, a control is performed four times a year, it may appear to an auditor that a sample size of two (or, perhaps, even one) will be sufficient to establish reliance on the control. Existing guidance is, unfortunately, deficient and inconsistent. This article provides the correct methodology to be utilized.