Sample Attribute

Hi Laetitia,

I will try and help you out, but just to let you know, I am not a stats expert but I have used this function as part working in Internal Audit and Internal Controls.  If you want the real details you are best consulting with a stats expert.  Ok, with that out of the way here goes.

For attribute sampling there are four items that you need to caculate your sample.  The first is the population, as attribute sampling is used to test a condition, such as did the manager approve the invoice for payment, yes or no, was the control in place, yes or no.  So attribute sampling tests items that have a yes/no or true/false outcome.  If you are testing dollar amounts you are better off using Monetary or Dollar Unit Sampling.  This is why attribute is used in internal audit and internal controls as you are usually testing something that is in place or not.  So your population size is the number of items, if you are validating that the manager approved all invoices the population would be the number of invoices that the manager should have approved. 

The expected deviation rate is the error rate you expect in your population.  You can get this from past experience or if this is the first time performing this test you might want to perform a smaller sample, such as 30 items and see what the deviation rate is.

The tolerable devation rate is the number of errors you are willing to accept in the population before you consider that you have a population.  Now I have usually used 5%, I have seen others use 10%, it all comes down to managements tolerance for deviations.  When deciding on this you have to remember that just because there is a deviation does not necessarily mean that there was an error.  If the manager did not approve the invoice it does not mean that the invoice is in error or that the invoice should not be paid, it means the managers did not approve it.

Finally you have the confidence level.  The higher the level the more items you will need to tests.  So if you pick a 95% confidence this means that 19 times out of 20 you will come to the correct conclusion, at 90% it is 9 times out of 10.  For internal control testing I have seen 70% used when the auditors are doing other types of work, such as some type of analytical review to raise the total confidence.

So the higher the confidence level the more test you have to do, the closer the difference is between the expected and tolerable devation rate the more tests you have to do.  Sometimes you have to play with the numbers because the resources might not be availble to do the amount of work you would like.

I have only used the Beta Risk Control in my career so I won't comment on the Beta and Alpha Control risk.

Hope this helps out a bit.

Brian