Discussant's response to setting standards for statistical sampling in auditing;

              Discussant's Response to
Setting Standards for Statistical Sampling in Auditing
Lawrence L. Vance
University of California, Berkeley
John Broderick has raised interesting and important questions about the application of statistical sampling in auditing. The two areas of most concern that he has discussed and which I wish to comment upon are (1) the role and method of evaluation of internal control and (2) the matter of setting standards in general, with particular reference to the precision band in estimates.
Evaluation of Internal Control
Our use of internal control evaluations may be approached in at least two ways, which I refer to as the three-step and two-step methods. In the three-step method, which appears to be Mr. Broderick's preference, one first evaluates internal control on the basis of descriptive material—organization charts, pro­cedure
manuals, and conversations with members of the organization who are operating the system. On this basis, one forms a judgment about the apparent quality or effectiveness of the system. The second step in the three-step method is to test the operation of the system with documents and other records that disclose directly the working of the system. We are all aware that the system prescribed on paper and reported as functioning by members of the organization may in fact be distinctly different from the one that the people involved are actually using, and the effectiveness of the system may vary accordingly. The third step is to use the results of the first two steps in determining the "extent of the testing" (to use the traditional phrase) or to set confidence and precision limits for the sampling designed to appraise the bona fides of the accounts. If either the first or second step shows weaknesses in internal control, the confidence level is raised and the precision limits narrowed for the tests of bona fides; if both indicate effective control, these levels can be reduced. Note that this three­fold
concept, if applied under a policy of keeping each step distinct, requires separate samples for step two as against step three.
In the two-step approach to the evaluation and use of internal control in­formation,
step one is the same as in the three-step procedure. However, the second step proceeds directly to tests of bona fides, and the extent of these tests, or the statistical criteria they are required to meet, are determined by the subjective evaluation made in step one.
The question that arises when we have to choose between these two concepts is this: is it necessary to have an objective—not subjective—estimate of the functioning of internal control before we set standards for the test of bona fides?
In making a clear-cut distinction between the three-step and two-step
85