Audit sample size calculator
How many changes, permissions or incidents do you need to test, and what does the result tell you? The calculator answers both for tests of controls with random selection.
Free, no account. Your inputs stay in your browser and are not transmitted.
Reference values at a glance
Sample sizes from the same calculation, for common population sizes.
| Population | 95% confidence, 5% tolerable, 0% expected | 95% confidence, 10% tolerable, 0% expected | 90% confidence, 5% tolerable, 0% expected | 90% confidence, 10% tolerable, 0% expected | 95% confidence, 5% tolerable, 1% expected | 95% confidence, 10% tolerable, 2% expected |
|---|---|---|---|---|---|---|
| 100 | 45 | 25 | 37 | 20 | 65 | 39 |
| 250 | 51 | 27 | 40 | 21 | 78 | 43 |
| 500 | 56 | 28 | 43 | 22 | 87 | 44 |
| 1,000 | 57 | 29 | 44 | 22 | 90 | 45 |
| 5,000 | 59 | 29 | 45 | 22 | 93 | 46 |
| 10,000 | 59 | 29 | 45 | 22 | 93 | 46 |
| 100,000 | 59 | 29 | 45 | 22 | 93 | 46 |
How to choose the values
Population
First check that the list is complete. A sample from an incomplete list says nothing about the missing items. Separate items that are subject to different controls.
Confidence
The more important the control and the less other evidence you have, the higher the value. Follow the requirements of your audit manual.
Tolerable rate
Set it before testing and document why. Choose a low value for an important control.
Expected rate
Base the estimate on earlier audits or a small pilot test. The closer it is to the tolerable rate, the larger the sample.
What the number says and what it does not
- The calculation only applies to random selection, where every item has the same chance. A judgmental selection cannot be projected this way.
- The conclusion is an upper limit on the deviation rate. It says nothing about the severity of a single deviation; even one case can be a finding of its own.
- The calculation does not cover items judged incorrectly or unsuitable audit procedures.
- The calculator does not replace your professional judgment or any requirement of your organisation or supervisor. All information without warranty.
The calculation
The calculator draws without replacement and therefore uses the exact hypergeometric distribution. It looks for the smallest sample at which a population with exactly the tolerable number of deviations would stay undetected with at most the chosen remaining probability. The permitted findings follow from the expected rate, rounded up.
For small populations this gives smaller samples than tables that assume an infinite population. For very large populations the values converge: 5% tolerable, 95% confidence and no expected deviation result in 59 items there.
The evaluation uses the same distribution and states the highest number of deviations that the result does not yet rule out.
Difference from the application: ProAuditMap suggests a fixed number per control frequency there, for example 25 items for daily controls. That is a practical default without a statistical conclusion and can be lower than the value here. If you need the statistical conclusion, enter the calculated size there freely.
Terms and basis
From the sample to a complete audit package
ProAuditMap creates the audit program, test steps, document request list and report template for your audit. You manage populations and samples directly in the working paper.
View sample package Request a test View sample audit programs