SOX requires auditors to test the design and operating effectiveness of controls. I have discussed how controls can be designed here and testing the operating effectiveness of controls here. The first question which an auditor is faced at the time of testing the operating effectiveness of controls is the right sample size to be selected. There are many factors which influence the sample size to be selected for controls testing. Such factors may include other controls being tested, expected error rate, comfort from previous test results etc. Depending upon the frequency of performance of a control, one can decide the sample size to be tested. I have jotted the best practice for selecting sample size which many companies follow below -

For manual Controls:

Frequency of Performance - Minimum Sample Size

Annually - 1
Quarterly - 2
Monthly - 2
Weekly - 5
Daily - 25
Many times a day - 25

For Automated Controls:

Auditors should test atleat one application of each of the control activities which are automated. For IT General controls, auditors can follow the guidance given for manual controls depending upon the frequency.

Related Posts

Sarbanes Oxley Controls Testing Methodology
Section 404 Project Scoping
Accountability Risk Factors
Content of Internal Control Report