An auditor who uses statistical sampling for attributes in testing internal controls should alter the assessed risk of material misstatement when the
Sample rate of deviation plus the allowance for sampling risk exceeds the tolerable population deviation rate.
The auditor may calculate sample size from standard tables based on the tolerable population deviation rate, the likely rate of deviations, and the risk of overreliance. Given the sample size and the sample deviation rate, another table is used to determine an upper deviation rate at the specified level of risk. The difference between the upper deviation rate and the sample rate is the allowance for sampling risk. When the upper deviation rate (sample rate + allowance for sampling risk) exceeds the tolerable population deviation rate, the sample result does not support the assessed risk of material misstatement.