An auditor is testing credit authorization procedures by examining sales invoices for credit approval by the credit department. The procedures will be considered to be working adequately if 96% of all sales invoices either indicate approval or are cash sales. The auditor selects a random sample of 100 invoices. In this situation, which of the following outcomes illustrates underassessment?

• A. The auditor finds no deviations and concludes that procedures work adequately. The true population deviation rate is 5%.
• B. The auditor finds five deviations and concludes that procedures work adequately. The true population deviation rate is 2%.
• C. The auditor finds no deviations and concludes that the procedures work adequately. The true population deviation rate is 2%.
• D. The auditor finds five deviations and concludes that procedures work inadequately. The true population deviation rate is 6%.

Answer: (A)

The main concept here is sampling risk in evaluating control procedures. When you audit against a performance standard (96% of invoices must be approved or cash), you’re relying on a sample to judge the whole population. If the true deviation rate is higher than the 4% threshold, but your sample happens to show zero deviations, you may wrongly conclude that the procedures are working adequately. That mismatch between the population reality and the sample result is called underassessment.

In the scenario, the true population deviation rate is 5% (above the 4% limit), but the sample of 100 invoices shows no deviations. Concluding that the procedures work adequately based on that sample illustrates underassessment due to sampling variability — you’ve accepted a higher level of risk than allowed because the sample didn’t reveal the actual problem.

The other options don’t demonstrate this mismatch between reality and conclusion. For example, a true rate of 2% with no deviations aligns with adequacy, and a true rate of 6% with observed deviations would correctly indicate inadequacy.