Audit Sample Size Calculator

Sample size follows from the conclusion you need to reach

Attribute sampling in a controls audit is not about estimating a rate; it is about being able to say, at a stated confidence, that the true deviation rate is below a threshold you can live with. That threshold is the tolerable deviation rate. The sample size is whatever number makes the upper confidence bound fall below it, given the number of deviations you expect to find. Choosing a round number like 25 because it appears in a table is doing the arithmetic backwards.

Expected deviations drive the size more than confidence does

Moving from 90 to 95 percent confidence increases the sample modestly. Expecting even one deviation instead of zero increases it sharply, because a single failure has to be outweighed by many more successes before the upper bound comes back down. This is why a control believed to be clean can be tested with a small sample while one with a known occasional failure needs a much larger one, and why discovering an unexpected deviation mid-test usually invalidates the planned size.

The upper deviation limit is the actual output

The number that belongs in the working papers is not the sample size but the upper deviation limit achieved: given the sample tested and the deviations found, the highest true rate consistent with the evidence at your confidence level. This tool computes it from the exact binomial distribution rather than the Poisson approximation used by the printed AICPA tables, so it stays correct for small populations and high deviation rates where the approximation drifts.

Related tools

• SOC 2 Evidence Readiness — Interactive checklist to gauge your SOC 2 evidence readiness.
• Privacy Policy Checker — Check if your policy covers standard requirements (GDPR/CCPA basics).
• Compliance Req Finder — Find which standards (ISO, SOC2, HIPAA) apply to your industry/region.
• Audit Readiness Planner — Plan your compliance audit timeline (SOC2, ISO) backwards from deadline.