Materiality and Sampling in a Malaysian Statutory Audit, Explained

An auditor who signs a set of accounts has almost never looked at every transaction behind them — and the standards say that is exactly the right way to work.

Reasonable assurance is not certainty. Testing every invoice, receipt and journal in a company of any size would be slow, expensive and still would not guarantee a perfect answer. So auditors do two disciplined things instead: they decide how large an error would have to be before it matters, and they test a representative slice of the numbers. Two ideas govern the whole exercise — materiality and sampling.

How does an auditor decide what counts as “material”?

Materiality is not a fixed ringgit figure. Misstatements are material if they, individually or in aggregate, “could reasonably be expected to influence the economic decisions of users taken on the basis of the financial statements” (ISA 320, para 2). It is a matter of professional judgment, made assuming users have reasonable business knowledge and read the statements with diligence (ISA 320, para 4).

In practice, auditors start by applying a percentage to a benchmark. ISA 320 notes that profit before tax from continuing operations is often used for profit-oriented entities; as an illustration, an auditor “may consider five percent of profit before tax” appropriate for a profit-oriented manufacturer, or “one percent of total revenue or total expenses” for a not-for-profit entity (ISA 320, para A7). These are examples, not rules — the benchmark and percentage flex with the entity’s circumstances.

Why is performance materiality set even lower?

If the auditor only hunted for individually material errors, lots of small errors could quietly add up past the line, with no cushion for the errors testing never finds. To prevent that, ISA 320 defines performance materiality as an amount set “at less than materiality for the financial statements as a whole,” chosen to reduce “to an appropriately low level” the probability that the aggregate of uncorrected and undetected misstatements exceeds materiality (ISA 320, para 9). The standard then requires the auditor to determine that amount when planning the audit (ISA 320, para 11), and to document both figures and the reasoning behind them (ISA 320, para 14).

How does materiality drive the sample size?

This is the bridge to sampling. When designing a test, the auditor sets a tolerable misstatement — the largest error they are willing to accept in that population. Critically, tolerable misstatement “is the application of performance materiality… to a particular sampling procedure” (ISA 530, para A3). So the materiality judgment made at the top of the audit flows straight down into how many items get tested.

Sampling exists to manage sampling risk: the risk that a conclusion drawn from the sample differs from the conclusion the auditor would reach if the whole population were tested (ISA 530, para 5(c)). The auditor must “determine a sample size sufficient to reduce sampling risk to an acceptably low level” (ISA 530, para 7) — and the lower the risk accepted, the larger the sample must be (ISA 530, para A10). Several factors push sample size up or down:

Factor changes	Effect on sample size	Standard
Higher assessed risk of material misstatement	Larger	ISA 530, App 3
More reliance on other substantive procedures	Smaller	ISA 530, App 3
Lower tolerable misstatement	Larger	ISA 530, App 3
Higher expected misstatement in the population	Larger	ISA 530, App 3
Appropriate stratification of the population	Smaller	ISA 530, App 3
Size of the population (large populations)	Negligible	ISA 530, App 3

Items can be picked by random, systematic, monetary-unit, or haphazard selection; block selection is rarely appropriate (ISA 530, Appendix 4). The unit tested might be an invoice, a debtor balance, or a single monetary unit (ISA 530, para A2).

What happens to the errors the sample turns up?

For tests of details, the auditor projects the errors found in the sample to the whole population (ISA 530, para 14). If that projected misstatement plus any anomaly exceeds tolerable misstatement, “the sample does not provide a reasonable basis for conclusions about the population” (ISA 530, para A22) — the auditor then extends testing or asks management to investigate.

Every identified misstatement, “other than those that are clearly trivial,” is accumulated (ISA 450, para 5). Clearly trivial is not a synonym for “not material” — such items are of a wholly smaller order of magnitude, and where there is any doubt, the item is treated as not clearly trivial (ISA 450, para A2). Before forming the opinion, the auditor reassesses materiality against actual results (ISA 450, para 10) and judges whether uncorrected misstatements are material individually or in aggregate (ISA 450, para 11), communicating them to those charged with governance (ISA 450, para 12).

Which standards apply, and do they apply in Malaysia?

Three interlocking standards run this process:

Standard	Question it answers
ISA 320	How big must an error be to matter?
ISA 530	Which and how many items do we test?
ISA 450	Do the errors we found change the opinion?

Malaysia applies all three as written. The Malaysian Institute of Accountants’ Auditing and Assurance Standards Board adopts the IAASB’s pronouncements as the Malaysian Approved Standards on Auditing “without modification.” For auditors of public interest entities, the Audit Oversight Board — established under the Securities Commission Malaysia Act 1993 — holds the legislative authority to adopt those auditing standards and registers and inspects those auditors, but exercises the standard-setting responsibility through the MIA (IFAC, Malaysia member profile). Because the Companies Act 2016 provides the legal basis for statutory audits in Malaysia, a Malaysian statutory audit follows the same materiality-and-sampling logic as an audit anywhere the ISAs apply.

What’s next

If you are reviewing your own audit, ask the engagement team three questions: what benchmark and percentage set materiality, what performance materiality (and tolerable misstatement) they used, and how they responded when a sample’s projected error approached that limit. The answers reveal how much of your accounts were really tested — and why. For the wider picture, read how statutory audits are triggered and overseen in Malaysia, and how the roles of the MIA and the Audit Oversight Board fit together.