SIA 5 explained: this guide covers what it means, who it applies to, the step-by-step process, documents required, fees, due dates and penalties in India — so you can stay compliant with confidence and avoid costly mistakes.
An internal auditor cannot check every voucher, so two questions decide the quality of the work: which items are tested, and what do the numbers say before any item is opened? SIA 5 deals with the first and SIA 6 with the second. Both are practical, and both explain what the auditor will ask your accounts team for.
This article is from the ICAI Compendium of Standards on Internal Audit (as on 1 October 2022). SIA 5 and SIA 6 belong to the older group in the compendium, headed "as on July 1, 2013", and were published in the October 2008 issue of the ICAI journal. Their front note says they were recommendatory in the initial period and become mandatory from a date the Council notifies, and their effective-date paragraphs are printed with a blank date. Under paragraph 5.1 of the Preface the Council decided to make the SIAs mandatory in a phased manner. Check the current status on the ICAI internal audit board's site, internalaudit.icai.org.
SIA 5 asks the internal auditor to design the sample around the audit objective, choose it so it is representative, evaluate the errors and project them to the population. SIA 6 asks for analytical procedures at planning and again at the overall review, and for unusual results to be investigated until explained. Both leave the method to professional judgement.
SIA 5: sampling
SIA 5 applies to statistical and non-statistical sampling alike; either, properly applied, can give sufficient appropriate evidence (paragraph 1). Testing every item in a population, or every item above a chosen amount, is not sampling, because the items were not chosen to be representative (paragraph 3). Key terms in the standard: error means a control deviation in a test of controls or a misstatement in a test of details; sampling risk is the chance that the conclusion from a sample would differ from the conclusion on the whole population; tolerable error is the most error the auditor is willing to accept (paragraphs 4, 6 and 9).
Designing the sample
| Step | What the standard says | Paragraph |
|---|---|---|
| Start with the objective | Consider the audit objective, the population and the sample size; define what counts as an error | 13, 14 |
| Choose the right population | It must suit the objective and be complete. Testing for understated payables, for example, needs subsequent payments or unpaid invoices, not the payables list | 15, 17 |
| Check the data | Perform procedures to be sure the information being sampled is complete and accurate | 18 |
| Stratify where useful | Divide into sub-populations, often by value, so effort goes to the items with most potential error | 19 |
| Fix the size | Consider sampling risk, tolerable error and expected error | 20 |
Three relationships in paragraphs 20 to 26 are worth remembering. The lower the risk the auditor will accept, the larger the sample. The smaller the tolerable error, the larger the sample. If errors are expected, a larger sample is needed than if none is expected. The size may come from a statistical formula or from judgement applied objectively (paragraph 21), and for tests of controls the analysis of the nature and cause of errors often matters more than statistics, so non-statistical sampling may be preferred (paragraph 22). Sampling suits tests of controls where the control leaves evidence, such as a credit manager's initials on an invoice (paragraph 11). The standard's appendices on sample-size factors and selection methods are not reproduced here.
Selecting and evaluating
The sample must be chosen so that it can be expected to be representative, which means every item has an opportunity of being selected (paragraph 27). The three commonly used methods are random selection including computer-assisted techniques, systematic selection and haphazard selection (paragraph 28). After testing, the auditor should (paragraph 29):
- analyse the nature and cause of errors;
- project the errors to the population;
- reassess sampling risk; and
- consider the effect on the objective and on other areas.
An item whose evidence cannot be obtained may be cleared by alternative procedures, such as later receipts for an unanswered confirmation; if those fail, it is treated as an error (paragraph 32). Where errors share a feature such as location or period, the auditor may isolate that sub-population and extend work there (paragraph 34). For tests of controls the sample error rate is the projected rate (paragraph 36). Where projected error exceeds tolerable error and the sampling risk is unacceptable, the auditor extends procedures or does alternative work, and may ask management to investigate (paragraphs 37 and 38). Documentation records the design, population, size, rationale, errors, projection and effect (paragraph 39). The statutory audit equivalent is explained in our SA 530 guide.
SIA 6: analytical procedures
Paragraph 3 describes analytical procedures as analysis of significant ratios and trends, including investigating fluctuations and relationships in financial and non-financial data that are inconsistent with other information or deviate significantly from predicted amounts. The comparisons can be with prior periods, budgets or forecasts, the auditor's own predictions, such as an estimate of depreciation, and industry information (paragraph 4), or relationships among data, such as gross margin percentages or payroll cost per employee (paragraph 5). Methods range from simple comparisons to regression analysis; the choice is judgement (paragraph 6).
| Stage | What SIA 6 requires | Paragraph |
|---|---|---|
| Planning | Apply as risk assessment procedures to understand the business and find areas of potential risk | 2, 10 |
| Substantive | May be used instead of, or with, tests of details, depending on expected effectiveness | 12 |
| Overall review | Apply at or near the end to form a conclusion on whether systems, processes and controls as a whole operate effectively | 2, 15 |
| Unusual results | Investigate, get explanations and corroborating evidence; communicate unexplained matters to management | 19 |
How far to rely on analytics depends on materiality, other procedures aimed at the same objective, how precisely the result can be predicted and the assessed risks (paragraph 17). The standard notes, for example, that gross margins are more predictable than discretionary spending, and that where inventory balances are material the auditor does not rely on analytics alone. The data used must itself be reliable, so controls over its preparation may need testing (paragraph 18). Investigation starts with inquiry of management, then corroboration of the answers and other procedures if the explanation is inadequate (paragraph 20). For the statutory audit counterpart, see our SA 520 guide. If you want such analytics built into monthly management reports so that variances are caught early, our MIS reporting team can set that up.
Illustrative example
Illustrative: Kesar Foods Ltd's internal auditor reviews its dealer discount process. An analytical pass shows discount as a percentage of sales rising from 4.1 to 5.3 per cent over the year while sales mix is unchanged. The auditor therefore treats the discount approval control as high risk. The population is all credit notes for the year, 2,400 items; the auditor stratifies into credit notes above a set value, which are all examined, and the remainder, from which 40 are selected randomly. Three of the 40 lack the second approval. The auditor analyses the cause (one regional office, one approver on leave), projects the rate of deviation, finds it above the tolerable rate and extends testing to that office's other credit notes. The results go to management with a recommendation and are documented in the working papers.
Common lapses
- Picking "a few" items by convenience and calling it a sample.
- Sampling from the payables list to prove completeness of payables.
- Not recording why the sample size was chosen.
- Treating the largest items as a sample of the whole population.
- Accepting management's explanation of a variance with no corroboration.
Need help with analytics and variance reporting?
If you want ratio and trend reports that highlight unusual movements before the internal auditor arrives, our team can help build them through MIS reporting.
Key takeaways
- Define the objective and the population before choosing the sample size (SIA 5, paragraphs 13 to 17).
- Sample size grows with lower accepted risk, smaller tolerable error and higher expected error (paragraphs 20 to 26).
- Evaluate errors by cause, project them and reassess sampling risk (paragraph 29).
- Use analytical procedures at planning and at the overall review (SIA 6, paragraphs 2, 10 and 15).
- Investigate unexplained variances and report them (SIA 6, paragraph 19).
Read next
- SIA 310, 320, 330 and 350: planning, evidence, documentation and review
- SIA 360, 370 and 390: internal audit report and follow-up
- SA 530: audit sampling
- SA 520: analytical procedures
Disclaimer: Based on the Standards on Auditing, the review, assurance and related services standards, the Compendium of Standards on Internal Audit (as on 1 October 2022) and the Compendium of Forensic Accounting and Investigation Standards (as on September 2025) issued by the Institute of Chartered Accountants of India, in the versions named in the article, as consulted on 4 October 2026. ICAI revises standards from time to time; check the current text and effective dates on icai.org and the Companies Act provisions referred to. This article is general information, not legal advice; check the official text before acting.