Audit sampling and evidence: what your sample can support
Define the population and audit objective before selecting a sample. The method, coverage, and evidence quality determine what the results can support. A judgmental selection of high-risk items can find important exceptions, but its exception rate is not automatically an unbiased estimate for the entire population.
Sampling decisions that change the conclusion
| Decision | How to apply it | Mistake to avoid |
|---|---|---|
| Population | Reconcile the source population to the process and period being assessed. | Sampling only available records when missing records may contain the problem. |
| Selection | Choose a method that fits the objective and document why items were selected. | Calling a convenience sample random. |
| Evaluation | Investigate exceptions, consider sampling risk, and stay within the method’s inference limits. | Applying the rate from targeted suspicious items to all transactions without justification. |
Population
Reconcile the source population to the process and period being assessed.
Avoid: Sampling only available records when missing records may contain the problem.
Selection
Choose a method that fits the objective and document why items were selected.
Avoid: Calling a convenience sample random.
Evaluation
Investigate exceptions, consider sampling risk, and stay within the method’s inference limits.
Avoid: Applying the rate from targeted suspicious items to all transactions without justification.
A decision path you can use
- 1Validate the population
- 2Choose and document selection
- 3Investigate results and limit inference
Understand the method
Work through the reasoning
Define the population and sampling unit first
A sample can support an evaluation only if its population matches the objective. For timely purchase approval, the unit might be a purchase order released during the review period. Selecting from a folder of signed approvals excludes orders without approval evidence. Reconcile the population and understand filters, duplicates, cancellations, and missing records before selecting items.
Also specify what constitutes an exception. A missing signature, an unauthorized approver, and approval after release represent different conditions. Apply the criterion consistently and investigate alternative evidence where appropriate. Without a defined unit and exception rule, a reported deviation rate may combine unlike observations and mislead the reader.
Choose a method that fits the intended inference
Statistical sampling uses probability-based selection and a method that permits evaluation of sampling risk. Nonstatistical selection can also be useful, including targeted examination of high-risk or unusual transactions. The important distinction is what the results allow the auditor to infer, not whether one method sounds more sophisticated.
A targeted review of the largest payments can reveal significant problems in those payments. It does not automatically estimate the deviation rate in all payments. Likewise, checking every row with an automated rule eliminates sampling for that rule but leaves questions about data completeness, rule design, and matters the rule does not test. State these limits explicitly.
Investigate exceptions before interpreting a rate
An exception may reflect a control failure, a data error, or a misunderstanding of the criterion. Establish the actual condition and consider its cause and significance. Several exceptions linked to the same system configuration may indicate a wider defect. A single high-impact override may matter even when the numerical deviation rate is low.
Do not remove an exception merely because management calls it unusual. Determine whether it belongs to the defined population and how it affects the intended inference. Additional work may be needed to understand its extent. Expanding a sample should follow a reasoned approach rather than continuing to select items until the percentage looks acceptable.
Separate sampling risk from other evidence risks
Sampling risk arises because a sample may lead to a different conclusion from examining the whole population using the same procedure. Other risks include testing the wrong attribute, using incomplete records, misreading evidence, or applying unsuitable criteria. Increasing sample size cannot repair all of these defects.
Document the population, selection method, sample rationale, procedures, exceptions, and evaluation. Keep the conclusion consistent with the method and coverage. The Standards do not supply a universal sample size for every internal audit. Use an appropriate methodology and expertise for the assurance sought, including statistical support where the chosen method requires it.
Original teaching example
Apply the method to a decision
The scenario
An auditor deliberately selects the 20 largest purchases and finds four missing approvals in a population of 8,000 purchases.
The decision
The selected-item exception rate is 20%; it does not establish that 20% of all 8,000 purchases lack approval.
Four divided by 20 describes the tested items. Selection favored large purchases, so it can reveal a serious issue in that group without representing every transaction. Assess causes, exposure, and whether further testing is needed.
Independent hypothetical case. It is not an official IIA question, an actual investigation, or a scoring prediction.
A second application
A targeted sample is reported as a population rate
The situation
The auditor examines the 20 largest expenses and finds four approval failures. The draft says 20% of all employee expenses are noncompliant.
Reason through it
The arithmetic describes the selected items, but the selection deliberately overrepresents large expenses. It does not support that population-wide estimate without an appropriate basis.
Take the decision
Report the result for the targeted selection and evaluate significance. Use a suitable additional approach if estimating the wider rate is an objective.
Original hypothetical teaching case.
Check your understanding
Choose the best answer, then check the reasoning for each alternative. These short learning checks are not a full exam simulation. Answers are not saved or sent.
Questions about this topic
Is there one required sample size for every CIA audit scenario?
No. Size depends on the objective, risk, expected exceptions, desired assurance, method, and population characteristics. Avoid treating an illustrative sample count as a universal professional requirement.
Does a larger sample always provide stronger assurance?
Only when the underlying population, procedure, and evaluation are appropriate. More items cannot correct a biased population or a test that measures the wrong attribute. Sample size is one decision within a complete evidence approach.
Sources and syllabus scope
Prepared by MiloPrep editorial team. Source links checked 2026-10-10. These notes and cases are independent teaching material; the IIA sources do not verify or endorse them.
- IIA expanded syllabus
Establishes the examined topics. Primary domain: Information Gathering, Analysis, and Evaluation (40% of Part 2). This is a domain allocation, not a separate weight for this lesson.
- Global Internal Audit Standards reference
- Locator: Standards 13.6 and 14.1. Supports the professional requirements cited here; our scenarios and solution steps are original applications. Current IIA Standards resources.
Part 2: Internal Audit Engagement. Selected learning notes, not complete curriculum coverage. Browse all CIA topics.