Audit Sampling Methods: Complete Guide for Internal Auditors [2026]

Audit Sampling Methods: Complete Guide to Statistical & Non-Statistical Techniques

Audit sampling is the application of an audit procedure to less than 100% of items within a population to draw conclusions about the entire group. Under the Global Internal Audit Standards (GIAS) 2024, Standard 14.1 requires internal auditors to gather sufficient, reliable, and relevant information — and well-designed sampling is how auditors meet that standard without testing every single transaction. Whether you are preparing for the CIA Part 2 exam or building an audit universe in practice, understanding when to use statistical versus non-statistical sampling is essential for both exam success and fieldwork efficiency.

What Is Audit Sampling?

In practice, internal auditors rarely have the time or resources to examine 100% of transactions in an audit engagement. Sampling bridges this gap by allowing auditors to test a manageable number of items and extrapolate the results. The key is designing the sample so that conclusions drawn from it are reliable and defensible.

Audit sampling applies to both tests of controls (evaluating whether internal controls are operating effectively) and substantive tests (verifying the accuracy of account balances or transaction details). The method chosen depends on the audit objective, the size and nature of the population, and the acceptable level of risk.

Why Audit Sampling Matters in Internal Audit

Effective audit sampling is the backbone of efficient internal audit fieldwork. Without it, auditors would face an impossible choice: test everything (impractical for large populations) or test nothing (unacceptable from an assurance perspective). Here is why sampling is critical:

• Resource efficiency — Sampling reduces the time and cost of audit engagements while still providing sufficient evidence for conclusions.
• Scalability — The same sampling principles apply whether the population is 500 purchase orders or 50,000 expense claims.
• Risk-based focus — Stratified and judgemental approaches let auditors concentrate testing on high-risk or high-value items, aligning with the enterprise risk management framework.
• Defensible conclusions — Statistical sampling produces quantifiable confidence levels and error rates, making findings harder to challenge.
• Regulatory alignment — GIAS 2024, PCAOB AS 2315, and ISA 530 all recognise sampling as a valid evidence-gathering technique when properly designed.

GIAS 2024 Requirements for Audit Sampling

The 2024 Global Internal Audit Standards do not prescribe a specific sampling methodology, but they set clear expectations for the quality of audit evidence. Standard 14.1 (Gathering Information) requires that evidence be sufficient (enough in quantity), reliable (trustworthy and verifiable), and relevant (connected to the audit objective).

This means auditors must be able to justify their sampling approach in the audit documentation. The working papers should clearly record the sampling objective, the population definition, the method used, the sample size rationale, and how results were evaluated and projected.

Statistical Sampling Methods

Statistical sampling uses probability theory to select items and evaluate results. Every item in the population has a known, non-zero chance of selection. The advantage is that results are mathematically measurable — auditors can quantify sampling risk and express confidence levels numerically.

1. Simple Random Sampling

Each item in the population has an equal probability of being selected. Auditors typically use random number generators or tables to select items. This method works best when the population is relatively homogeneous and no specific risk stratification is needed.

Example: An auditor selects 50 purchase orders from a population of 2,000 using a random number generator. Each PO had an equal 2.5% chance of selection.

2. Systematic Sampling

The auditor selects every nth item from an ordered list after choosing a random starting point. The sampling interval is calculated by dividing the population size by the desired sample size. This method is efficient for large, well-ordered populations.

Example: From 10,000 expense claims, the auditor wants a sample of 200. The interval is 50 (10,000 ÷ 200). Starting at a random point (say item 17), the auditor selects items 17, 67, 117, 167, and so on.

3. Stratified Random Sampling

The population is divided into distinct subgroups (strata) based on a characteristic relevant to the audit objective — typically monetary value, risk level, or transaction type. Random samples are then drawn independently from each stratum. This ensures adequate coverage of high-risk or high-value segments.

Example: An auditor stratifies vendor payments into three layers: over $100,000 (test 100%), $10,000–$100,000 (sample 30%), and under $10,000 (sample 5%). This ensures large-value items receive proportionally greater scrutiny.

4. Monetary Unit Sampling (MUS)

Also called dollar-unit sampling or probability-proportional-to-size (PPS) sampling. Each individual monetary unit (dollar, rupee, pound) in the population has an equal chance of selection. This naturally weights the sample towards higher-value transactions — a $100,000 invoice is 100 times more likely to be selected than a $1,000 invoice.

MUS is particularly effective for substantive testing where the auditor is looking for monetary overstatements. It is the most commonly tested statistical method in the CIA Part 2 exam.

5. Cluster Sampling

The population is divided into naturally occurring groups (clusters) — such as branches, time periods, or departments. Entire clusters are randomly selected and all items within the chosen clusters are tested. This is efficient when records are physically grouped by location or system.

Example: An auditor randomly selects 3 out of 12 regional offices and tests all travel expense claims from those three offices.

Non-Statistical Sampling Methods

Non-statistical sampling relies on the auditor's professional judgement rather than probability theory. The auditor decides both the sample size and which items to select based on experience, knowledge of the business, and risk assessment. While results cannot be projected with mathematical precision, non-statistical methods are widely used in practice — especially for smaller populations or targeted investigations.

1. Judgemental (Purposive) Sampling

The auditor uses experience and knowledge of the business to select items most likely to contain errors or irregularities. This is the most common non-statistical method used in risk-based internal auditing. It is particularly effective when the auditor has specific concerns about certain transaction types, time periods, or personnel.

Example: An auditor investigating potential revenue fraud selects all sales transactions recorded in the last three days of each quarter, where historical data shows errors are most concentrated.

2. Haphazard Sampling

The auditor selects items without any structured technique, attempting to be unbiased but without using random number generators. The key distinction from random sampling is that there is no mathematical basis for selection — the auditor simply picks items from the population without conscious bias.

3. Block (Interval) Sampling

The auditor selects a contiguous block of items — for example, all transactions from a specific week or month. This is efficient for testing time-specific controls but carries a significant limitation: the selected block may not represent the entire population.

Example: Testing all purchase orders processed during the first two weeks of March to evaluate compliance with the updated procurement policy that took effect on 1 March.

4. Convenience Sampling

Items are selected based on ease of access. While this saves time, it is the weakest sampling method because it is most susceptible to selection bias. It should only be used when the audit objective is narrow and the population characteristics are well understood.

Statistical vs Non-Statistical Sampling: Comparison

The choice between statistical and non-statistical sampling depends on the audit objective, population size, available resources, and the level of assurance required. Here is a side-by-side comparison:

How to Determine Sample Size

Sample size determination is one of the most critical — and most tested — aspects of audit sampling. The factors that influence sample size differ slightly between tests of controls and substantive tests, but the core principles remain consistent.

Factors That Increase Sample Size

Sampling Risks & Common Pitfalls

Sampling risk is the possibility that the auditor's conclusion based on a sample differs from the conclusion that would be reached if the entire population were tested. There are two types:

Common Sampling Pitfalls

• Undefined population — Failing to clearly define the population boundaries leads to incomplete or incorrect sampling frames.
• Selection bias — Unconsciously favouring certain items (e.g., easily accessible records, recent transactions).
• Inadequate sample size — Under-sampling reduces the reliability of conclusions and may not satisfy quality metrics.
• Failure to project results — Finding 3 errors in a sample of 50 but not extrapolating what this means for the population of 5,000.
• Ignoring non-sampling risk — Errors caused by factors other than sampling (e.g., inappropriate audit procedures, misinterpretation of evidence) which no amount of sampling can address.

Best Practices for Audit Sampling

Additional best practices include:

• Use CAATs (Computer Assisted Audit Techniques) to automate sample selection and eliminate manual bias.
• Document the sampling methodology thoroughly in your working papers — including the rationale for the method chosen.
• Consider stratification even when using non-statistical methods to ensure coverage of high-risk items.
• Always investigate the root cause of errors found, not just the error itself — this supports stronger audit findings and recommendations.
• Benchmark your sampling approach against internal audit excellence frameworks during quality reviews.

Audit Sampling in CIA Part 2 Exam

Audit sampling is a high-weight topic in CIA Part 2: Practice of Internal Auditing, falling under Domain II (Managing Individual Engagements) which covers approximately 40–50% of the exam. Specifically, candidates are expected to understand:

• The difference between statistical and non-statistical sampling
• When each sampling method is appropriate
• How to calculate sample sizes based on confidence level and tolerable error
• Attribute sampling for tests of controls vs variable sampling for substantive tests
• Alpha risk vs Beta risk and their implications
• How to evaluate and project sampling results

For a comprehensive comparison of CIA review providers, see our guide to the best CIA review courses in 2026.

Frequently Asked Questions