Sample size for an internal audit

How the sizing is carried out

1. 1

   Define the population

   The number of items genuinely examinable over the period and within the audit scope: records, batches, interventions, entries. A poorly defined population distorts everything that follows.

2. 2

   Choose between judging and counting

   Judgement-based sampling targets risk areas and relies on experience; it supports no statistical estimate. Statistical sampling does, at the price of a genuinely random selection.

3. 3

   Set confidence and precision

   Confidence is the sampling risk you accept. The margin is the gap you tolerate between sample and population. Tightening either one raises the number of items to examine quickly.

4. 4

   Select at random, genuinely

   A statistical sample chosen for convenience, alphabetically, or from what the auditee puts forward is no longer a statistical sample. The draw is made on the full list, before the visit.

5. 5

   Read what the result allows

   This is the step almost always missing. A sample with no findings does not demonstrate the conformity of the population: it gives an upper bound on the nonconformity rate, and that bound can be computed.

The most frequent mistakes

• ▪Concluding conformity because the sample turned up nothing. Zero findings in twelve items still allows the population rate to reach about twenty-two per cent without that result being surprising.
• ▪Letting the auditee choose the records. It is the surest way to find nothing, and it strips the sample of any statistical value.
• ▪Calling a convenience sample statistical. Without a random draw on the full population, no bound and no estimate is defensible.
• ▪Using the same sample size whatever the process. A low-stakes process and a critical one call for neither the same confidence nor the same precision.
• ▪Forgetting the finite population correction. The usual formulas return about three hundred and eighty items whatever the population, which makes no sense for a batch of a hundred and twenty.
• ▪Confusing margin of error with nonconformity rate. The margin describes the precision of your estimate, not the quality of the audited process.

Frequently asked questions

Does ISO 19011 impose a sample size?

No. It is a guidance document: its Annex A.6 distinguishes judgement-based sampling from statistical sampling, without setting a size or a method. No management system standard prescribes a number of items to examine.

Can I conclude conformity if my sample shows no findings?

No, and this is the most widespread error. A sample with no findings gives an upper bound on the population's nonconformity rate, not a proof of conformity. On twelve items at ninety-five per cent confidence, that bound still exceeds twenty per cent: the result is compatible with a fairly degraded process.

Is statistical sampling required for an internal audit?

Not necessarily. Judgement-based sampling is legitimate and often more effective at finding issues, since it targets risk areas. Its limit is that it supports no estimate of uncertainty: nothing can be asserted about the whole population. The choice depends on what the audit must demonstrate.

Why does the size depend so little on the population?

Because the precision of an estimate depends mainly on the number of observations, not on the size of the pool they come from. The population only enters through the finite population correction, which shrinks the sample when it represents a noticeable share. This is why a hundred and twenty records need far fewer than a hundred and twenty thousand, but ten thousand and one million need almost the same.

What does the confidence level mean?

It is the sampling risk you accept. Ninety-five per cent confidence means the method, repeated many times, would correctly bracket the true value in ninety-five per cent of cases. It says nothing about this particular sample, and that nuance matters when writing a finding.