Audit Testing and Sampling Methodology is the structured set of techniques an IS auditor uses to select a representative subset of items from a population, test those items for control effectiveness or error rates, and draw defensible conclusions about the entire population. It encompasses two primary branches: (1) Statistical Sampling — mathematically rigorous methods (attribute sampling, variables sampling) that produce quantifiable confidence intervals and are legally defensible; and (2) Non-Statistical (Judgmental) Sampling — auditor-directed selection based on professional judgment, appropriate for small or non-homogeneous populations. The methodology covers the full lifecycle: defining the objective and population, determining sample size, selecting items, executing tests, evaluating results against the tolerable error rate, and documenting conclusions. It is NOT a random guess, NOT a guarantee of finding all errors, and NOT a substitute for 100% testing when populations are small enough to test entirely or when data analytics tools make full-population testing feasible.
Where it stops · what it isn't
- —IS: Statistical sampling (attribute and variables), non-statistical/judgmental sampling, stratification, sample size determination, selection methods (random, systematic), error projection, and conclusion documentation.
- —IS NOT: Audit evidence collection techniques — how evidence is gathered once a sample is selected; that is a prerequisite competency.
- —IS NOT: Continuous controls monitoring (CCM) or 100% population testing via data analytics — though auditors must know when to use these instead of sampling.
- —IS NOT: Academic statistical hypothesis testing. Audit sampling is applied professional judgment constrained by standards (AICPA Audit Sampling Guide, PCAOB AS 2315, ISACA).
- —IS NOT: A substitute for the testing scope or frequency mandated by specific regulations (SOX, PCI-DSS, HIPAA) that override purely risk-based sample size decisions.
- —Boundary case: Populations under approximately 50 items are typically tested in full; sampling methodology still applies to the decision to sample but is rarely cost-justified at that scale.
Connected concepts in the graph
Every cubelet sits in a knowledge graph. Here's what this one connects to.
REQUIRESAudit Evidence Collection TechniquesRisk-Based Audit Planning
PART OFInformation Systems Auditing Process (CISA Domain 1)
ENABLESControl Effectiveness Assertions (SOX, ISO 27001)Audit Opinion Formulation
RELATED TOContinuous Auditing and Continuous MonitoringAudit Documentation and Workpaper Standards
CONSTRAINSData Analytics and 100% Population Testing