The missing records your audit sample cannot find

A sample can tell an internal auditor nothing about records that were excluded before selection. Before choosing internal audit sampling methods, establish which events the review covers, how the list was produced and whether that list contains the events relevant to the audit question. Increasing the sample size cannot repair an incomplete starting population.

For US internal audit teams, this is an evidence-design problem with a practical consequence: a reassuring result may describe the export someone supplied, while leaving a different part of the process untested.

• Define the event and period being tested before requesting the data.
• Distinguish a targeted review of unusual items from a sample intended to support a broader conclusion.
• Report the population, selection method and limitations alongside the result.

Consider a fictional purchasing review. The audit objective is to assess whether purchases were approved before suppliers were committed. The team receives an export of completed purchase orders and selects records from it. Every selected order contains an approval.

That result leaves an important question unanswered: could staff commit the business through an email, purchasing card or emergency route without creating a purchase order? If so, the export cannot by itself reveal those commitments. Even inspecting every record in the export would leave that gap.

Our proposed first step is to write a one-sentence population definition: all commitments within the specified business units and period that fall under the approval policy. Then identify the systems and alternative routes that could contain those events. The accessible list used for selection is the sampling frame; it needs to be reconciled to the intended population.

The distinction has a clear parallel in US external-audit guidance. PCAOB AS 2315 explains that a population must fit the audit objective and that testing recorded items cannot reveal omitted items merely by sampling those records. Its sampling guidance also makes professional judgment central to both statistical and nonstatistical approaches. These are external-audit requirements in their applicable engagements, not a blanket legal mandate for operational internal audits. PCAOB AS 2315

An auditor may deliberately inspect all emergency purchases, all transactions above a threshold or records with missing approval timestamps. That can be useful work. The conclusion should identify the selected group and avoid treating its exception rate as the rate for unrelated transactions.

PCAOB AS 1105 explicitly separates testing all items, selecting specific items and audit sampling. It says results from specific-item selection cannot be projected to the whole population. It also addresses checking the accuracy and completeness of company-produced information. This provides a useful comparison when documenting why an internal audit's selected records support a particular conclusion. PCAOB AS 1105

For the fictional purchasing review, the work could be separated as follows. This is an illustrative design, not a prescribed sampling plan.

A reviewer should be able to understand how the auditor moved from the source data to the tested records. Retain the extraction date, period, included entities, query or filters, record identifiers, duplicate treatment and any exclusions. Where the list changes during fieldwork, retain the earlier version and explain how the change affected selection.

Do not quietly replace an inconvenient item because its evidence is hard to obtain. Record the problem, assess whether another procedure can resolve it and explain any effect on the conclusion. A missing approval record and an inaccessible archive are different findings, even if both initially appear as an empty cell.

The IIA-Australia's public description of its 2025 sampling-and-testing factsheet connects the plan to the engagement objective. The full factsheet is a members-only resource; the public description alone is used here. Sampling and testing overview

Suppose the defined population is all purchasing commitments during one month. Three sources contain 120 purchase orders, 18 purchasing-card transactions and 10 emergency commitments. Cross-matching identifiers and evidence establishes that four card transactions and two emergency entries refer to purchase orders already listed. There is no overlap between the card and emergency lists in this invented dataset.

The reconciled frame is 120 + 18 + 10 − 4 − 2 = 142 distinct commitments. Preserve the six cross-references; do not merely delete repeated amounts, because two genuine commitments can have the same value. The purchase-order-only frame would omit 22 known commitments, or 22 ÷ 142 = 15.5% of the reconciled count, rounded to one decimal place.

The auditor then separately examines the 22 additional commitments and designs the routine purchase-order testing. Finding three exceptions among the 22 is a result for that identified group, not an estimated 13.6% failure rate for all 142 commitments. Its selection was driven by the purchasing route, not a representative design across the whole population.

The count reconciliation supports completeness against these three sources only. It cannot establish that an unidentified fourth route does not exist. Record how purchasing practices were investigated, which routes remain uncertain and how that limitation affects the final conclusion. All figures are fictional; they are not a recommended sample size or an observed audit outcome.

A useful closing statement identifies what was tested, why it was selected, what exceptions were found and which questions remain unresolved. In the fictional example, the audit could explain that purchase-order approval was tested while commitments outside that route still required reconciliation. It should not describe procurement as fully effective on that evidence alone.

There is no universal number of records that makes every audit adequate. Choose the method with the engagement's objective, risks, population and required assurance in view, using the function's approved methodology and suitable expertise. Connect that engagement-level decision to the wider risk-led audit programme.

The IIA's 2024 Global Internal Audit Standards remain the professional framework for internal audit practice; this article offers a practical evidence-control proposal, not a substitute for the Standards. Source checks were completed on 8 October 2026. The PCAOB page separately identifies an AS 2315 amendment effective on 15 December 2026; this article does not treat that future amendment as already effective. IIA standards overview

*Prepared with AI assistance. The purchasing example is fictional.*

This article is general information. Verify current requirements and seek qualified advice for your specific circumstances.

Spotted an issue? Contact our editorial desk.