By Julius DeSilva
Auditing is like tasting a dish—you don’t need to eat the whole meal to know if it’s well-seasoned. By sampling just the right bites, you can judge the overall quality and balance of flavors. One key factor to a successful audit is picking the right sample—one that’s big enough to uncover real issues but focused enough to be effective.
But how do you know how much to check? And how do you ensure your sample gives you a true reflection of the system?
In this article, I break down the science and strategy behind audit sampling.
Why Audit Sampling Matters
Auditors can’t check every single process, process output, or record—it would take forever. If they did, what then would be the difference between an audit and a 100% inspection? Auditors must therefore select a portion (a sample) of the organization (and underlying system/process being audited) that helps them evaluate the overall performance, risks, and conformity of the system.
Choosing the “wrong” sample can lead to:
- Missed risks– Not catching systemic issues or ineffective controls.
- Wasted time– Reviewing too many low-risk areas or areas that may be historically conforming.
- Biased results– Looking at the parts of the system that are not necessary for the audit objective.
A good audit sample should:
- Match the audit objective– Focus on what you’re trying to assess.
- Be representative– Reflect the system’s reality at different levels and areas of the organization.
- Consider risks– Focus on high-risk areas.
- Be efficient– Large enough to be meaningful, but not excessive.
The Audit Objective – The Starting Point
Before selecting a sample, ask yourself: What is the goal of this audit?The audit objective dictates how big, deep, and focused your sample should be. When the audit objective is not clear, the auditor must check with the audit client to clarify expectations.
Based on the objective the auditor must determine the scope and criteria assigned by the client to assess if it will allow them to meet the audit objective. With clarity on the objective, scope and criteria of the audit, the auditor can now determine the sample of the audit.
The sample an auditor selects would also vary based on the type of auditbeing conducted, whether it is a compliance audit, process audit, product audit, system audit, or integrated audit. In each type of audit, the goal is to determine that at various levels, the controls and resources are adequate, suitable, and effective.
To do this, auditors should select a representative sample of personnel from various levels of the organization:
- Senior management– for strategic oversight and policy enforcement.
- Intermediate management– to assess operational control and implementation.
- Frontline employees– to understand how procedures translate into daily operations.
Additionally, a mix of experienced and new employees should be sampled to gauge how well the system supports both seasoned professionals and those new to the process.
Beyond personnel, auditors should also select a representative sample of projects, processes, and records that will give them confidence in concluding whether the organization is consistently achieving its objectives as planned.
How to Know You’re Getting a Good Snapshot of the System
A well-selected audit sample should focus on where most of the work happens. In a system audit, for example, auditors should focus on:
- Areas where the audit criteria apply most frequently.
- High-risk areas where failures in control would have the greatest impact.
- A mix of experienced personnel and those new to the system.
Following the above guideline, in a manufacturing organization, auditors may focus on processes generating the highest volume of product. Using the Pareto Principle (80/20 rule), auditors might consider that the top 20% of customers generate 80% of revenue. Thus, focusing on the product lines serving these key customers would provide an 80% confidence level in how the system/process is functioning.
In a safety audit, the maximum focus on verification of implementation of controls and provision of resources would be in those areas of the organization that present the maximum identified hazards or those that have the most safety critical processes.
How Deep Should the Auditor Dive?
Determining how deep to go in an audit sample is a balance between risk-based judgment and structured sampling methodologies. While an auditor’s experience plays a significant role, the following methods help in determining the right sample size:
- Risk-Based Sampling– Prioritize areas with higher risk exposure, regulatory scrutiny, or past non-conformities.
- Random Sampling– Select records or transactions at random to reduce bias and get an unbiased snapshot.
- Judgmental Sampling– Use auditor expertise to select key areas where issues are most likely to occur and have maximum impact on the customer and/or organization.
- Statistical Sampling– Use data-driven methods (such as frequency analysis) to determine the number of records or processes to check.
If your sample shows zero issues, you might not need to go further. If you find multiple issues, the auditor may expand the sample to uncover patterns or more systematic issues than the symptomatic ones.
Final Thoughts
In certification audits the auditor may cover a large breadth of the system but not take as deep a dive versus internal audits that may focus on one process area at a time and in which the auditor may have time to do a deeper dive.
Selecting the right audit sample is both an art and a science. A well-thought-out sampling approach helps auditors identify risks, drive continuous improvement, and provide meaningful insights without wasting time on unnecessary checks. By aligning your sample selection with audit objectives, risk factors, and representative elements of the system, you can ensure a more effective and efficient audit process.
Choosing the right audit sample is a balance of strategy, risk assessment, and efficiency. Get it right, and your audit will provide meaningful insights that drive real improvements.
About the author
Julius DeSilva is the CEO of Quality Management International Inc. A former merchant marine officer, he has assisted organizations of varied sizes across a wide spectrum of industries implement process-based management systems conforming to ISO and other standards. He is well versed in the following standards: maritime safety/security, aerospace, environmental, supply chain security, and quality. He teaches, consults, and audits in these disciplines, including process improvement and leadership-related topics. DeSilva received his MBA from the Darden School of Business, University of Virginia. He is an Exemplar Global certified lead auditor to various ISO Standard including ISO 9001 and is an Associate Fellow of the Nautical Institute.
This article first appeared on Julius DeSilva’s LinkedIn page and is published here with permission.