Back to: Sample Size matters

When considering sampling, several factors must be considered. The main parameter is what is referred to as the Total Population. This simply means, how many instances of supporting evidence are there to sample from for the given timeframe of the audit?

For example, if during an access audit, my total population of employees is 100, and the sample size requirement is for first time audits, a 25% sample is collected according to company policy, it would be incorrect to collect a random 25 samples from that population of 100.

Why?

As the auditor, you need to understand what the employee access classifications are for that population of 100 first.

Let’s say that in that population of 100, 5 employees are executive management, 15 are information technology, 10 are operations management, and the remaining 70 are operations support employees.

Sampling under the 25% rule would then be 2 from executive management, 4 from information technology, 3 from operations management, and 18 from operations support. 27 total samples from an equal distribution of job classifications instead of 25 samples from an unbalanced population sampling.

It is also very important not to overlook third party access in your sampling population.