Sampling that follows residual risk

When control conclusions shift, sample design should move with them — not stay frozen from the planning kickoff.

Data charts on a monitor

Teams often lock sample sizes in week two and never reopen the worksheet. That habit is expensive when a key control fails testing or when walkthroughs reveal a different process owner than the flowchart claimed.

Name the trigger that forces a resize

Write the trigger in the planning memo: “If operating effectiveness for control AP-04 is not supported, revenue occurrence sampling increases by X and confirmation scope expands to Y.” Pre-deciding the resize reduces mid-season politics.

Separate precision from comfort

Some partners ask for larger samples because the client “feels risky,” even after residual risk is already rated high and substantive procedures are extensive. Push the conversation back to what additional precision the extra items buy.

Keep the trail short

A one-page change log — date, trigger, old size, new size, reviewer — beats a buried comment in the sampling tool. Reviewers look for that trail first.

Module 6 of Risk-Based Audit Fundamentals walks through three resize scenarios with annotated worksheets.

← All insights