Write an audit sample-selection note before reporting a result

A selection note should let someone reconstruct which records you examined and how they relate to the question. State the target population, the available file, the selection rule and the record identifiers before describing the result.

This fictional exercise concerns documentation and reasoning. It does not prescribe a sample size or statistical projection method for a real audit.

Separate four sets

The task at fictional Alder Systems is to examine whether access requests completed during April received approval before access was granted. A dashboard reports 120 completed requests. An exported file has 112 rows. The reviewer selects ten rows marked urgent from that file.

The difference of eight is a reconciliation question. It does not by itself prove that eight requests are missing: the dashboard and export might apply different definitions, filters or duplicate handling. Do not silently replace the target population with whichever file is easier to use.

Write the first note

“Selected ten urgent records from the supplied 112-row export. Recorded their identifiers and compared documented approval and access-grant times using the supplied April criterion. Two selected records show access granted before approval. The export has not been reconciled to the dashboard total of 120, and the selection does not cover non-urgent records.”

This note supports two observed timing exceptions among the ten examined records, assuming the stated timestamp interpretation is sound. It does not establish a 20% exception rate across the entire April population. Selection based on urgency is a targeted choice; it is not made random by calling the rows a sample.

Revise only what new evidence resolves

A later reconciliation shows that the dashboard included eight requests completed in March but updated in April. The export is confirmed as the 112 April completions. Link the reconciliation and its definitions to the note.

That resolves the supplied completeness discrepancy in this case. It does not change the urgent-only selection into coverage of every category. Preserve the two observed exceptions and the remaining selection limit. Additional procedures, if required, should follow the task's objective and responsible methodology rather than a desire to produce a cleaner result.

Rehearse the boundary

Ask yourself: Could another reader identify the same ten records? Did I state why they were selected? Which conclusion would require evidence about records I never examined?

ISACA's audit-sampling definition links a subset to a characteristic of its population. The exercise here makes the intervening documentation visible; it is not ISACA exam content or an endorsed workpaper.

Continue with explaining a control test for the procedure and result. Use the sample-selection preparation comparison to decide whether a free exercise or the existing connected Portfolio Kit better addresses your learning gap.