Auditors usually do not test every record. They ask for the full population of a control, such as all new hires in the period, pick a sample from it, and test that sample. Your job is to supply a complete, accurate population list, because the sample is only as honest as the list it came from.
What a population is
A population is every instance of a control event during the audit period. For a joiner process it is every person who started. For change management it is every production change. For access removal it is every person who left.
The auditor does not choose from your memory of what happened. They want a system export or a dated list, then they select items from it. How many items they pick, and how, is their call, and it varies by firm and by how often the control runs. Ask your auditor rather than guessing at a number.
Why populations go wrong
Most sampling pain comes from incomplete lists. Common causes:
- The export covers only one system, but the control spans two.
- Contractors and former staff are missing because the HR tool only lists current employees.
- Dates are in different time zones or formats, so items fall outside the period by mistake.
- The list was edited by hand after export.
An incomplete population is a finding waiting to happen. If the auditor later discovers a leaver who was not on your list, they may question every list you gave them.
How to prepare clean populations
Work out the populations before the audit starts, not during it. For each control, write down the source system, the filter, the date range and who runs the export. Then run it on a schedule, so you have a dated record of the list as it stood.
Keep the raw export untouched. If you need a cleaned version, save it as a second file and note what you removed and why.
What happens after the pick
For each sampled item the auditor looks for proof that the control ran as written: the ticket, the approval, the timestamp, the person who did it. Missing proof for one item may be recorded as an exception. That does not automatically sink the report, but it will be described, so it pays to know your weakest controls early.
The general idea of testing controls by examining records and asking people appears in NIST's assessment guidance, which describes procedures for assessing controls and analysing the results. Audit firms apply their own methods on top.
Where automation helps
Automated collection makes populations easier because the system records every event with a timestamp. It does not remove the need to check scope: confirm the export covers every system in the audit boundary.
Safeguard includes compliance and evidence automation that collects control evidence continuously, so a population can be pulled for any date range. Your auditor still decides what is sufficient.
Quick check
Can I pick my own sample to show the auditor?
No. The auditor selects the sample from the population you provide. You can influence quality only by making the population complete.
Is there a fixed sample size?
Not one that applies everywhere. It depends on the auditor's method and how often the control operates. Ask your audit firm for their approach.
Sources
Last reviewed: 19 October 2026.
