Risk helps determine where to direct audit work. It does not make a list of unusual transactions a representative sample. Define the conclusion you need before choosing the items that will support it.
Start with the objective and the population
A review of approval-control operation asks a different question from a test for overstated expenses. The first might focus on whether an authorized person approved purchases at the required time. The second needs evidence about recorded transactions and their accounting. The selection and the procedure must fit that objective.
First establish the population's completeness and boundaries. Identify the sampling unit, period and exclusions. An invoice, invoice line and occurrence of an approval control are not interchangeable units, even when they come from the same system.
Higher assessed risk can require more persuasive evidence and changes to the nature, timing or extent of procedures. PCAOB AS 2301 explains that relationship. Increasing a record count without improving the procedure may leave the original evidence problem unresolved.
Keep targeted selection and audit sampling distinct
Suppose a fictional review at Bellwater Manufacturing covers 8,000 recorded invoices. Forty unusually large or complex items account for 55% of the value. The team decides to examine all 40 individually. That is useful targeted work, but its findings alone do not characterize the remaining 7,960 invoices.
Specific-item selection can focus attention on known risks. Results from those selected items cannot simply be projected across the whole population. PCAOB AS 1105 distinguishes that approach from audit sampling.
The remaining population needs an explicit decision in the plan. Depending on the objective and other evidence, the reviewer may design sampling, perform other procedures or revise the scope. Calling the 40 items a “risk-based sample” does not resolve that decision.
Choose a method that supports the intended inference
| Approach | Useful purpose | Boundary to document |
|---|---|---|
| Examine specific items | Investigate identified risks, unusual transactions or individually significant items. | Conclusions concern the items examined; do not project their exception rate across untested records. |
| Audit sampling | Evaluate a defined population characteristic using a designed selection and evaluation method. | Preserve the sampling frame, selection method, assumptions and treatment of results. |
| Test every item for a defined condition | Apply a supported procedure across the complete defined population. | Coverage of that condition does not establish every assertion or the quality of the source evidence. |
Audit sampling can be statistical or nonstatistical; both require professional judgment. Statistical sampling uses probability-based selection and evaluation to quantify sampling risk. A properly designed nonstatistical sample also requires a basis for drawing and evaluating a sample, not convenient or outcome-driven selection. PCAOB AS 2315 addresses both approaches.
Design the remainder deliberately
At Bellwater, document the 40 targeted invoices as a separate group. If the team samples the remainder, preserve the 7,960-item frame and its relationship to the original population. Any further grouping should have a reason connected to the objective, such as different controls or transaction characteristics.
Record the chosen methodology, the assumptions used to determine sample size and the selection procedure before inspecting outcomes. Preserve reproducible selection details where the method permits them. Do not keep drawing records until the results look satisfactory or replace difficult items with easier ones.
There is no universal number of invoices that makes every review sufficient. Expected errors or deviations, the level that would be unacceptable, and other planned evidence affect the design. Apply the methodology relevant to the engagement rather than borrowing a sample count from an unrelated checklist.
Treat missing evidence as part of the result
If a selected invoice lacks support, record that fact and decide what alternative work is appropriate. Replacing it because its documents are difficult to obtain changes the selection and can conceal precisely the issue under investigation.
Different failures require different responses. A missing approval, a duplicate liability and an arithmetic difference are not equivalent events. Record the condition tested, the finding and its cause before deciding how it affects the evaluation. Follow the documented method when assessing sample results and any population implications.
Keep transaction value separate from error
Assume one of Bellwater's selected $18,000 invoices lacks an approval record. That establishes an evidence or control issue to investigate, not an $18,000 accounting error. If later work identifies an incorrect charge, determine that difference separately.
Likewise, two exceptions among the 40 targeted invoices do not establish that 5% of all invoices are defective. The targeted group was selected for different characteristics. Report its findings separately from any designed sample of the remainder, and retain the basis for combining evidence into the overall conclusion.
See materiality and control exceptions for how significance assessment follows the evidence, and resolving conflicting evidence for a practical follow-up workflow.
Use verification after the selection decision
OpenAuditor can apply supported checks to submitted items and context. It does not select an audit sample, calculate sample size, project monetary misstatements or establish engagement materiality. Its risk indicators can help direct investigation; they do not create a statistical sampling design.
Keep the selection rationale and population reference outside the request, alongside the returned findings. Preserve comparison records needed for duplicate, cap or history checks even when only selected items are submitted. The batch API guide describes how to submit and retrieve that work without changing the scope your review plan established.