For decades, sampling was the reasonable answer to a time problem. Nobody could review tens of thousands of journal entries or user accounts by hand, so a selection was drawn with a defensible method and the result was extrapolated. For most processes that live in a system, that limit is no longer technical.
The Global Internal Audit Standards, effective since 9 January 2025, address it in their considerations for implementation. On gathering information, Standard 14.1 asks auditors to consider whether to test a complete data population or a representative sample. Standard 14.2 adds that internal auditors should understand and use technologies such as software that enables testing of an entire population rather than just a sample.
The gap between that sentence and practice is still wide. In Vision 2035, the IIA's global study with 6,506 responses gathered between February and March 2024, only 25% have data analytics implemented at a high level, and 27% continuous monitoring. At the same time, 91% consider data analytics extremely or very important for the future of the profession.
What changes in fieldwork
Testing the entire population is not doing the same thing with more rows. It changes the order of the work.
- Data access moves into planning. If the extraction depends on someone in IT finding a free slot, the engagement starts late. Standard 14.1 contemplates directly accessing systems or extracting data, and that is worth agreeing before the engagement opens, not during it.
- The cut-off date is set and written down. A complete population is complete as of a date and for a period. The Standards themselves list, as evidence of conformance, a description of the information with its source, the date it was gathered and the period it relates to.
- The criterion is defined before running. With a sample, the auditor adjusts judgement case by case. With the whole population, the rule has to be written first, because the rule is what classifies. Changing it after seeing the result is looking for the number you wanted.
- Exceptions are handled in batches. A full test can return hundreds of exceptions, and most of them are not findings. They need to be grouped by cause, the ones explained by evidence set aside, and the rest taken into analysis. Without that step, volume buries what matters.
- What could not be evaluated is stated. Records missing the key field, a system that could not be extracted, a missing month. Standard 14.1 requires that, if relevant evidence cannot be obtained, the auditor determines whether that situation is itself a finding.
Complete when the data allows it
A complete population is not a promise. It is what gets tested when the data exists, is reliable and can be extracted.
There are processes where sampling is still the sensible choice. Manual controls with no record, evidence scattered across emails, data from a system whose governance does not deserve trust. Standard 14.1 notes that information is more reliable when it comes from a system with effective governance, risk management and control processes. If the source is not, reviewing every record proves nothing.
That is why the shift is not decided for the whole plan at once. It is decided test by test, with one question about the data and another about the criterion. When both have an answer, sampling stops being the default and starts needing a justification.
A good starting point is a control that is sampled today and lives entirely in systems. Matching staff leavers against active accounts is the classic example, and the tests that leave evidence on access show where to start reviewing all of them.
