Know how your auditor will pick invoices before the request arrives.

An item reaches the test in one of three ways.

The PCAOB’s AS 1105 names them in paragraph .22: test every item, test specific items, or sample. Specific items are the ones the auditor picks on purpose, such as key items that are large, unusual or risky, or everything over an amount (.25). Those results describe only the items tested and are never projected to the rest (.27). Sampling is what lets a conclusion about 29 items stand for 1,240.

AS 2315, the sampling standard, adds the rule that shapes everything else: every item in the population must have an opportunity to be selected (.24). Its footnote 4 lists the random based methods that meet it, including sampling with probability proportional to size, also called monetary unit sampling. The AICPA’s AU-C 530, used for most private company audits, and the IAASB’s ISA 530 deal with the same subject in their own words. Current guides on preparing for this, like this glossary from Hyperbots, list the steps and stop. So here is one draw, done in full.

Twelve payments, a sample of four.

A software company made twelve supplier payments in the first quarter of 2026, 376,095 in all. The auditor asks for four. Every figure is an example, in US dollars. The last two columns are each payment’s chance of being picked, first by amount alone, then with a risk weight that multiplies the amount by one plus the number of warning flags.

The method is short. Divide the total by the number of items still to pick to get an interval. Anything larger than the interval is a key item, taken outright, and the interval is worked out again on what is left. Then take a random start inside the first interval and step through the payments, laid end to end by amount, one interval at a time. Each point lands in one payment.

Look at the extremes. The 120,000 licence was always going to be tested, under either method. The 3,120 payroll fee had a 3.7 percent chance. And weighting nearly doubled the laptops’ odds, from 26.3 to 48.1 percent, yet this particular draw still missed them. Weighting moves the odds and leaves the choice to the random start, so nobody can know in advance which small items will be skipped.

The number depends on risk more than on volume.

How many items to test is the auditor’s judgement, set by risk, by how much misstatement they can tolerate, and by the errors they expect (AS 2315 .23). Table 1 of the standard says the number of items in the population has virtually no effect on sample size unless the population is very small. The arithmetic agrees. These are the smallest simple random samples with a 95 percent chance of including at least one bad item, assuming none are expected.

Going from 300 payments to 1,240 adds one item at a 10 percent rate. A stricter rate is what doubles the work. The 58 for 1,240 sits close to the standard’s own example in paragraph .41, where 60 items with no deviations support a 5 percent tolerable rate. So a first audit with weak controls should expect more items, because the auditor can rely on less.

Each item needs its own small file.

Once the list of selections arrives, each item is traced from the ledger back to the documents and forward to the cash. The table is a practical starting point. Your auditor’s request list is the one to follow.

A missing document costs more than its own amount. In a test of controls, AS 2315 .40 says an item that cannot be tested is ordinarily counted as a deviation. In a test of balances, .25 lets the auditor treat it as misstated, and asks what the gap says about risk and the integrity of the people involved. A misstatement found in a sample is then projected: the standard’s example in .26 turns 3,000 of errors in 50 of 1,000 items into a 60,000 projected overstatement.

Tie the list before anyone draws from it.

Every sample starts from a list the company produces, and AS 1105 .10 requires the auditor to test that list for accuracy and completeness. So before sending it, tie it to the ledger by count and by total for the period, and keep a frozen copy of the exact file. AS 2315 .17 adds a subtler point: a sample of recorded items cannot find items that were never recorded, which is why auditors also look at payments made after year end to hunt for unrecorded liabilities.

Then leave the selected items alone. A correction posted to a sampled payment after the draw is legitimate, but it changes the evidence the auditor chose, and it needs to be explained rather than discovered. Tell the auditor first.

How Rivane handles a sample today.

Rivane has an Audit Sampling screen for the external auditor, and the draw above came from its code. The auditor describes the test in a sentence, Rivane turns it into a typed test and shows what it understood. Before anything is drawn, it counts the population from the source records and ties count and total to the books. If the population cannot be proven complete, no sample is drawn, and an empty population is reported rather than filled.

# Rivane Audit Sampling, as built.

the test      typed as a sentence ("sample 25
              payment vouchers over 50,000 in
              FY26"), turned into a typed test
              the server validates; nothing is
              drawn from an unvalidated number
population    counted from the source records
              and tied to the books by count
              and total; if it cannot be proven
              complete, no sample is drawn
method        monetary unit, systematic, with
              key items; optional risk weight of
              amount x (1 + flags)
flags         weekend, round amount, last 3
              days of a month, altered at the
              source, no narration, same party
              and amount twice, open anomaly,
              open tax finding
seed          the same seed always selects the
              same vouchers
per item      source voucher, postings, decision
              trail, approvals, attachments
draw hash     each item's evidence is hashed at
              the draw; a later change shows as
              changed since the draw
export        a zip with a manifest, hashes and
              a PDF; external auditor or admin
              only, and each export is recorded

Each selected item opens to its source voucher, its postings, the decision trail and its approvals, with a reason under “Why selected”. The evidence for every item is hashed when the sample is drawn, so a later change shows as changed since the draw instead of passing unnoticed. Every draw is recorded and cannot be edited.

Limits worth knowing. Today the screen samples vouchers from Tally and Oracle Fusion books connected to Rivane, one test covers at most 200 items, and the population for one draw can hold up to 200,000 vouchers. The risk weighted draw is a documented, value weighted selection; on its own it does not support a statistical projection, and the sample size reference shown beside it is for a simple random sample. Choosing the method and the size stays with the auditor.

Prepare for the shape of the sample.

Expect the largest items to be tested outright and every other item to have a fair chance. Tie the population to the ledger before it goes out, keep support filed by transaction so any item can be answered the same day, and leave selected items untouched. Done once for the first audit, that file becomes the template for every year after.

If you would like to see a sample drawn and traced to source in Rivane, book a demo.

Sources

• PCAOB, AS 2315, Audit Sampling. Read in full on the PCAOB site: items examined 100 percent sit outside the sample (.21), every item must have an opportunity to be selected (.24), what happens when support for a selected item is missing (.25 and .40), projecting a misstatement found in a sample (.26), the 60 item example at a 5 percent tolerable rate (.41), and Table 1, where population size has virtually no effect on sample size unless the population is very small.
• PCAOB, AS 1105, Audit Evidence. Read on the PCAOB site: testing the accuracy and completeness of information produced by the company (.10), and the three ways of choosing items, all items, specific items and audit sampling, with key items and items over an amount not projected to the population (.22 to .27).
• Hyperbots, What is Audit Sampling Support? Read as a current answer. It lists the steps, confirm the population, select, collect invoices, approvals, contracts and bank records, and stops before how items are chosen, how many, or what a missing document does to the result.

A note on how this was researched. AS 2315 and AS 1105 were read in full on the PCAOB site, and every paragraph number above comes from that text. AU-C 530 and ISA 530 are named for orientation only; their text was not quoted. The company, the payments and every amount are examples. The draws, the chances of selection and the sample sizes were computed by running the sampling functions from Rivane’s codebase on the example and checked by hand. The Rivane section describes the product as built today, checked against the code rather than marketing copy.

On embedded social posts: we looked for public posts from auditors or standard setters on sample selection and found none we could verify as current, relevant and authentic, so this article uses ordinary citations instead.