ISO Audit Group / Evidence

Sampling that could actually find something

A sample chosen for convenience finds convenient results.

Audit conclusions rest on samples, and the sample determines what can be found. Records selected by the auditee, or taken from the front of a folder, or drawn from a period the organisation nominated, cannot support a general conclusion.

The sample should be selected by the auditor from the full population, and the auditor should see the population rather than a list of it. Being shown twelve files is different from choosing twelve from a register of four hundred.

Stratification is worth the effort. Sampling across shifts, sites, product lines and periods finds variation that a sample from one area cannot, and variation is usually where the finding is.

Deliberately including the awkward cases is what distinguishes a searching audit: the rushed job, the one that went wrong, the period when the usual person was away. Those are where a system is actually tested.

The sample and its basis should be recorded, because a conclusion is only as strong as the sample it rests on, and an auditor who cannot describe how records were chosen has produced an anecdote.

There is a further sampling consideration for processes that run infrequently. An annual management review or a rare product recall cannot be sampled meaningfully, and the honest treatment is to examine the whole population rather than to sample one and generalise.