Nobody can check every record in a management system audit, so every audit is a sample. The question is whether the sample was chosen so that a reader can trust the conclusion. In financial audit, sampling has tables and formulas. In management system audits it is usually judgement, which makes the reasoning more important, not less.
Last reviewed: 17 October 2026. Facts checked. This post describes general practice. We did not open ISO 19011 or any certification body's sampling rules, and we did not find any single required sample size for management system audits; do not expect one. We have deliberately not invented numbers. Where a customer, scheme or certification body sets a requirement, follow theirs.
Why this differs from financial audit sampling
A financial auditor often tests a population of similar transactions and wants a statement about error rates, so statistical methods help. A management system auditor is asking different questions: is the process defined, followed and effective? The evidence is mixed: interviews, observed work, records of varied kinds. Populations are small and unlike each other. A statistical sample of eleven training records says little about whether the training process works.
So the sample is chosen to give coverage and to test where failure is most likely. For the financial side, see the logic behind SOX test sample sizes and sampling versus full testing.
The principle: the sample must represent the audit scope
The risk-based thinking in audit guidance leads to a few questions to ask before sampling:
- What is in scope? Processes, sites, shifts, products, time period.
- What is the risk? Where would a failure hurt customers, safety, legal compliance or the certificate?
- What changed? New process, new equipment, new staff, new supplier, recent complaint.
- What did the last audit find? Previous findings and their closure.
The sample should spread across the scope and lean towards the answers to questions 2 to 4.
Three layers of sampling
Layer 1: processes and sites. In a short audit you will not reach every process in depth. Decide which processes get full attention, which get a lighter pass, and which wait for the next audit in the programme. Make that choice explicit. A multi-site organisation usually cannot have every site audited every time; the plan should show how coverage rotates.
Layer 2: records within a process. Pick a period and take items across it, not only the most recent. Include some from different shifts, products or customers. Include awkward cases: rejected items, late deliveries, cancelled orders, concessions.
Layer 3: people. Interview across levels and roles, including those new to the job and those who work on nights or at remote locations.
Trace one thing end to end
A method that works well and needs little arithmetic is the trace. Choose one real item and follow it through every process it touches: an order, a complaint, a purchase, a maintenance job, a new hire. At each step ask to see the record and the person who did the work.
One trace covers several processes at once and shows whether the handoffs work. Three or four traces across different areas tell you more than a long list of unconnected record checks. Our eight-week preparation plan uses the same approach to find gaps before the certification audit.
How to select, in practice
- Mix random and targeted. Some items picked blindly, so the auditee cannot arrange them in advance; some picked because they are high-risk.
- Let the auditee not choose. If the sample is chosen by the process owner, expect the best examples. Ask for a list, then choose.
- Expand when you find a problem. One missing calibration label could be a one-off. Look at more. If three of five are missing, you have a pattern; if the sampling widened and everything else was fine, record that too.
- Do not stop at the first confirmation. A good record in one area does not clear another.
Recording the sample
The report should let a reader see what was done. For each process, note what was sampled, how it was chosen, what period it covered and what was found. Typical notes are brief: "Reviewed eight maintenance work orders from April to September across two lines, selected from the system list including three emergency jobs. All had completion sign-off; two lacked a spare parts record."
This does two things. It protects the auditor if a later problem appears in an area not sampled, and it lets the next audit pick different items. Without it, the same easy records get reviewed every year.
What to say about coverage
Be honest in the conclusion. Audit evidence is a sample, and the report should say so. Typical wording: the audit was based on sampling, so nonconformities may exist that were not identified. That is not a hedge to avoid responsibility; it is a true description of the method. Do not claim "the system is compliant" when you mean "in the areas and records sampled, no nonconformity was found."
Sampling when data is available in full
Where the organisation holds complete electronic data, such as a full list of purchase orders or access logs, you can sort and filter the whole population to choose items or test everything for a specific condition. This raises a point that applies in financial audit too: full-population testing changes what a sample is for. In a management system audit you still need to talk to people and see work, so data narrows the sample rather than replacing it.
An invented example
An auditor has one day for the purchasing process of a food packaging firm. She asks for the list of approved suppliers and the last twelve months of purchase orders. She picks six orders: two from the supplier with a recent complaint, two from newly approved suppliers, one emergency order and one random. For each she checks supplier approval, specification, receipt inspection and payment. Five are clean. The emergency order was placed with an unapproved supplier. She extends to all emergency orders in the year and finds four out of nine the same way. The finding is about how emergencies bypass the approved list, supported by a stated sample and its extension.
The takeaway
Sampling in management system audits is judgement made visible. Cover the scope, lean towards risk and change, trace real items end to end, widen when something looks wrong and write down what you looked at. Then say plainly that the conclusion rests on a sample.
Last reviewed: 17 October 2026. Facts checked. Opened: nothing new for this post. Could not open: ISO 19011, certification body sampling rules or any scheme rule on minimum samples. No sample sizes, percentages or audit-day figures are given; the example is invented.
Statutory facts on this page are checked against their sources, and the page says where it relied on secondary reporting. How we verify · Report an error