When a peer reviewer asks why the sample size is 62, 'the engine picked them' is not an answer. CORAA renders the SA 530 formula explicitly, sample size equals ceiling of (confidence factor × population value) divided by performance materiality. Confidence factors derive from the Poisson distribution. Selections are seeded, peer reviewers running the same seed obtain identical vouchers.
Two paths to the same audit conclusion. One leaves traces; the other doesn't.
For each Working Paper, the auditor sets the Risk of Material Misstatement, High (95% confidence), Medium (90%), or Low (80%). The confidence factor follows: 3.0 / 2.3 / 1.6 from the Poisson distribution at -ln(α).
Sample size = ceil((confidence factor × population value) / Performance Materiality). Worked example: Trade Payables population ₹5 crore, PM ₹35.8 lakh, high risk = ceil((3.0 × 5,00,00,000) / 35,80,000) = 42 vouchers. The formula is rendered on the Working Paper.
Locking generates the deterministic voucher selection per SA 230 Para. 8. The seed is derived from engagement ID + balance head code. A peer reviewer running the same seed obtains the same vouchers. Locked plans are read-only; unlock requires a documented note.
Every Working Paper renders the sample-size formula explicitly: ceil((Confidence factor × Population value) / Performance Materiality). The confidence factor, the population value, and the PM all show on the page. The auditor can defend the sample size on the spot.
ICAI SA 530 Para A11 + Appendix 3 derives confidence factors from -ln(α) where α is the acceptable sampling risk. High risk → 95% confidence → CF 3.0. Medium → 90% → CF 2.3. Low → 80% → CF 1.6. CORAA renders the math.
Some rows demand 100% testing regardless of sample math, year-end manual journals (last 14 days), related-party transactions, employee benefits over PM threshold. Configure once per engagement; CORAA enforces.
Selection is seeded from a deterministic value: engagement ID + balance head code, hashed via SHA-256. A peer reviewer running the same seed obtains the same vouchers. SHA-256 algorithm and numpy version are pinned, so identical seeds yield identical selections years later.