CORAA
Full-population testing · built for auditors· 100%

You signed on a 2% sample. The exception was in the other 98%.

Sampling under SA 530 is a legitimate basis for a conclusion — but it tests what manual review can reach and infers the rest. CORAA reads 100% of the population — every ledger, every voucher, every journal — and tests each row against a defined rule set, instead of inferring from a 2-5% extract. That's full coverage of the rule-based and analytical checks it runs, not a claim of blanket assurance. Findings are ranked by SA 320 materiality, with qualitatively material and fraud-risk items surfaced regardless of size. The auditor decides; the engine does the work.

The 2% vs 100% question

Coverage isn't a sample size — it's how much you can defend.

2% reaches 2%

A representative sample lets you infer about the whole, but the line you never opened is the line you can't speak to. Sampling answers 'on average'; a peer reviewer asks 'and this one?'

100% reaches every row

Reading the full population means each ledger, voucher and journal entry is tested against the rule set — checks like duplicate or round-sum journals near cut-off, ITC claimed on blocked credits under §17(5), TDS short-deduction and 269SS/T breaches — including the outliers a small sample is statistically likely to miss.

Calm by design

Full coverage without full noise: findings are ranked by SA 320 materiality, so testing everything doesn't mean flagging everything. Qualitatively material and fraud-risk items — SA 240 journals at period-end, related-party flows, override patterns — surface regardless of size, and immaterial items are still retained and totalled so an aggregate breach can't slip past.

Sampling, when you choose it

Coverage is a default, not a dogma. Full-population testing extends coverage where the data and the assertion allow; sampling stays valid where you choose it. Where you deliberately sample, the engine runs Monetary Unit Sampling to SA 530 — sample size per ICAI guidance, seeded selection, statistical evaluation.

What the engine does

Every row read, every choice recorded — and shown on its working.

01

100% population testing

Reads and tests the whole population — every ledger, every voucher, every journal — against a defined rule set, instead of a 2-5% sample. No line is assumed to behave because a neighbour did. This is 100% coverage of the rule-based and analytical checks it runs — not a substitute for substantive judgement on estimates or third-party evidence like confirmations and existence.

02

Interactive at engagement scale

A client's whole year is tested while you're still reasoning about the engagement, not in an overnight batch — and it scales to your largest ledger. The bottleneck we remove is reaching the full population, not raw query speed.

03

SA 530 sampling, by the book

When sampling is deliberately chosen, Monetary Unit Sampling applies: sample size per ICAI guidance, seeded selection, statistical evaluation of the result — a legitimate basis for a conclusion, not a shortcut.

04

Deterministic & reproducible

Same file in, same flags out. The run is deterministic and re-performable under SA 230 — re-run a file and you get the same findings, with no silent drift between drafts. (Seeded selection, where reproducibility of a chosen sample matters, applies inside SA 530 sampling.)

05

Materiality-gated under SA 320

Flags are ranked and triaged by SA 320 materiality, but qualitatively material and fraud-risk items surface regardless of size, and immaterial items are retained and totalled so an aggregate breach is still caught. Coverage goes wide; attention stays focused on what could change the opinion.

06

Built for messy real-world data

Drop in the files a real Indian engagement arrives in — Tally and Excel exports, GST returns, ledger dumps — no pre-cleaning. Blank or garbled GSTINs and PANs, amended documents and multi-registration clients are read as they actually are. Items that can't be cleanly resolved are surfaced for your judgement, not silently dropped.

Defensibility

When the reviewer asks how you know — the file already answers.

A re-performable SA 230 trail

Every flag is timestamped, cites the rule it applied, and traces to the source row it came from — exportable straight into the working-paper file. The trail is the evidence, not a screenshot of it.

Traced to the source row

No finding floats free of its data. Click from the conclusion back to the exact voucher or ledger line, so a qualification is qualified, not assumed.

Reproducible under inspection

Because the run is deterministic, a peer reviewer or NFRA inspector can re-run the same file and land on the same findings — the strongest answer to 'show your working'. For sampled procedures, the printed seed reproduces the selection too.

The auditor owns the opinion

The engine surfaces, traces and evidences; it does not sign. Every flag is a prompt for professional judgement, and the partner's conclusion governs what reaches the report.

Who it's for

From the article's first tie-out — to the partner's signature.

The article assistant

Stop keying a sample by hand and hoping it's representative. The full population is tested in seconds, each exception traced to its row, so your time goes to judgement instead of data entry.

The audit manager

Review against the whole population, not a 2% extract — and see why each item flagged, with the rule cited and the source row attached. One versioned rule set means every office tests the same control the same way, so coverage is consistent across engagements and you can stand behind it in the file review.

The engagement partner

Sign on coverage you can defend in peer review, QRB and NFRA inspection: a re-performable SA 230 trail, SA 320 materiality ranking, and SA 530 sampling where you chose it. It's exhaustive analytical coverage of the rules it runs — not a substitute for substantive judgement on estimates — and your opinion still owns the conclusion.

By the numbers
coverage of the rules it runs
100%
Every ledger, voucher and journal tested — not a 2-5% sample.
tested per engagement
Whole year
Interactive, not an overnight batch — scales to your largest ledger.
compliant sampling on demand
SA 530
MUS by the ICAI formula, seeded and statistically evaluated.
re-performable trail
SA 230
Deterministic, seed printed, traced to source — exportable.
Questions, answered

What auditors ask before they trust full-population testing

Sampling under SA 530 remains a legitimate basis for a conclusion, and CORAA supports it: where you deliberately choose to sample, it runs Monetary Unit Sampling — sample size per ICAI guidance, seeded selection and statistical evaluation. Full-population testing simply removes the need to sample purely because manual review couldn't reach the whole file; it extends coverage where the data and assertion allow. You choose the approach per engagement.
No — coverage and noise are separated. Findings are ranked by SA 320 materiality, so you read the material movements first. Immaterial items aren't discarded: they're retained and totalled so an aggregate breach still surfaces, and qualitatively material or fraud-risk items (SA 240 — period-end journals, related-party, override patterns) surface regardless of size. You test everything; you read what matters, in the order it matters.
Every flag is timestamped, cites the rule it applied and traces to the source row, exportable into the working-paper file under SA 230. The run is deterministic and the seed is printed, so a reviewer can re-perform it and reach the same result. Defensibility comes from a re-performable trail, not from a claim.
That's the data it's built for. Blank or garbled GSTINs and PANs, amended documents and multi-registration clients are read as they actually arrive. Items that can't be cleanly resolved are surfaced for your judgement rather than silently dropped.
Data is hosted in India and handled in line with the DPDPA, on infrastructure built to ISO 27001 controls — a controls-alignment statement, not a certification claim; current certification status is available on request. Your client data is never used to train models. The platform is a tool that runs on your engagement data, not a pool that learns from it.
The auditor. CORAA tests the population, traces findings and assembles the evidence — but the engine does the work and the auditor decides. Every flag is a prompt for professional judgement, and the partner owns the opinion that reaches the report. The tool assists; it does not sign.
See it on your own file

Stop inferring from 2%. Test the whole population.

Bring a real ledger and watch CORAA test 100% of it in seconds — materiality-gated, traced to source, and re-performable under SA 230. The auditor decides; the engine does the work.