CORAA
Log inRun your first audit free
CORAA University / Free sampling template

Internal audit sampling plan generator

Create a fieldwork-ready sampling plan for tests of controls, substantive checks and dual-purpose procedures, with sample basis, population, deviation and conclusion fields.

Sampling plan profile
Procedures
6
Samples
247
High risk
4
Full population
1
Deviation rate
4.5%
Sampling plan
CycleTest areaTypePopulationSource reportExtracted onPopulation ownerFrequencyRiskSample basisMin sampleReplacement ruleDeviationsConclusion
High risk
P2P
PO-GRN-invoice three-way match. Sample 60 from 1240. Deviations: 2.
High risk
O2C
Credit-limit override approval. Sample 40 from 184. Deviations: 1.
High risk
R2R
Manual journal approval and support. Sample 55 from 420. Deviations: 3.
Medium risk
H2R / Payroll
Payroll master change approval. Sample 25 from 96. Deviations: 0.
Medium risk
Inventory
Inventory write-off approval. Sample 25 from 68. Deviations: 1.
High risk
ITGC
Privileged access recertification. Sample 42 from 42. Deviations: 4.
Sampling discipline

Sample plans need auditor judgement

A sample size table does not prove coverage. Internal audit teams still need a complete population, documented selection basis, replacement trail, deviation evaluation and reviewer conclusion before relying on results.

Use this after the RCM builder and before the observation report generator. For recurring tests, pair it with the monitoring rules library.

How an internal audit sampling plan should work

An internal audit sampling plan converts an approved RCM or work programme into specific testing coverage. It should identify the population, source report, risk level, frequency, sample basis, selected sample count, replacement rule and conclusion for each procedure.

The plan is not a mechanical sample-size answer. High-risk controls, prior deviations, incomplete populations, manual overrides and system-access weakness may require larger samples or full-population testing even when a simple formula suggests less.

This generator creates an editable fieldwork plan and export workbook. It is designed for internal audit teams that need a documented sampling basis for P2P, O2C, R2R, payroll, inventory, treasury, compliance and ITGC testing.

Worked example - R2R manual journals

The R2R RCM includes a monthly manual journal approval control. The ERP extract has 420 journals for the quarter, including weekend postings, round-number entries and preparer-approver matches.

Inputs
Population420 journals
RiskHigh
FrequencyMonthly
Output
Sample basisStratified risk-weighted sample
Minimum sample55
The sample includes high-risk strata instead of only random selections. Deviations should be evaluated for cause and effect before converting them into an observation.

Common mistakes

Sampling from an incomplete population
First reconcile the population to the source report, ledger, register or system extract. Sampling an incomplete report gives false comfort.
Replacing samples informally
Every replacement needs a reason and reviewer approval. Otherwise the audit file cannot show that difficult items were not quietly dropped.
Using one sample rule for every control
Control frequency, automation, risk, prior exceptions and transaction value should influence sample design.
Treating every deviation as a final finding
A deviation needs cause, effect, compensating controls and management response evaluation before it becomes a report observation.

Frequently asked questions

What is an internal audit sampling plan?+
It is a fieldwork document that explains which population will be tested, how samples will be selected, how many items will be checked, what replacement rules apply and how deviations will be evaluated.
How many samples should internal audit test?+
There is no universal number. Sample size depends on population size, risk, frequency, control design, automation, prior deviations and auditor judgement. High-risk or small populations may justify full-population testing.
Should internal audit use random or judgemental sampling?+
Both may be appropriate. Random sampling helps reduce bias, while judgemental or stratified sampling is useful for high-value, unusual or risk-flagged transactions. The selected basis should be documented.
Can continuous monitoring replace sampling?+
Continuous monitoring can test full populations for defined rules, but the exceptions still need reviewer conclusion, root-cause analysis and follow-up. Sampling may still be needed for controls that require document or judgement review.

Authoritative sources

ICAI
ICAI IASB - Compendium of Standards on Internal Audit — Applicable from April 1, 2026; includes standards on planning, evidence, documentation, review, reporting and follow-up.
ICAI
ICAI IASB - Standards on Internal Audit publications — Lists SIA 5 Sampling along with the 2026 SIA series on planning, evidence, documentation and review/supervision.
The IIA - Global Internal Audit Standards — The 2024 standards became effective for internal audit functions on January 9, 2025.
Always confirm against the latest version of the source. Regulations evolve and amendments are common.
Related calculators
Internal audit RCM builder →Data request list generator →Monitoring rules library →Observation report generator →CORAA Internal Audit →
Share this tool
Last reviewed: 2026-08-30 · For informational purposes only — not professional advice.