# Standards and Regulatory References — Audit Sampling Methods

## International Auditing Standards

### ISA 530 — Audit Sampling
- **Paragraph 5**: Definition of audit sampling and sampling risk
- **Paragraph 7**: Statistical vs non-statistical sampling approaches
- **Paragraph 8**: Sample design, size, and selection
- **Paragraph 11-12**: Performing audit procedures and evaluating sample results
- **Paragraph 14**: Nature and cause of deviations — each deviation must be investigated

### ISA 500 — Audit Evidence
- **Paragraph 6-7**: Sufficiency and appropriateness of audit evidence
- **Paragraph A14-A25**: Reliability of evidence and sampling considerations
- Requires auditor to determine means of selecting items for testing

### ISA 520 — Analytical Procedures
- **Paragraph 5**: Use of analytical procedures alongside sampling to corroborate findings

## Institute of Internal Auditors (IIA)

### IIA Practice Advisory 2320-3 — Audit Sampling
- Provides guidance on selecting and applying sampling methods in internal auditing
- Covers statistical and non-statistical approaches
- Emphasises documentation of sampling methodology and rationale

### IIA Standard 2310 — Identifying Information
- Internal auditors must identify sufficient, reliable, relevant, and useful information to achieve engagement objectives
- Sampling is a key technique for information gathering

### IIA Standard 2320 — Analysis and Evaluation
- Engagement conclusions must be based on appropriate analyses and evaluations
- Sampling results must be properly evaluated and extrapolated

## ISO Standards

### ISO 19011:2018 — Guidelines for Auditing Management Systems
- **Clause 6.4.4**: Collecting and verifying information — sampling as a data collection method
- **Annex A.7**: Guidance on audit sampling approaches

### ISO 2859-1 — Sampling Procedures for Inspection by Attributes
- International standard for attribute sampling plans
- Provides sample size tables by acceptable quality level (AQL)
- Applicable to compliance testing in privacy audits

## Data Protection Context

### GDPR (Regulation (EU) 2016/679)
- **Article 5(2)**: Accountability — sampling results serve as evidence of compliance monitoring
- **Article 39(1)(b)**: DPO monitoring compliance through audits (including sampling-based testing)
- **Article 58(1)(e)**: Supervisory authority power to obtain access to data and premises for investigations (sampling expectations)

### EDPB Guidelines on DPO Role (WP 243 rev.01)
- DPO should use risk-based sampling approaches when monitoring compliance
- Sampling depth should reflect the risk level of processing activities

### ICO Audit Framework (UK)
- Uses sampling extensively in regulatory audits
- Expects organisations to demonstrate compliance through representative testing
- Sampling methodology should be documented and defensible

### CNIL Control Methodology (France)
- Regulatory inspections use both targeted and statistical sampling
- Organisations should anticipate sampling-based verification of processing records