Sampling Still Matters. But It No Longer Defines Audit. 

Audit has always relied on sampling as a practical way to evaluate large volumes of financial data. But as data has grown, systems have fragmented, and risk has become more complex, that approach is starting to show its limits in ways that are harder to ignore. 

Teams are working harder, spending more time getting comfortable with results, and adjusting how they approach engagements in response to more complex environments. Even with that additional effort, it often takes longer to reach the same level of confidence. At a certain point, the question shifts. 

If more effort isn’t enough, where does the approach itself start to show its limits? 

For many engagements, that question leads back to sampling. 

Sampling has always had a clear purpose 

Sampling is not a shortcut. It’s a practical response to scale. 

Audit has never required reviewing every transaction. It has required forming a reasonable basis for a conclusion using a subset of data that can be tested and evaluated with professional judgment. 

That approach works because it is grounded in a few core assumptions: 

• populations behave in ways that can be represented through selection  

• risk can be surfaced through testing a subset of activity  

• conclusions can extend beyond what is directly tested  

Those assumptions have held up for a long time. And in many cases, they still do. 

Sampling continues to play an important role in audit. 

What sampling was designed for 

Sampling approaches were developed in environments where: 

• data volumes were more constrained  

• financial activity was more centralized  

• risk surfaced in more observable ways  

Under those conditions, selecting and testing a subset of transactions provided a reliable way to understand the broader population. 

The objective was not to see everything. It was to see enough to support a conclusion. 

Where the environment starts to diverge 

That logic becomes harder to apply as the environment changes. 

Across engagements today, teams are working with: 

• larger and more uneven data sets  

• financial activity distributed across multiple systems  

• risk that is less visible at the surface and more embedded in patterns  

In these conditions, the challenge is no longer just selecting items to test. It is understanding how risk behaves across the entire population. 

That is where the tension begins to show. 

Where sampling starts to fall short 

These patterns reflect what many would describe as audit sampling limitations, particularly in environments where risk is distributed across large, complex data sets. The limitations do not appear all at once. They show up in specific situations that are becoming more common: 

• when populations are large but uneven, making representativeness harder to establish  

• when risk is driven by patterns across transactions rather than isolated anomalies  

• when activity spans systems, and context is not visible from a single data source  

• when rare but material behaviors do not surface in a limited selection  

In these cases, the question is not whether sampling was executed correctly. It is whether the sample can fully reflect how risk is actually distributed. 

And increasingly, that becomes harder to answer with confidence. 

What teams are already doing differently 

You can see the adjustment happening in real time. 

Across engagements, teams are expanding how they build their understanding of risk before and during testing. 

They are: 

• using planning analytics to understand populations more broadly  

• looking for patterns across transactions, not just exceptions within selections  

• allowing analysis to guide where effort is applied, rather than relying only on predefined scopes  

• revisiting samples in the context of what broader data reveals  

In some environments, this broader view of financial activity is becoming the starting point for how risk is assessed, not something layered on afterward. 

These shifts are not formal changes to methodology. They are practical responses to the same pressure described earlier in the series. 

The shift isn’t away from sampling 

Sampling hasn’t stopped working. 

But it is no longer the primary way teams build their understanding of risk. 

In more complex environments, it becomes one component of a broader approach—one that combines targeted testing with a wider view of the population. 

That shift is subtle, but it changes how audit work is approached. 

The question is no longer just what to select. 

It is how to understand the population well enough to know what matters before selection even begins. 

What this changes 

When that broader understanding comes earlier, the rest of the engagement begins to move differently. 

• Planning becomes more focused. 

• Testing becomes more targeted. 

• Review becomes more about interpretation than reconciliation. 

Effort is no longer spread evenly across uncertainty. It is directed toward where risk is most likely to exist. 

This does not replace existing practices. It reframes how they are used. 

Where the conversation is heading 

As audit teams continue adapting to more complex environments, one thing is becoming clearer: 

Sampling still plays a role, but it is no longer the primary lens through which risk is understood. 

That shift starts within audit, but it does not stay there. 

Because once teams have a clearer, more complete view of financial activity and risk, their role begins to shift—from validating what happened to interpreting what it means. 

This is part of an ongoing series exploring how audit is evolving as data, complexity, and expectations increase—and how firms are beginning to respond with more advanced, data-driven, and technology-enabled approaches. 

→ Start from the beginning: Busy Season Didn’t Get Harder. The System Did.
→ Previous: Doing More With Less Isn’t a Strategy Anymore. It’s the Constraint 
→ Next: Where Audit Insights Start Creating Broader Client Value 

We’ll be continuing this conversation in the lead-up to AICPA Engage, where these shifts are becoming more visible across the profession. 

Learn more about our presence at AICPA Engage. 

Frequently Asked Questions