Audit Sampling and Objective Evidence: How Auditors Reach Defensible Conclusions
How experienced auditors decide what to sample, how much evidence is enough, and how to defend a conclusion
Key takeaways
- An audit is always a sample. The quality of the conclusion depends on how the sample was chosen.
- ISO 19011 describes two approaches: judgement-based sampling and statistical sampling. Most management system audits use judgement-based sampling.
- Good samples follow risk: critical processes, recent changes, complaints, new staff, night shifts and previous findings.
- Objective evidence must be verifiable: records, observations and interviews that can be repeated by another auditor.
- Triangulation, confirming one source with another, turns impressions into defensible findings.
1. Why sampling matters
No auditor can check every record, every shift and every product in the time available. Whatever the audit concludes is based on a sample. If the sample is chosen badly, for example only records the auditee offers, only day shift, or only the best-performing line, the conclusion can be confidently wrong.
2. Two sampling approaches
| Approach | How it works | Strengths | Limitations |
|---|---|---|---|
| Judgement-based | The auditor selects samples using knowledge, risk and previous results | Flexible, focuses on what matters, fits management system audits | Conclusions cannot be extrapolated statistically to the whole population |
| Statistical | Samples drawn randomly with a defined sample size and confidence level | Results can be generalised with known confidence | Needs large, homogeneous populations and more time |
For management system audits, judgement-based sampling is the norm. What makes it credible is that the auditor can explain why each sample was chosen.
3. Choosing samples by risk
Good auditors build samples around questions such as:
- Which processes have the highest impact on product safety, quality or legal compliance?
- What changed since the last audit: products, equipment, suppliers, people, systems?
- Where do complaints, nonconformities and KPIs show weakness?
- Which areas were not covered last time?
- Are there differences between sites, shifts, lines or product groups?
A practical rule: let the auditee show you the system, then you choose the samples. Ask for the full list (e.g. all deliveries last month, all training records for the packing team) and pick from it yourself.
4. How much evidence is enough?
There is no fixed number, but these principles help:
| Situation | Typical approach |
|---|---|
| Stable, low-risk process with good history | A few samples confirming consistency |
| Critical control or high-risk process | Larger sample covering different dates, shifts and operators |
| First sample shows a problem | Expand the sample to judge whether it is isolated or systemic |
| Records look “too perfect” | Compare with observation, raw data and other sources |
When the first samples reveal a deviation, the auditor should look further before writing a finding: one late record is a different finding from a systematic failure to record.
5. What counts as objective evidence
Objective evidence is data supporting the existence or truth of something. In practice it comes from three sources:
- Records and documents: dated, identifiable and traceable to the activity.
- Observation: what the auditor sees happening, at a stated place and time.
- Interviews: statements by people doing the work, ideally confirmed by records or observation.
Evidence should be recorded precisely enough that another auditor could find it again: document number, batch, date, location, person’s role.
6. Triangulation
Triangulation means confirming a conclusion from more than one source. For example:
- The procedure says metal detector checks are done hourly (document).
- The record shows hourly checks on the sampled dates (record).
- The operator explains and performs the test correctly (interview and observation).
When the three sources agree, the conclusion is strong. When they disagree, for example perfect records but an operator who cannot perform the test, the disagreement itself is the finding to investigate.
7. Sampling across a multi-site or integrated system
- Cover each standard’s specific requirements as well as the shared processes.
- Rotate sites and processes across the audit programme so that everything is covered over the cycle.
- Record the sampling rationale in the audit plan so it can be reviewed.
8. Common mistakes
- Accepting the samples the auditee prepares.
- Sampling only day shift or only the main line.
- Writing a finding from one weak example without checking whether it is systemic.
- Recording vague evidence such as “records were reviewed”.
- Never sampling records from the start of the period, when problems are often hidden.
Conclusion
Sampling is where audit skill shows. A well-chosen, risk-based sample, clear objective evidence and triangulation between documents, records, observation and interviews produce conclusions that management can trust and that withstand challenge.
In your next audit, write one sentence in the plan explaining why you chose each sample. It will change how you audit.