An audit sample is a subset of items selected from a complete population so an auditor can test a control or balance and draw a conclusion about the whole population without examining every item.
In a SOC 2 Type 2 examination, the population is usually every occurrence of a control during the audit period, such as every production change, every new hire, or every quarterly access review. The auditor selects some of those occurrences and checks whether the control operated as described for each one.
In simple terms, an audit sample answers:
- What is the full set of items the control applies to?
- Which of those items will the auditor test?
- Did the control work on every item tested?
Why Audit Samples Matter
Testing every item is often impractical. Sampling lets auditors reach a conclusion with reasonable effort, but only if the population is complete and the sample is representative.
Audit samples matter because:
- A single failed sample can become a reported deviation, or exception, in a Type 2 report.
- An incomplete population can undermine the test, even if every sample passes.
- Teams that know how samples are selected can keep evidence ready for any item, not just a few.
How Audit Sampling Works
A typical sampling flow looks like this:
- Define the control and attributes. The auditor decides what must be true for each item, such as approval before deployment.
- Obtain the population. The organization provides a system-generated list of every occurrence in the period.
- Test completeness. The auditor checks that the population is complete and accurate, for example by comparing it to another source.
- Select the sample. The auditor picks items using random, systematic, haphazard, or judgmental selection.
- Test each item. The organization provides evidence for each selected item.
- Evaluate results. The auditor considers any deviations and decides what they mean for the control.
Professional guidance on sampling appears in the AICPA standards, including AU-C section 530, Audit Sampling, and the AICPA Audit Guide on audit sampling. See the AICPA for current guidance.
Sample Size
SOC 2 does not set a fixed sample size. Each audit firm applies its own methodology, which usually considers:
- How often the control operates, such as annually, quarterly, monthly, weekly, daily, or many times per day
- Whether the control is automated or manual
- The risk the control addresses
- How many deviations the auditor is willing to tolerate
Automated controls are sometimes tested with a smaller sample plus evidence that the configuration did not change during the period. Ask your auditor for the sample sizes they plan to use rather than relying on generic tables.
Audit Sample vs Related Terms
| Term | Primary job | How it relates |
|---|---|---|
| Population | The complete set of items in scope | The sample is drawn from it |
| Audit sample | The subset selected for testing | What the auditor actually examines |
| Audit evidence | Records that support a conclusion | What you provide for each sampled item |
| Audit period | The time window under review | Defines which items belong in the population |
| Exception management | Track and resolve deviations | How teams handle sampled items that failed |
Evidence Themes Auditors May Expect
Auditors set their own procedures, but sampling requests commonly include:
- A complete, system-generated population with dates, IDs, and owners
- The query, report, or export used to produce the population
- Evidence for each selected item, matched to the control attributes
- Explanations for any item that does not meet the control, with remediation if applicable
Common Failures
- Populations built by hand instead of exported from the system of record
- Populations that miss a system, repository, or part of the period
- Evidence that exists for some items but not all
- Approvals or reviews dated after the action they were meant to authorize
- Control descriptions that promise more than the team actually does
How AuditFlo.co Helps
AuditFlo.co helps teams retain continuous evidence collection and audit-period history for operational artifacts when those records are stored or linked through connected systems and workflows your team already uses, such as GitHub and Jira.
For sampling, that can mean dated records for each occurrence are already organized when the auditor selects items. AuditFlo.co does not select samples, does not perform testing, does not issue SOC 2 reports, does not certify compliance, and does not replace auditors.
To see the workflow for your stack, request a demo.
Key Takeaway
An audit sample is the subset of a complete population that an auditor tests to reach a conclusion about a control. SOC 2 sets no fixed sample size; your auditor's methodology does. The practical work for your team is a complete, system-generated population and evidence ready for any item that could be selected.