The Sample That Was Too Convenient
You are auditing travel and subsistence payments at a Bulgarian regional health inspectorate for the first half of the year. The population is 1,240 payment orders. Your colleague proposes testing 'the 30 largest payments plus the 10 files the finance director volunteered', because the finance director says those 10 show how well the new procedure works. During fieldwork you find that 4 of the volunteered files are missing the required prior authorisation, and that the payment system allows an order to be split into two below the threshold that triggers secondary control. The finance director tells you the split payments are 'a technicality' and asks you to keep them out of the report because they are being fixed. Your working papers so far consist of a spreadsheet with amounts and a note saying 'files reviewed'.
1. Critique the sampling approach and explain what a defensible sample would look like here, given the population and the risks identified.
Read the worked answer
The proposed sample is not defensible. Selecting the 30 largest payments is judgemental selection biased toward high value and says nothing about the routine population where control failures are most likely; accepting 10 files chosen by the auditee is worse, because the auditee controls which files are seen, and the fact that 4 of 10 failed shows the selection was not even flattering. A sample chosen by the auditee cannot support a conclusion about the population.
The split-payment indicator is the key discovery: it is a fraud/error red flag that should reshape the sampling. The right approach is to combine a statistical or structured random sample across the whole population with targeted testing of the specific risk. Concretely: define the population precisely (1,240 orders, period, system extract, reconciled to the ledger), take a random sample sized to support the conclusion you intend to draw, and separately extract all pairs of payments to the same beneficiary, same trip or same dates that fall just below the secondary-control threshold, and test 100% of those. Stratify by value if you want coverage of large items, but do not let stratification replace random selection.
Document the method: population definition, extract date, random-number or systematic selection with seed, sample size rationale, and how exceptions are projected. The four failed volunteered files should be treated as indicative and followed up by testing the authorisation control on a random basis, not reported as a rate from a biased sample.
2. The finance director asks you to omit the split payments from the report because they are being corrected. How do you handle this, and what must the working papers contain before you draft?
Read the worked answer
The request must be declined. Whether a matter is reported is an audit judgement based on significance and evidence, not on the auditee's preference or on a promise of correction. Correction is relevant to the recommendation and to follow-up, not to whether the finding appears. Omitting a known control weakness at management's request would breach objectivity and the requirement to report significant matters; if the director's position is that the practice is legitimate, the route is to give management a chance to provide evidence and to include their response in the report, not to suppress the finding.
Substance of the finding: the payment system permits splitting an order to stay below the secondary-control threshold. That is a design weakness in the control, regardless of whether any individual case involved intent. The report should describe the mechanism, the value and number of cases identified, the control bypassed, the risk (loss, irregularity, circumvention of oversight), and recommend a system or procedural fix plus retrospective review of the identified cases. If indicators of intent exist, apply the unit's fraud protocol and escalate rather than resolving it inside a routine compliance report.
The working papers are currently inadequate. Before drafting they must contain: the reconciled population extract; the selection method and evidence of randomness; for each tested item, the file reference, the attribute tested, the result and the evidence seen (authorisation date, signatures, amounts, system screenshots); the full list of split-payment cases with the matching logic used; a record of the management discussion including the request to omit and your response; and reviewer sign-off. A spreadsheet of amounts plus 'files reviewed' cannot support any conclusion and would fail an internal or external quality review.