Can AI Select an Audit Sample? Document and Defend It

AI can help you select an audit sample, but the selection itself should come from a seeded, repeatable method (random numbers, systematic with a random start, or monetary unit sampling), not from a chat model choosing items. Document the population, method, seed, size rationale and results so a reviewer can re-run it and get the same list.

That is the whole difficulty. Ask a chatbot for "30 representative invoices" and you get a different 30 each time, with no way to show that every item had a chance of selection. Use the AI instead for the work around the selection: writing the script, cleaning the population, drafting the working-paper wording, and checking your memo against a list of reviewer questions.

Follow me on Instagram@sagnikteaches

What the standard asks, in plain terms

ISA 530 (Audit Sampling) is the international standard that covers this. Reading its text as published by national adopters, a few points matter for a small practice. They are worth knowing before any tool is involved, because they tell you what a reviewer will test.

Connect on LinkedInSagnik Bhattacharya

• Every sampling unit needs a chance of selection. The auditor selects so that each unit in the population has a chance of being picked. That rules out choosing only items that look interesting, unless you are deliberately testing a defined group (such as all items above a value) and say so.
• Statistical means two things. Random selection, and probability theory used to evaluate the results, including sampling risk. A sample that lacks either is non-statistical. Both are acceptable; what matters is that you design, select and evaluate consistently.
• Sampling units can be items or money. An invoice, a bank credit or a debtor balance can be the unit, or each dollar can be (monetary unit sampling).
• Tolerable misstatement drives size. You set an amount, linked to performance materiality, that addresses the risk that small misstatements add up. A smaller tolerable amount, lower acceptable sampling risk or higher expected error all push the sample size up.
• The standard lists selection methods in an appendix. Random, systematic, monetary unit, haphazard and block selection are all described. Two warnings sit in that appendix: haphazard selection is not appropriate for statistical sampling, and block selection (a run of consecutive items) would rarely support a conclusion about the whole population. Read it for the definitions your firm relies on.

Its requirements govern what you do, not which tool you use; the appendix even describes random selection as applied through random number generators. So "ISA 530 still accepts sampling" in an AI world simply means the obligations are unchanged. Documentation more generally follows ISA 230, which expects the file to let an experienced auditor with no prior connection to the engagement understand what you did.

Subscribe on YouTube@sagnikteaches

Why asking the model to pick the items fails the reviewer test

Imagine the reviewer opening your file and asking three questions. How do you know the population was complete? How do you know every item could be selected? Could I get the same sample by repeating your steps? A chat-selected sample fails all three. The model cannot see your ledger's control total, tends to favour descriptive or unusual lines, and cannot return the same list on demand. It can also output invoice numbers that do not exist if your extract is long.

There is a second, practical reason. The population contains client names, amounts and bank details. Selecting locally with a script or spreadsheet keeps that data on your machine. The AI only needs to see the column headers and a few dummy rows to write the code.

A purchase-invoice population for a specialist food importer

An illustration with made-up numbers. A small practice audits a specialist food importer. The purchase ledger extract holds 1,842 invoices totalling $4,380,000. The partner sets tolerable misstatement for this test at $120,000. The firm's methodology uses monetary unit sampling (MUS), where each dollar of the population is a unit and larger invoices are therefore more likely to be picked.

The working steps look like this.

1. Prove the population is complete. The extract total ($4,380,000) agrees to the ledger control account. If it differs, stop and explain the difference before any selection.
2. Choose the reliability factor. For a 95% confidence level and no expected errors, MUS tables commonly use 3.0. Use the factor in your firm's own table, not one suggested by a chatbot.
3. Compute the sampling interval. Interval = tolerable misstatement divided by reliability factor = $120,000 / 3.0 = $40,000. The rough sample size is the population value divided by the interval: $4,380,000 / $40,000 = 109.5, so about 110 items.
4. Take out key items. Any invoice of $40,000 or more will be selected whatever the method, so test them all. Say 14 invoices total $1,020,000. That leaves $3,360,000.
5. Select from the rest. $3,360,000 / $40,000 = 84 interval hits. With a random start, every $40,000 step along the cumulative list picks the invoice that contains it.
6. Total items to test: 14 key items plus 84 sampled items, 98 in all. It is fewer than 110 because the key items cover about 25.5 intervals of value by themselves.

The random start comes from the seed you write in the file. For example, Python's random module with seed 20261104 gives a start of $29,628, so the first pick is the invoice containing the 29,628th dollar of the cumulative list, then 69,628, then 109,628, and so on. Anyone with your extract, the seed and the interval gets the same 84 picks.

The script a reviewer can re-run

Ask the AI to write this from a description, then read it line by line yourself. The version below was run on a test file of 1,842 rows. The population file needs columns for reference, date, supplier and amount.

import csv
import random

SEED = 20261104          # write this in the working paper
TOLERABLE = 120_000      # tolerable misstatement
FACTOR = 3.0             # reliability factor from your firm's table
interval = TOLERABLE / FACTOR

with open("population.csv", newline="") as f:
    rows = list(csv.DictReader(f))       # columns: ref, date, supplier, amount
for r in rows:
    r["abs_amount"] = abs(float(r["amount"]))

key_items = [r for r in rows if r["abs_amount"] >= interval]
rest = [r for r in rows if r["abs_amount"] < interval]

start = random.Random(SEED).uniform(0, interval)
selected, running, next_hit = [], 0.0, start
for r in rest:
    running += r["abs_amount"]
    if running >= next_hit:
        selected.append(r)
        next_hit += interval            # an item below the interval is hit once at most

print("population", len(rows), "key items", len(key_items),
      "interval", interval, "start", round(start), "sampled", len(selected))
with open("selection.csv", "w", newline="") as f:
    w = csv.DictWriter(f, fieldnames=list(rows[0].keys()) + ["basis"])
    w.writeheader()
    for r in key_items: w.writerow({**r, "basis": "key item"})
    for r in selected:  w.writerow({**r, "basis": "interval hit"})

Two details matter. The script takes absolute values so credit notes can be selected, and it walks the rows in the order they arrive, so you must file the extract, in that order, with the script. Change the row order and the same seed gives a different list.

Doing the same in Excel without a script

Some practices prefer a spreadsheet, which is fine if the steps are visible. Copy the items below the interval to their own sheet (the 14 key items are tested in full elsewhere), with references in column A and absolute amounts in column D (=ABS(C2) if the original amount is in C), so credit notes add to the running total instead of shrinking it. Put the running total in column E (=SUM(D$2:D2), filled down). Put the interval in a cell, say H1 (=120000/3), and the random start in H2. For the start, use =RAND()*H1 once, then copy and paste it as a value, otherwise it recalculates every time the file opens and the selection moves. Write the pasted value on the working paper too.

Then list the hit points in column J (=$H$2+(ROW()-2)*$H$1 in J2, filled down until the value passes the last running total) and pull the reference for each with =INDEX($A$2:$A$1829,XMATCH(J2,$E$2:$E$1829,1)), where rows 2 to 1829 hold the 1,828 non-key invoices. Match mode 1 in XMATCH means "exact match or next largest item", so it returns the first running total equal to or above the hit point: the invoice that contains that dollar, which is the same rule the script applies. XMATCH needs Excel 2021, Excel 2024 or Microsoft 365; on an older version, ask the assistant for an equivalent with MATCH and test it. Count the filled hit points too: with this population they should stop at 84. The ChatGPT and Excel guide is useful for building these formulas, provided you test each one on five rows by hand.

Where AI genuinely earns its place

With selection fixed, AI does four useful jobs for a small practice.

1. Cleaning the population. Extracts arrive with merged cells, text-formatted numbers and duplicate headers. The AI can write the clean-up steps while you supply only column headers and dummy rows. The clean messy data tutorial covers the principle.

2. Writing and explaining the code. Ask for the script in plain steps, then ask it to explain each line back to you in words your reviewer would follow. If you cannot explain a line, do not file it.

3. Drafting the documentation. Give it your inputs and ask for a memo in your firm's template. Always check numbers against your own calculations.

4. Playing the reviewer. Paste your finished memo (client names removed) and ask it to list the questions a reviewer would raise. This is cheap and catches gaps such as a missing control total.

Documentation wording you can adapt

This filled-in example shows the level of detail. Replace the figures with yours, and adapt the headings to your firm's template.

Population: all purchase invoices posted 1 January to 31 December 2025,
1,842 items, $4,380,000, agreed to the purchase ledger control account
(difference nil). Extract saved as population_2025.csv, sorted by reference.

Objective: test occurrence and accuracy of recorded purchases.

Method: monetary unit sampling. Tolerable misstatement $120,000 (performance
materiality $150,000 less allowance). Confidence 95%, reliability factor 3.0
(firm table, expected error nil). Sampling interval $40,000.

Key items: 14 invoices of $40,000 or more ($1,020,000), all tested.
Selection: random start $29,628 from Python seed 20261104 (script
mus_select.py, filed). Every $40,000 step through the remaining cumulative
value selected one invoice: 84 items. Total tested: 98.

Result: see test sheet. Errors found, projection and conclusion below.
Prepared by: [initials, date]. Reviewed by: [initials, date].

A reviewer can now do three things: re-run the script and compare lists, trace the control total, and challenge the factor against the firm table. That is the standard of a file that "defends itself".

Evaluating what the sample found

Say testing the 98 items finds two misstatements. One is a key item overstated by $4,000, which is a known error and is taken at that amount. The other is a sampled invoice recorded at $5,200 where the correct amount was $4,420, an overstatement of $780. The tainting percentage is $780 / $5,200 = 15%. Projected to the interval, that is 15% x $40,000 = $6,000. Total projected misstatement is $4,000 + $6,000 = $10,000, compared with tolerable misstatement of $120,000.

That looks comfortable, but the evaluation does not stop at the arithmetic. Your firm's methodology also asks for an allowance for sampling risk, and you must consider whether the errors share a cause (a price list not updated, a supplier terms change) because that can mean the same error exists elsewhere in the population. Do not let AI conclude for you. It can summarise the errors and draft the wording; the partner decides.

Controls, payroll and stock: three smaller populations

Testing controls at a kitchen fitter. The question is whether job-cost sheets were approved. The population is 480 sheets for the year, the unit is a sheet, and you use attribute sampling, counting deviations rather than dollars. Selection can be a simple random draw using the seeded script with the interval step replaced by random.Random(SEED).sample(range(480), n). The sample size comes from your firm's table for the tolerable deviation rate, not from the AI.

Payroll at a childcare nursery. Employees number 22, so sampling is almost pointless; you can test all of them for one month. The tutorial lesson is knowing when the population is small enough that the right selection is everything. Document that decision rather than forcing a sample.

Stock at a craft brewery supplier. The inventory listing has 3,100 lines, with a handful holding most of the value. Stratify: test all lines above a threshold, then sample the rest by monetary unit. Document the strata, the thresholds, and why items in the top stratum are not part of the statistical conclusion.

Prompts that save time without touching the selection

Three prompts cover most of what a small practice wants from an assistant here. Use a business plan, and paste only headers, dummy rows or anonymised text.

Prompt one: the script. "I have a CSV with columns ref, date, supplier, amount. Write Python 3 that takes a tolerable misstatement and a reliability factor, sets the interval, separates items at or above the interval as key items, uses random.Random with a seed I supply to pick a start, then selects one item at each interval step through the cumulative total of the rest. Output a CSV with a basis column. Comment each step in plain English." You then read the result. The first draft commonly has one of two faults: it forgets to take absolute values, so credit notes shrink the cumulative total, or it uses the global random module without a seed, so results change each run. Both are quick to fix once you know to look.

Prompt two: the reviewer's questions. Paste the filled-in documentation above, with the client removed, and ask: "You are a file reviewer. List the five questions you would raise." An illustrative reply: "1. How was completeness of the 1,842 items established beyond the control account? 2. Why is 3.0 the right factor, and where is the firm table referenced? 3. Why is performance materiality $150,000 and who approved it? 4. Were credit notes in the population? 5. What happened to items that could not be located?" Answer each in the file before the reviewer asks. Ignore any question that does not fit your engagement.

Prompt three: the plain-English summary for the client file. "Summarise the following test results in 120 words for the engagement partner, without adding any conclusion." Telling it not to conclude matters, because the model will otherwise write "no material misstatement identified", which is your conclusion to reach.

Before and after: a population that did not agree

A population extract for a craft brewery supplier shows 2,406 lines totalling $3,918,550, but the ledger control account says $3,931,000. Before: the junior runs the selection anyway and plans to "mention the difference". After: the difference of $12,450 is investigated first. It turns out a month-end accrual journal, posted in the ledger without an invoice reference, was filtered out by the export. The extract is re-run with journals included, the total agrees, and the new lines (including journals with no supplier) are part of the population, so every item has a chance of selection. A sample drawn from the first extract would have excluded an entire category of entries that an auditor most wants to reach.

Credit notes, zero values and duplicates in a monetary unit population

Real extracts are messy, and each oddity changes who can be selected.

• Credit notes and negatives. MUS works on absolute amounts, so negatives may be included by taking their absolute value, or tested separately. Choose one rule and write it down. Many firms test large credits as a separate stratum.
• Zero-value lines. They have no monetary units, so MUS can never select them. If zero-value lines matter to the objective (for example, free-of-charge goods received), test them by another method.
• Duplicates. If the same invoice number appears twice, decide whether that is a data error or a genuine duplicate posting. Duplicate payments are a risk in themselves, so a duplicate check across the whole extract is worth doing every year.
• Items hit twice. If an item is larger than the interval it is a key item and tested anyway; that is why key items are removed first.

When testing everything is better than sampling

For some populations, a script that tests every item is easier to defend than a sample. Suppose a nursery's 2,100 monthly direct-debit receipts must agree to the booking system. A spreadsheet lookup compares all 2,100 in seconds and lists the exceptions, so no sampling risk exists for that test. AI can write the lookup, and you then investigate the exceptions. Sampling stays the right tool where each item needs a person to inspect a document, such as vouching an invoice to a delivery note. State in the file which tests are full-population and which are sampled, so a reviewer does not look for a sample that does not exist.

Recording the use of AI itself

Add two sentences to the file: what the AI was used for (generating the script and drafting wording), and what was done to check it (script read and tested on a small file, output agreed to a manual calculation for five items). Do not write "AI selected the sample". The sample was selected by the documented method, and the tool is incidental. If your firm has an approval route for software or scripts, note the approval and its date.

A mistake that gets caught at review

A junior asks a chat tool for "a random sample of 40 invoices from this list" and pastes in 300 rows. The model replies with 40 invoice numbers, and the junior files them. At review, the senior notices that 11 of the 40 are in the first 60 rows and that the model never saw the other 1,500 rows because the paste was cut off. Nobody can explain how the items were selected, and the work must be redone. The fix is the process above: population tested for completeness first, selection run locally, the seed written in the file.

A one-page checklist for the file

1. Population defined, agreed to a control total, and the extract filed.
2. Test objective stated, with the assertion tested.
3. Tolerable misstatement or tolerable deviation rate set and signed off by the partner.
4. Method named and justified; factors taken from the firm's table.
5. Seed or random start recorded; script or formulas filed.
6. Selection list produced by the script, not edited by hand. Any substitutions (for example, a cancelled item) explained and replaced by a documented rule.
7. Results recorded item by item; errors projected; evaluation concluded.
8. Preparer and reviewer initials and dates.

Also record who approved the use of the AI-assisted code under your firm's policy, and keep client data out of any consumer chat account. If your practice has no written policy on that yet, the readiness checklist for professional firms is a good place to begin. For drafting the rest of the paper trail, ChatGPT for working papers covers where drafting help ends, and chasing evidence requests covers what happens after the sample goes to the client.

Questions reviewers and small-practice partners ask

Does ISA 530 allow computer-generated samples?

The standard is neutral about tools. It asks that each sampling unit in the population has a chance of selection and that you document what you did. A seeded script or spreadsheet is a legitimate way to do that, provided the population is complete and the steps can be repeated. Check your firm's methodology and the edition you apply.

Can I just paste my ledger into ChatGPT and ask for 30 items?

That is the approach to avoid. The result changes each time, the model may favour items it finds notable, and you cannot show a reviewer a repeatable method. It also puts client data into a chat tool. Run selection locally and use AI for the code and the wording.

Is a haphazard selection still acceptable?

ISA 530 lists haphazard selection as a method, provided the auditor avoids conscious bias or predictability, but says it is not appropriate when using statistical sampling. It is also hard to defend and impossible to repeat exactly. For a small practice, a seeded random or systematic selection costs the same effort and gives the reviewer something to re-run.

What should I keep in the file besides the sample list?

Keep the population extract with its control total, the script or formulas, the seed or random start, the sample size calculation, the selection output, the testing results and your evaluation. Together they let another person reproduce the selection and see how you reached the conclusion.

Further reads

• ChatGPT for Accounting With Excel: Seven Tasks, Each With Its Check — Seven ChatGPT and Excel tasks accountants can check.
• How to Chase Missing Client Records With AI Before Deadlines — Chase missing client records before deadlines.
• How Accountants Use AI to Spot Errors in Client Books — Use AI to scan whole ledgers for oddities alongside sampling.
• Can AI Draft Journal Entries? Accruals and Prepayments, Then Review — Journal entry review is a related population-testing job.
• Accountants AI Risk Checklist: Error Points, Each With a Named Check — Error checks to build into any AI-assisted accounting task.
• What an AI Implementation Looks Like in a Small Accounting Firm — What AI implementation looks like in a small accounting firm.
• AI Tools and AI Development: The Complete 2026 Guide — the AI hub, including every tutorial in the AI-for-business series.

Sources: ISA 530 Audit Sampling and ISA 230 Audit Documentation as adopted by a national standard-setter (2010 texts of the IAASB standards, read on a professional body's standards site); a national audit regulator's thematic review on audit sampling; Microsoft support page for XMATCH; scripts run locally on a synthetic 1,842-row file. Checked 4 November 2026.