Population testing — Modern Auditing

Testing every item in a population rather than a sample, which becomes the default once tests are executed by software against the system of record.

Sampling exists because opening 25 files took a person a day and opening 40,000 took a career. Remove that constraint and the sample loses its reason to exist.

The consequences are less comfortable than they first appear. Population testing does not reduce work; it relocates it. A sample of 25 with one exception produces a short conversation. A population of 40,000 with 1,900 exceptions produces a triage problem, and the skill the team needs shifts from performing procedures to categorising failure — which exceptions share a root cause, which are data quality rather than control failure, which are genuinely deficiencies.

It also changes what you can conclude. A sample supports a statement about the sample and an inference about the population. A population supports a statement about the population, full stop. Auditors used to hedged conclusions sometimes find the precision uncomfortable, particularly when the answer is that a control everyone believed was operating has been failing quietly for three quarters.

That discomfort is the value. It is also why the first full-population test a function runs is usually the business case for every change that follows it.