An auditor cannot review all 40,000 access-change tickets from the past year, so the auditor selects 60 tickets at random and checks each for documented manager approval before drawing a conclusion about the whole population. Which data-gathering technique is the auditor using?
Select an answer to reveal the explanation.
Short Explanation
Sampling is tasting a spoonful to judge the whole pot of soup. You check 60 random tickets and use the result to say something about all 40,000. Don't confuse it with assertion; that's management's claim the auditor is testing, not the testing method itself.
Full Explanation
Sampling is an audit technique in which a representative subset of a population is examined in order to draw conclusions about the whole. Selecting 60 tickets at random from 40,000 and checking each for documented approval lets the auditor estimate how consistently the approval control operated, with the sample size and selection method chosen to support the desired confidence. Random or statistical selection avoids bias toward easy or favorable items. Interviews gather information by questioning personnel about how processes work; they help the auditor understand the control but do not provide evidence that it operated on specific tickets. An assertion is a claim made by management or the control owner, for example that all access changes are approved; the auditor gathers evidence such as samples to test the assertion, so the assertion is the subject of the test, not the technique. Questionnaires and surveys collect structured responses from many people, often for self-assessment or vendor review; they capture what respondents report rather than examining actual records. Exam caveat: if exceptions appear in the sample, auditors typically expand the sample or report the control as ineffective rather than assuming the exceptions are isolated. Operational check: confirm the sample was selected from the complete ticket population and that every exception is documented with its ticket number.