SOX sampling guidance: how to choose the right sample size for control testing

SOX sampling guidance answers one question: which control instances do you test, and how many, to support a conclusion about operating effectiveness? The answer is never a single number. It comes from the control's frequency, its risk, the population, the deviations you expect and can tolerate, and your documented methodology, with the reasoning written down.

Should you test two monthly reconciliations or six? How many journal entry approvals are enough? Does every control need the same sample size? This guide explains SOX sampling in plain terms: defining the population, choosing an audit sampling method, what PCAOB AS 2315 says, what to do when a sample fails, and how to document it. For illustrative sample-size ranges by frequency, see the companion guide, How many samples? SOX sample sizes by control frequency.

What is SOX sampling?

SOX sampling is selecting items from a larger population to test whether an internal control operated as intended. Instead of reviewing every control instance, the tester examines selected items and draws a conclusion about the whole period.

A company may process thousands of vendor payments a year, with a control requiring an authorized manager to approve each payment before release. The tester selects payments and inspects their approval evidence, to learn how the control operated during the period.

Sampling is common in operating effectiveness testing, but it is not right for every control. Some controls need other procedures, and automated controls are often tested through their configuration or a complete-population analysis instead.

Why sampling matters in SOX control testing

Testing every instance can take enormous time. A well-designed sampling approach lets you:

• Support a conclusion about operating effectiveness
• Test efficiently
• Cover the relevant periods and control activity
• Find potential deviations
• Keep testing consistent across testers
• Leave clear audit documentation

A sample does not guarantee every instance operated correctly. It can miss a deviation that exists elsewhere in the population. That is sampling risk, and the approach should give a level of assurance that fits the control and the purpose of the test.

How many samples are required for SOX testing?

There is no single sample size for every SOX control, and using the same number for every daily, weekly or monthly control is a shortcut that does not hold up. The right size depends on:

• Control frequency
• The risk associated with the control
• Population characteristics
• The expected deviation rate
• The tolerable deviation rate
• The level of assurance you need
• Your testing methodology

PCAOB AS 2315 discusses these considerations for audit sampling, but it does not hand out a universal sample-size table. Management testing teams follow their approved methodology; external auditors apply the standards for their audits, and their minimums usually set the floor for yours.

SOX sample sizes by control frequency: start with the population

Frequency is the natural starting point, because it tells you how many times the control ran. The table shows populations, not sample sizes.

These are illustrative population frequencies, not mandatory sample sizes or minimums. The number you test should come from your methodology and the assurance you need.

Annual controls

An annual control runs once, such as an annual review of a significant accounting policy. Test that occurrence, and check that every required step was done and evidenced.

Quarterly controls

Four occurrences a year, for example a quarterly disclosure review. With a population this small, testing every occurrence is often practical; weigh the risk and the testing objective.

Monthly controls

Twelve occurrences: bank reconciliations, balance sheet reviews, monthly close procedures. Select months from across the year under your approved approach.

Weekly and daily controls

Larger populations, such as a daily exception report review. Consider the number of occurrences, the risk, expected deviations and the assurance required. Picking only the most recent items rarely covers the period.

Transaction-based controls

Some controls run on every transaction: purchase approvals, journal entry reviews, changes to vendor bank details. The population is the set of relevant transactions, and sample design should weigh both volume and risk.

Factors that affect SOX sample size

1. 1

   Control risk

   Higher-risk controls need more persuasive evidence. A control over sensitive journal entries carries more risk than a routine administrative approval. Risk shapes the nature, timing and extent of testing, but it does not mean every high-risk control gets the same larger sample.

2. 2

   Control frequency

   Frequency defines the available population. On its own, it does not set the right sample size.

3. 3

   Expected deviations

   Prior results tell you whether deviations are likely. A control with a history of missing approvals needs a different approach from one with clean prior results. Changes in systems, people and procedures count too.

4. 4

   Tolerable deviation rate

   The highest rate of deviations that would still support the planned reliance on the control. A lower tolerable rate generally calls for more persuasive evidence, usually a larger sample.

5. 5

   Population characteristics

   Know exactly which items belong. A payment approval control may apply only above a threshold; including payments that were never subject to the control makes the sample wrong before testing starts.

6. 6

   Available evidence

   A larger sample does not fix an incomplete report, inaccurate records or an unsuitable procedure. The evidence has to support the actual control attributes. SOX audit evidence covers what makes evidence reliable.

Audit sampling methods for SOX control testing

Tests of controls usually use attribute sampling: each selected item either meets the control requirement or it does not, and the deviation rate drives the conclusion. Within that, different selection methods suit different objectives.

Random sampling

Every item has a chance of selection, which reduces selection bias and supports a representative sample. For example, selecting payments from the complete annual population with a random method. Document the population and the selection approach.

Systematic sampling

Items selected at a fixed interval, usually after a random start, such as every twentieth item. Check the population for patterns that line up with the interval and bias the result.

Stratified sampling

The population is split into groups by a relevant characteristic, such as value, business unit or transaction type, and each group is sampled. The method should match the objective and still allow a sound evaluation of the results.

Haphazard selection

A nonstatistical approach that avoids deliberate bias without a formal random method. It still takes discipline: picking the documents that arrived first produces a sample of whoever answers email fastest.

Targeted selection

Items chosen for particular risk characteristics, such as high-value journal entries or unusual transactions. It gives useful evidence about specific risks, but targeted items alone are not a representative sample of the population. Risk-focused selection and representative sampling serve different purposes.

Example: sampling a monthly reconciliation control

A company requires a finance manager to review and approve the bank reconciliation every month: 12 reconciliations a year. Assume the testing team selects four months under its approved methodology. That number is illustrative, not a recommended or universal size.

The tester selects February, May, August and November, spread across the year.

The August evidence shows no clear approval date. The tester checks whether approval exists in another approved source. If the requirement was not met, the tester records a confirmed deviation and evaluates its effect on the conclusion. Three passes do not outvote one deviation.

SOX sampling guidance, step by step

1. 1

   Understand the control

   Start from the RCM: the control objective, the financial reporting risk, the owner, the frequency, the testing attributes and the expected evidence.

2. 2

   Define the population

   Identify every relevant instance in the testing period: 12 reconciliations for a monthly control, thousands of transactions for a payment approval. Check the population is complete and accurate before you sample from it.

3. 3

   Assess the risk

   Consider the control's importance to financial reporting, prior results and deficiencies, staff changes and system updates.

4. 4

   Determine the sample size

   Apply your methodology: frequency, population, expected and tolerable deviations, assurance needed. Write down why. Copying last year's number without reassessing is not a rationale.

5. 5

   Select the samples

   Use the chosen method, make sure recurring controls are covered across the period, and keep a record of how each item was selected.

6. 6

   Collect the evidence

   Approval records, reconciliations, transaction reports, system logs, review comments and supporting documents, each confirmed to belong to the right control, transaction and period.

7. 7

   Perform the testing

   Compare each item with the testing attributes, for example that the approver was authorized and approved before the payment was released, and document what the evidence shows.

8. 8

   Evaluate exceptions

   Investigate any item that misses a requirement: missing evidence, a wrong population, a genuine deviation or something else. Evaluate both how often and what kind.

9. 9

   Document the conclusion

   Control ID and description, testing period, population definition and size, sampling method, sample size and rationale, evidence reviewed, results, exceptions and investigations, conclusion and reviewer approval. The SOX workpaper template lays it out.

What happens when a SOX sample fails?

A failed sample needs careful evaluation: which requirement was missed, and why. The approval might be missing, the review late, the performer unauthorized, a significant exception not investigated, or the evidence simply unavailable.

Investigate the facts and assess the effect on the testing objective. Additional procedures may be needed, and depending on the nature and cause of the deviation, the team may need to revisit the conclusion or evaluate a control deficiency. The deficiency classification guide covers that step.

Increasing the sample size does not remove or resolve a confirmed deviation. Testing more items until the failure looks small is not sampling; it is negotiating.

SOX sampling vs testing 100% of transactions

Data analytics and AI tools can examine whole transaction populations, finding missing fields, unusual amounts and duplicates. Reviewing every transaction still does not prove a control operated effectively: the analysis has to test the right attributes, on complete and reliable data.

Looking at everything proves nothing if the population is incomplete or the control never ran. The right approach depends on the control, the technology, the evidence and the objective.

SOX sampling and PCAOB guidance

Two PCAOB standards matter most for external auditors evaluating control testing.

• AS 2315, Audit Sampling: covers planning, performing and evaluating audit samples. For tests of controls it discusses tolerable and expected deviation rates, sampling risk and population characteristics, and it accepts both statistical and nonstatistical approaches. It does not prescribe one sample size for every control
• AS 2201, An Audit of Internal Control Over Financial Reporting: covers how auditors evaluate design and operating effectiveness, the nature, timing and extent of testing, and additional procedures after interim testing (see rollforward testing for SOX controls)

These standards apply to external auditors. Management and internal audit follow the applicable requirements and their own documented methodology, which in practice is usually aligned with what the external auditor expects.

Best practices for SOX sampling

• Use a documented sampling methodology. Define how sizes and selection methods are set, covering risk, frequency, population and objective
• Confirm population completeness. An incomplete population makes every result built on it unreliable
• Avoid convenience sampling. A sample of the twelve tidiest folders proves the folders are tidy
• Cover the testing period. If you test at an interim date, plan what the remaining period needs; interim vs roll-forward testing covers it
• Review changes to the control. New systems, people or procedures may need separate or extra testing
• Investigate every potential deviation. An AI flag or a missing document is not an automatic failure. Investigate and record the result
• Keep clear workpapers. Selection method, evidence, procedures, exceptions and conclusion, in one place

How SOXLayer supports SOX sampling and control testing

SOXLayer is an AI-assisted SOX control testing workspace for internal audit, SOX and internal controls teams. For sampling specifically:

• Your own sample-size table: each company sets minimums by control frequency in settings, based on its auditor's or its own policy, and SOXLayer uses those numbers, not a generic default
• Plans with sizes filled in: when you add controls to a plan, sample sizes, due dates and preparers are filled in from your table, and interim and roll-forward plans are suggested from your fiscal year end
• A fingerprinted population: a population upload (CSV or Excel) is totalled and SHA-256 fingerprinted before samples are drawn, so the population you sampled from is on record
• Evidence per sample: evidence is matched to each sample, and the AI proposes Pass, Fail, Insufficient or N/A per attribute with a confidence score and the exact quote and page
• Exceptions to deficiencies: exceptions raise deficiencies automatically, and every decision lands in a hash-chained audit trail

AI never submits, reviews or approves a test. With auto-fill on, it can record a result it is at least 90% sure of, with a verified citation, while the test is still being prepared. Anything flagged, disputed or Insufficient waits for a person, and admins can switch auto-fill off so every result waits. Until the test is submitted, a person can still edit or override any result, auto-filled ones included. The sampling methodology and the final conclusions stay with your organization and its qualified reviewers.

Common questions about SOX sampling

What is SOX sampling guidance?

Guidance on selecting control instances for testing: defining the population, setting the sample size, choosing a selection method, weighing risk, gathering evidence and evaluating results.

How many samples are required for SOX testing?

There is no universal number. Size depends on the testing objective, risk, control frequency, population, expected deviations and your methodology. SOX sample sizes by control frequency has illustrative ranges.

How many samples should be tested for a monthly control?

A monthly control has 12 occurrences a year. How many to test depends on your methodology and the assurance you need; do not assume one number fits every monthly control.

What is the difference between random and judgmental sampling?

Random sampling uses a probability-based selection method. Judgmental or nonstatistical approaches rely on professional judgment and defined selection procedures. Both have to suit the testing objective.

What happens if a SOX sample fails?

Investigate the issue, find the cause and decide whether it is a confirmed deviation. Then assess how it affects the testing conclusion; a larger sample does not cancel it out.

Can AI help with SOX sampling?

AI tools can help organize sample information, review evidence and surface potential exceptions. People stay responsible for sampling decisions, validation and final conclusions.

Does the PCAOB require a fixed SOX sample size?

No. AS 2315 sets out the factors that drive sample size but does not set one table for every control.

Sources and further reading

The standards and guidance behind this article. Your external auditor's methodology and your company's own policy still set the requirements for your program.

• PCAOB AS 2315, Audit Sampling: planning, performing and evaluating samples, including tests of controls
• PCAOB AS 2201, An Audit of Internal Control Over Financial Reporting: nature, timing and extent of control testing
• SOX testing 101: where sampling sits in the full testing cycle

The goal is not to test the fewest items. It is to test enough of the right ones to say something true about the whole year.

Back to top

Read these next

Testing

Three-way match in accounts payable: how to test the control

Seven attributes, five documents per sample and four exceptions to check, plus an illustrative worked sample with a 4-unit quantity variance.

Furqan Abaid·September 2, 2026·9 min read

Testing

How many samples? A practical guide to SOX sample sizes by control frequency

A practical breakdown of SOX sample sizes by control frequency, with illustrative ranges, rounding rules and common testing mistakes.

Furqan Abaid·July 28, 2026·7 min read