Sampling without pretending you tested everything

Boards sometimes ask whether “everything” was checked. In a busy payment cycle, that question can push teams toward language that overstates the work. Better practice is to write the sample size into the engagement letter and report against that promise.

Agreeing the depth

For a financial audit of vendor payment applications, we typically:

• Cover all lines above a monetary threshold with dual review
• Sample a stated percentage of remaining lines
• Expand the sample when the first exceptions cluster on one vendor

Those rules are dull on purpose. They keep the findings letter aligned with what was actually opened.

Reporting with restraint

A clean letter says which applications were tested, which were not, and which exceptions matter for the transfer. It does not invent coverage for lines left outside the sample. Controllers who need fuller coverage commission a wider population or a second window—not a stronger adjective.

Deadline pressure

Rush pre-disbursement checks are useful when the shortlist is explicit. They are a poor substitute for a full-cycle audit. Name the limit early so treasury and owners share the same expectation.