email-svg
Get in touch
info@canadiancyber.ca

Audit Evidence Sampling 101

A practical ISO 27001 internal audit case study showing how to choose defensible audit evidence samples. Includes sampling logic, traceability steps, and a copy/paste sampling record template.

Main Hero Image
ISO 27001 Internal Audits • Sampling • Evidence Traceability

Audit Evidence Sampling 101: How to Pick Samples That Auditors Trust

A practical case study for ISO 27001 internal audits (and what to do differently next time)

Most internal audit findings don’t happen because controls are missing. They happen because sampling is weak, inconsistent,
or not traceable to evidence. This case study shows how to pick samples auditors trust so your audit results stand up in
certification and surveillance audits.

What auditors trust
Risk-based selection, clear method, and evidence traceability.
What breaks audits
Convenience samples, vague logic, and missing links from test to proof.
What you’ll get
A copy/paste sampling framework and a practical baseline for sample sizes.

The situation (realistic case study)

A Canadian SaaS company (250 employees) was preparing for ISO 27001 certification.

They had completed an internal audit. They had a long checklist. They had “evidence” in a SharePoint folder.

Pre-assessment feedback from an external auditor
  • “Your samples don’t prove the control operates consistently.”
  • “I can’t trace what you tested.”
  • “I don’t know why you selected these samples.”

The company wasn’t failing security. They were failing audit evidence credibility.

That’s what sampling fixes.

What went wrong (and why auditors didn’t trust it)

Three common mistakes
1) They sampled what was easy, not what was risky
They chose one clean ticket, one recent policy, one “best-case” example.
2) They didn’t define a sampling logic
“They were available” and “They looked representative” is not a method.
3) They didn’t build traceability
No sample IDs. No audit trail. No mapping from control → test → sample → evidence → conclusion.

What “auditor-trusted sampling” looks like (in plain English)

Good sampling answers four questions clearly:

  1. What population did we sample from?
  2. How many did we test, and why?
  3. How did we pick them (method)?
  4. What did the sample prove (test + result)?

If you can’t answer those questions, you will eventually see weak internal audit results or a nonconformity in certification.

The fix: the vCISO sampling approach they implemented

Canadian Cyber (vCISO support) helped them rebuild their sampling method in one week.
The goal was not more samples. The goal was defensible samples.

Rule 1: Define population first
Write the population clearly before choosing samples.

Example (Access reviews):
Population: all quarterly access reviews completed between Jan 1 and Mar 31
Count: 22 systems reviewed
Rule 2: Sample across time, teams, and risk
Force coverage across time, people, and risk tiers. This prevents cherry-picking.
Rule 3: Link each sample to test + evidence
Every sample gets a sample ID, an evidence link, the test performed, and the result.

Case study: How they sampled three high-risk controls

Control area 1: Joiner–Mover–Leaver (Access provisioning)
Goal: prove access is granted, changed, and removed consistently.
Step 1: Define population
  • All joiner tickets in Q1: 31
  • All mover tickets in Q1: 14
  • All leaver tickets in Q1: 9
Step 2: Risk-based sample selection
  • 3 joiners (one per month)
  • 2 movers (different departments)
  • 2 leavers (one with elevated privileges)
Why auditors trust this: time coverage, process variants, and higher-risk cases.
Step 3: Test steps applied to each sample
  • Approval exists
  • Role-based access requested
  • Access granted matches request
  • Access removed within SLA (for leavers)
  • Evidence retained (ticket history + logs)
Evidence attached
  • Ticket link/export
  • Identity admin export (assignment/removal)
  • HR termination reference (where allowed)
Result: no major nonconformities. One minor improvement: leaver SLA clarified.

Control area 2: Vulnerability remediation (Patch SLAs)
Goal: prove vulnerabilities are triaged and fixed within defined timelines.
Step 1: Define population
  • Critical vulnerabilities identified in Q1: 18
  • High vulnerabilities identified in Q1: 62
Step 2: Risk-based sample selection
  • 5 critical vulnerabilities (including the oldest open item)
  • 5 high vulnerabilities (random + aged mix)
Why auditors trust this: includes worst-case items, not only clean records.
Step 3: Test steps
  • Detection date
  • Severity classification method
  • Assigned owner
  • Remediation action evidence
  • Closure date vs SLA
  • Exception/risk acceptance if overdue
Evidence attached
  • Scanner export/snapshot
  • Ticket(s) showing remediation
  • Change record (if needed)
  • Risk acceptance record (if any)
Result: two highs were overdue with no acceptance → corrective action raised (valid finding).

Control area 3: Backups and restore testing
Goal: prove backups exist and restores are tested.
Step 1: Define population
  • All backup jobs for critical systems: 12
  • All restore tests performed in Q1: 3
Step 2: Sample selection
  • 2 critical systems (customer-facing + internal finance)
  • Latest restore test + one earlier test
Step 3: Test steps
  • Backups completed successfully (job logs)
  • Retention meets policy
  • Restore test executed
  • Restore achieved within target time
  • Integrity validated (not just “it restored”)
Evidence attached
  • Backup job logs/screenshots
  • Restore test record (date, system, outcome)
  • Approval sign-off (IT/security)
Result: restore testing frequency too low → improvement action added to management review.

The sampling framework auditors trust (copy/paste)

Use this template for each control you audit. It makes sampling repeatable and defensible.

Sampling record template
Control / Clause: [e.g., A.5.15 / Clause 9.2]
Population definition: [what + time period]
Population size: [count]
Sampling method: risk-based / random / stratified
Sample size: [how many + why]
Sample list: [IDs, dates, owners]
Test steps: [exact checks performed]
Evidence links: [tickets, logs, exports]
Result per sample: pass/fail/exception
Overall conclusion: effective / partially effective / not effective

How many samples should you pick?

There’s no single ISO rule. Auditors expect sampling to be defensible, consistent, and risk-based.

Practical internal audit baseline
Control risk Typical sample size Note
Low-risk 2–3 samples Prove the control operates at least twice
Medium-risk 3–5 samples Include different owners or systems
High-risk 5–10 samples Include worst-case/aged items and admin scenarios
Best practice
Increase sample size if you find failures. One failure often means the control is not operating consistently.

The 5 sampling mistakes that create audit findings

  • Only sampling “perfect” records
  • Sampling from the wrong population
  • No time coverage (all samples from last week)
  • No high-risk coverage (no admin, no sensitive systems)
  • No traceability (no mapping from sample to evidence and test)

 Want an internal audit sampling workbook?
If your team struggles with sampling consistency, we can give you a ready-to-run workbook and a repeatable method.
A vCISO-led sampling setup includes:
  • sampling rules by control category
  • evidence pack folder structure
  • sample register template with auto traceability
  • internal auditor question scripts per clause

Outcomes from the case study (what changed)

After implementing the sampling method:

  • Internal audit results became reproducible
  • Findings were stronger and easier to close
  • Management review decisions were clearer
  • Certification preparation improved significantly
Most importantly: the audit moved from checklist compliance to risk assurance.

Download the Audit Sampling Toolkit
Get the Audit Evidence Sampling Toolkit used in this case study.
Includes:
  • sample register template
  • risk-based sampling rules
  • test step library for common ISO 27001 controls
  • evidence pack folder structure
About Canadian Cyber
Canadian Cyber helps Canadian organizations run internal audits that stand up to certification audits.
Our vCISO services include audit program design, evidence readiness, sampling methodology, and management review support so audits drive real improvement, not paperwork.

Follow Canadian Cyber
Practical cybersecurity + compliance guidance for Canadian teams:

 

Related Post

blog thum
2026
Aug

Internal Audit Questions for Cloud Security

What should an internal auditor ask about cloud security? This practical ISO 27001 and ISO 27017 guide covers shared responsibility, cloud access, privileged admin roles, backups, restore testing, logging, monitoring, vendor risk, cloud configuration, incident response, and audit-ready evidence.
blog thum
2026
Aug

Common Cloud Evidence Gaps

Cloud security controls may be working, but can you prove it during an ISO 27001 internal audit? Discover 14 common cloud evidence gaps involving access reviews, privileged admins, MFA exceptions, offboarding, backups, restore testing, logs, vendor access, cloud risks, the Statement of Applicability, and corrective actions.
blog thum
2026
Aug

Audit Cloud Access, Backups, Logs, and Admin Roles

Cloud controls need more than screenshots to pass a strong internal audit. Learn how to audit cloud access, privileged admin roles, MFA, offboarding, backups, restore testing, logs, monitoring, vendor access, and configuration under ISO 27001, with practical questions, evidence examples, red flags, and corrective actions.
blog thum
2026
Aug

AI Use Template for Canadian Organizations

AI tools such as ChatGPT, Microsoft Copilot, Gemini, Claude, and AI meeting assistants are already entering Canadian workplaces. Use this practical AI governance template to audit approved tools, data restrictions, privacy risks, vendor reviews, human oversight, employee training, incidents, and evidence as part of your ISO 27001 internal audit.
blog thum
2026
Aug

MSP Prepared for Certification Through Monthly Internal Audits

See how an MSP replaced last-minute ISO 27001 certification preparation with a monthly internal audit program. This case study covers multi-client access, privileged accounts, offboarding, backup and restore testing, vendor risk, incident response, corrective actions, and SharePoint evidence management.
blog thum
2026
Aug

Internal Audit Questions for Managed Service Providers

MSPs handle sensitive client data across ticketing systems, remote access tools, backup platforms, documentation portals, cloud environments, and vendor systems. This guide explains the internal audit questions MSPs should ask to prove client access is controlled, client data is protected, and evidence is ready for ISO 27001 certification or customer review.
blog thum
2026
Aug

ISO 27001 Internal Audit for MSPs

MSPs face unique ISO 27001 risks because one weak control can affect multiple clients. This guide explains how to audit multi-client access, privileged accounts, technician offboarding, backup and restore evidence, vendor dependencies, subcontractors, incident response, and client data separation.
blog thum
2026
Aug

How a FinTech SaaS Reduced Audit Fatigue

Audit fatigue often comes from collecting the same evidence repeatedly. This FinTech SaaS case study shows how shared evidence libraries, framework mapping, evidence owners, refresh schedules, SharePoint views, and corrective action tracking helped reduce duplicate work across SOC 2, ISO 27001 internal audit, enterprise security reviews, and customer due diligence.
blog thum
2026
Aug

SOC 2 vs ISO 27001 Audit Evidence

SOC 2 and ISO 27001 share a significant amount of audit evidence, but they are not interchangeable. Learn which policies, access reviews, vendor records, incident evidence, change controls, backups, training records, and corrective actions can support both frameworks—and which ISO 27001 and SOC 2 records must remain framework-specific.