Internal Audit Sampling Strategy: How Much Evidence Is Enough for ISO 27001?

Why Sampling Matters in ISO 27001 Internal Audits

ISO 27001 internal audit is meant to test whether the ISMS is implemented and working.

That does not mean the auditor must review every record. Instead, the auditor should review a reasonable sample.

Sampling helps the auditor test control operation, find exceptions, reduce audit burden, and support audit conclusions.

What Is Evidence Sampling?

Evidence sampling means selecting a portion of available records for audit testing.

For example, the company may have 120 access requests. The auditor may select 10 and check whether each request was approved and closed correctly.

Or the company may have 12 monthly backup reports. The auditor may select three months and check whether backups ran successfully.

How Much Evidence Is Enough?

The honest answer is simple. It depends.

ISO 27001 does not give one fixed sample size for every control.

The auditor should consider:

• How often the control operates.
• How risky the control is.
• How many records exist.
• Whether the control is manual or automated.
• Whether the control failed before.
• Whether the evidence is complete.
• Whether the system is critical.

Sampling by Control Frequency

Annual Controls

Annual controls happen once per year. Examples include annual risk assessment, management review, internal audit, policy review, and training.

For annual controls, one complete record may be enough if the evidence is clear and current.

Quarterly Controls

Quarterly controls happen four times per year. Examples include access reviews, risk reviews, and vendor status reviews.

For lower-risk controls, one quarter may be enough. For higher-risk controls, test more quarters.

Monthly Controls

Monthly controls happen 12 times per year. Examples include backup reviews, vulnerability scans, endpoint reviews, and metrics reviews.

A good approach is to select one early month, one middle month, and one recent month.

Daily or Weekly Controls

Daily and weekly controls may create too many records to review one by one.

For frequent controls, combine sample testing with dashboards, summary reports, and exception review.

Event-Based Controls

Event-based controls happen when something occurs. Examples include onboarding, terminations, access requests, production changes, and vendor onboarding.

For event-based controls, select a sample from the population. Include higher-risk cases where relevant.

Practical Sample Size Guide

When to Test More Evidence

Some controls deserve deeper testing. This is especially true when risk is high.

Test more evidence when:

• The control protects sensitive data.
• The control relates to privileged access.
• The system is business-critical.
• The control failed before.
• Evidence is inconsistent.
• Manual judgment is involved.
• There were incidents, complaints, or repeat issues.

When One Sample Is Not Enough

One sample may not be enough when the auditor needs to test consistency over time.

For example, one good access review does not prove that all quarterly reviews were completed properly.

One sample may be too weak when:

• The control happens many times.
• The control is manual.
• The control is high-risk.
• There were prior findings.
• Evidence quality is weak.
• The sample has exceptions.

What If the Sample Finds an Exception?

If the auditor finds an exception, it should not be ignored.

Common exceptions include:

• Missing approval.
• Late review.
• Incomplete record.
• Access not removed.
• Vendor not reviewed.
• Corrective action not verified.

The auditor should document the exception. Then they should assess whether it is isolated or systemic.

Sampling Strategy by Evidence Area

1. Access Control Evidence

Access control is usually high-risk. Samples should include standard users and privileged users.

Check approvals, business need, role assignment, MFA status, timely removal, and review sign-off.

2. HR and People Controls

HR controls affect onboarding, training, role changes, and offboarding.

Offboarding samples often need extra attention because late access removal creates serious risk.

3. Vendor Risk Evidence

Vendor controls can be annual, event-based, or risk-based.

For vendor sampling, include critical vendors even when they are not randomly selected.

4. Backup and Recovery Evidence

Backup evidence should prove that recovery is possible.

Samples should include both successful backup runs and exceptions.

5. Incident Response Evidence

If incidents are rare, review all incidents in the audit period.

Check classification, timeline, escalation, containment, lessons learned, and closure evidence.

6. Change Management Evidence

Change samples should include different types of changes.

Do not sample only easy changes. Include higher-risk changes where relevant.

7. Training Evidence

Training evidence should prove assignment, completion, and follow-up.

Include new hires and overdue cases, not only completed users.

8. Corrective Action Evidence

Corrective actions show continual improvement.

A corrective action is not closed until evidence proves the issue was addressed.

How to Document Sampling in the Audit Report

Sampling should be visible in the internal audit report.

Include these details:

• Control tested.
• Population reviewed.
• Sample size.
• Sample selection method.
• Evidence reviewed.
• Date range.
• Exceptions found.
• Auditor conclusion.

Random Sampling vs Judgmental Sampling

Internal auditors may use different sampling methods.

Random sampling selects records randomly. This can reduce bias.

Judgmental sampling selects records based on risk, importance, timing, or known concerns.

Both can be useful. The auditor should document the method used.

What External Auditors May Expect

External auditors may review the internal audit process.

They may ask:

• Was the internal audit planned?
• Was the sampling approach reasonable?
• Were high-risk areas tested?
• Were findings documented?
• Were corrective actions assigned?
• Were results reported to management?

Common Sampling Mistakes

• Testing only the best evidence. Auditors should not only review evidence selected by the control owner.
• Sampling too little. One screenshot may not prove recurring control operation.
• Ignoring high-risk controls. Privileged access, offboarding, vendor risk, backups, and incidents need careful testing.
• Not documenting the sample. Weak documentation makes the conclusion harder to defend.
• Not expanding after exceptions. One exception may indicate a wider issue.
• Reviewing documents but not records. Policies explain what should happen. Records prove what happened.
• No link to risk. Sampling should be stronger where risk is higher.

How SharePoint Can Help With Evidence Sampling

A structured SharePoint ISMS can make sampling easier.

Instead of searching through email, chats, folders, screenshots, and spreadsheets, evidence can be organized by control, owner, period, status, and due date.

Canadian Cyber’s ISMS SharePoint Solution can manage:

• Evidence libraries and control registers.
• Risk registers and access review records.
• Vendor review evidence.
• Training records and backup evidence.
• Incident records and corrective actions.
• Internal audit workpapers.
• Sampling notes, NCRs, and OFIs.
• Management review dashboards.

Canadian Cyber’s Approach to Internal Audit Sampling

Canadian Cyber performs ISO 27001 internal audits with a practical, risk-based sampling approach.

We do not only ask whether documents exist. We test whether controls are operating.

Our approach considers:

• Control frequency and control risk.
• System criticality and business impact.
• Evidence quality and prior findings.
• Sensitive data exposure.
• Manual control dependency.
• Audit period coverage and certification readiness.

How Canadian Cyber Helps

Canadian Cyber helps organizations prepare for ISO 27001 certification and surveillance audits.

We provide practical internal audit services and evidence readiness support.

• ISO 27001 internal audits.
• ISO 27001 implementation.
• Internal audit sampling strategy.
• Evidence readiness reviews.
• Access control testing.
• Vendor risk testing.
• Backup and recovery evidence review.
• Corrective action verification.
• NCR and OFI classification.
• SharePoint ISMS implementation.

Frequently Asked Questions

Takeaway

ISO 27001 internal audit sampling is not about collecting random screenshots.

It is about testing enough evidence to decide whether controls are working.

A strong sampling strategy considers frequency, risk, population size, evidence quality, prior findings, system criticality, and audit period coverage.

Enough evidence means enough to support a reliable audit opinion. Not too little. Not endless. Just enough to prove the ISMS is working.

Stay Connected With Canadian Cyber

Follow Canadian Cyber for practical guidance on ISO 27001 internal audits, audit sampling, evidence readiness, certification preparation, SOC 2, ISO 42001, ISO 27017, ISO 27018, SharePoint ISMS, cybersecurity assessments, and vCISO support.