Skip navigation Spacer Spacer Spacer
Data Protection Logo Spacer Guide to Data Protection Auditing

Data Protection Homepage  Bullet  
Audit Guide Homepage  Bullet  
Download print version  Bullet  

What is a Data Protection Audit? Why Audit? Beginner's guide Step-by-step Process Forms and Checklists Site Map

SpacerHow to Assess Risk | How to Assess Data | Audit Pro formas | Meeting Pro formas | Audit Checklists

Spacer Spacer

< Previous | Next >

Spacer
Spacer

Sampling Criteria

When conducting an audit, the Auditor will often be required to examine a batch of records from manual or computer files to check that they have been processed correctly and in accordance with procedures. Where there are many records involved it will often not be feasible to examine every single one from the batch, so instead we adopt the principle of taking a sample. If the records in the sample are correct then we infer that the entire batch is satisfactory, and equally, if the sample contains unsatisfactory records then we infer that the entire batch is also unsatisfactory.

The effectiveness of this type of sampling depends upon two main factors:

  • Making sure that the sample size is suitable so that it is reasonable to assume that the characteristics of the sample reflect the characteristics of the entire batch.
  • Making sure that the characteristics being checked are the correct ones, which implies that a certain amount of planning should be done before the sampling takes place.

The way that sample sizes are calculated for different batch sizes involves the use of probability distributions and applied statistics which is beyond the scope of this guide. In practice it is not necessary for the Auditor to have this level of mathematical understanding as suitable sampling tables are available in textbooks and have been published as National and International Standards such as ISO 2859.

A typical sampling plan recommended for general use has been extracted from ISO 2859 and is shown in the table below which has the following features:

  • This table assumes that the acceptable level of non-conforming records in the batch is 4%, i.e. a maximum of 4 out of every 100 records may contain errors. (Auditors who wish to use sampling plans with error rates different from 4% are advised to refer to ISO 2859-1:1989.)
  • The first column gives the batch size and the second column specifies the corresponding number of samples that should be examined.
  • If the number of faulty records in the sample equals or exceeds the number in the third column then the entire batch will have an error rate greater than 4% and will not be acceptable.

Number of records in batch

Sample size

Reject number

2 - 8

2

1

9 - 15

3

1

16 - 25

5

1

26 - 50

8

1

51 - 90

13

2

91 - 150

20

3

151 - 280

32

4

281 - 500

50

6

501 - 1,200

80

8

1,201 - 3,200

125

11

3,201 - 10,000

200

15

10,001 - 35,000

315

22

35,001 - 150,000

500

22

150,001 - 500,000

800

22

500,001 and over

1,250

22

Return to top
 

Spacer

< Previous | Next >

Spacer
Spacer