# Sampling design and selection record

SecNet.Work · Audit evidence, sampling and workpapers · 2026.10

Preserve selection method and extrapolation boundaries.

Blank organizational workpaper. Enter real contact, asset and data details only in a controlled organizational copy. This file is not evidence, organizational approval or an automated compliance decision.

- State whether selection is judgmental or probabilistic.
- Record decision needs and specialist judgment instead of a universal size.

| Question / population version | Method / rationale | Selection / reproduction | Assumption / limit |
| --- | --- | --- | --- |
|  |  |  |  |
|  |  |  |  |
|  |  |  |  |
|  |  |  |  |
|  |  |  |  |

## Approval and follow-up

| Version | Owner | Approval | Review |
| --- | --- | --- | --- |
|  |  |  |  |

## Official references

- [ISO 19011:2026 — Guidelines for auditing management systems](https://www.iso.org/standard/19011)
- [The IIA — Global Internal Audit Standards (2024)](https://www.theiia.org/en/standards/2024-standards/global-internal-audit-standards/)
- [NIST SP 800-53A Rev. 5 — Assessing Security and Privacy Controls](https://csrc.nist.gov/pubs/sp/800/53/a/r5/final)
- [NIST SP 800-115 — Technical Guide to Information Security Testing and Assessment](https://csrc.nist.gov/pubs/sp/800/115/final)