#steekproef

Sample-based or full access review: what does the auditor accept?

At larger scale, a full review becomes unworkable. Risk-based sampling is the answer — provided you can clearly explain how you sampled.