Building an invoice sample that still means something

A random twenty invoices pulled from last month rarely answers the question a controller is actually asking. Before we draw numbers, we ask what decision the sample must support: comfort for external auditors, a check on temporary clerks, or a look at one high-risk vendor category.

Stratify before you randomise

Split the population by amount bands and by process path (PO-matched versus non-PO). Large freight invoices deserve heavier weight than stationery claims. Then randomise inside each stratum so nobody can accuse the test of hunting only friendly vouchers.

Respect Hong Kong calendar pressure

In the fortnight before Lunar New Year, approval trails thin out and payment runs thicken. If that is the risk window, sample inside it — not from a quiet October that flatters the control environment.

Know when to expand

If the first tranche shows a cluster of missing second signatures on the same clerk code, expand that slice rather than declaring a clean bill across the whole ledger. A small, honest expansion memo beats a confident rate built on the wrong population.