Written by Sanjeeb Dey · Statutory references current to the Companies Act, 2013 and applicable IFC requirements.

Quick answer: The deciding difference is residual uncertainty: population testing examines every transaction and leaves no untested portion, while sampling tests a subset and carries sampling risk. Population testing now suits high-volume structured data and Internal Financial Controls testing under section 143(3)(i) of the Companies Act 2013; sampling still suits small, unstructured or judgement-led populations.

For most of my career, sampling has been the backbone of how audit work gets done: you pick a statistically defensible sample size, test it rigorously, extrapolate the results and issue an opinion with an appropriate level of assurance. It is a methodology built on sound statistical theory that has served the profession well for decades.

But something has changed. Fundamentally. Presently, data generated by our clients in the form of millions of transactions recorded over a multitude of interacting systems no longer requires our selective approach but instead allows for full testing of the data. Now we are faced with yet another issue: in case we can test 100% in entirety, should we still stick to sampling as our default practice?

From witnessing this transition play out in our projects, I have learned ten key lessons about what is causing it, what it changes, and what further work needs to be done in the profession.

What is the difference between audit sampling and population testing?

	Audit sampling	Population testing
Coverage	A statistically selected subset	Every transaction in the population
Conclusion	Extrapolated to the population	Observed directly
Residual uncertainty	Sampling risk remains	No untested portion exists
Effort profile	Manual testing of each selected item	Automated screening, manual investigation of exceptions
Best suited to	Small, unstructured or judgement-heavy populations	High-volume structured transactional data
Detects clustered anomalies	Only if the cluster happens to be sampled	Yes, by design

Why has the business case for sampling flipped?

Sampling exists because testing everything used to be impractical: too expensive, too time-consuming, too manual. That constraint is disappearing.

With modern data-extraction tools and audit data analytics platforms, pulling and testing an entire population of transactions is often no more effortful than pulling a sample, and sometimes faster. When the cost of full-population testing approaches the cost of sampling, the argument for sampling weakens considerably. We are no longer choosing sampling because it is efficient; we are choosing it, in some cases, purely out of habit.

Does 100% testing mean 100% manual effort?

No. This is the single biggest misconception I encounter, even among experienced auditors.

Population testing does not mean assessing each transaction manually, because the workflow is fundamentally different. Automated scripts and analytics tools screen the entire population against defined criteria: duplicate payments, threshold breaches, unusual approval patterns and weekend postings. Only the exceptions are flagged. Human judgement is then applied where it actually matters, investigating the anomalies rather than rubber-stamping the routine.

This is a redistribution of effort. Not a multiplication of it.

How does population testing remove sampling risk?

Every auditor who has had to defend a sample size in the face of questions from a sceptical member of the Audit Committee knows the follow-up question that is bound to come: “But what about those transactions that you never looked at?” This question stems from sampling and is entirely unavoidable and legitimate from the perspective of statistics. Sampling risk, by definition, means there is a chance the sample does not represent the population accurately.

Testing the population sidesteps the problem altogether. Once each and every transaction has been tested, there is no question what the untested segment could be made up of because there is no untested segment left.

What issues does sampling miss that population testing catches?

This is, in my view, the most compelling argument for the shift.

Control failures and fraud are rarely distributed evenly in populations but tend to cluster together purposely to avoid detection, and a sample of 30 or 60 transactions, however statistically sound, can miss a pattern that only becomes visible when you look at all 50,000.

We have seen this firsthand. Anomalies that would never have surfaced in a traditional sample-based approach became immediately apparent once the full population was run through an analytics script: a handful of unusual entries, invisible in isolation, but glaring once compared against the whole.

The same principle applies in terms of physical verification. By sampling a fixed asset register, you assess whether or not the sampled assets exist; physical verification and tagging of the full asset base aids in identifying the non-existent ones.

How does population testing affect IFC testing in India?

For Indian companies, this is where the shift bites: in internal financial controls over financial reporting, or ICFR.

Under section 143(3)(i) of the Companies Act 2013, the statutory auditor must report on whether the company has appropriate internal financial controls in relation to its financial statements, and whether these controls are operating effectively. The ICAI Guidance Note on Audit of Internal Financial Controls Over Financial Reporting provides guidelines on how this testing is carried out.

Operating effectiveness is an evidential question, and where a control applies to a high-volume, structured transaction stream, testing the full population produces direct evidence of every instance in which the control did or did not operate, whereas a sample produces only an inference about everything it did not touch. As management and auditors converge on analytics-based testing of the same control populations, a documented Risk and Control Matrix supported by full-population results is materially stronger evidence than the same matrix supported by an extrapolation.

What skills does an auditor need for population testing?

Traditional sampling required a solid grounding in statistical theory, including confidence levels, tolerable error rates and sample size calculations. Population testing requires something different: comfort with data extraction, scripting, query languages and visualisation tools.

This does not make statistical knowledge irrelevant, but it does mean the day-to-day skillset of an auditor is shifting, and increasingly our teams need people who can write a SQL query or build a Python script for anomaly detection, just as much as they need people who understand internal controls frameworks. The ICAI Internal Audit Standards Board, which issues the Standards on Internal Audit, is the body Indian functions should watch as this expectation formalises.

Why do data access and data quality become the new bottleneck?

Once the testing itself is no longer the constraint, the constraint moves upstream, to data access and data quality.

Full-population testing is only as good as the completeness and accuracy of the underlying dataset. If a client’s ERP system exports incomplete records, or if access negotiations with IT take three weeks, that becomes the actual bottleneck in the engagement, not the analysis itself. A growing share of our engagement planning now goes into data scoping and access logistics rather than sample design. The principle is the same as for fixed asset register: the results of the analysis depend on the quality of the data being analysed.

How does population testing change what assurance means?

There is a meaningful difference between telling an Audit Committee “we tested a representative sample and found no material exceptions” and telling them “we tested every single transaction in the population and found no material exceptions.”

The latter is a categorically stronger assurance statement, and clients and regulators increasingly recognise the difference. As population testing becomes more common, the bar for what counts as sufficient assurance is quietly rising, and firms that stick exclusively to sampling may find themselves needing to justify that choice, rather than the other way around.

How does population testing lead to continuous auditing?

Once you have built the scripts and analytics needed to test 100% of a population for a point-in-time audit, you are most of the way toward being able to run that same testing on a rolling, continuous basis.

This is where population testing and continuous risk intelligence intersect, because the infrastructure built for one supports the other, so that a control testing script built for an annual audit can, with modest adaptation, become a monthly or even daily monitoring routine, turning a static engagement into an ongoing assurance capability that the client did not have to build twice.

Does population testing replace professional judgement?

No. I want to be careful not to overstate this shift.

Population testing tells you what happened across every transaction, but it does not automatically tell you why, or whether a flagged anomaly represents a genuine control failure, a one-off exception, or perfectly legitimate business activity. Judgement-intensive areas, including complex estimates, related-party transactions and areas requiring interviews and process walkthroughs, still depend heavily on experienced auditors applying professional scepticism.

Population testing is a far more powerful tool for surfacing what deserves attention, but it does not replace the judgement needed to interpret what is found.

What does the transition actually require?

You cannot simply resolve to do more analytics. You need to take the necessary steps to invest in technology, build the data access infrastructure, train existing staff and, in some cases, hire people with different skills from those of traditional auditors.

Firms that treat this as a checkbox, running one analytics script on one engagement and calling it a transformation, will see limited results. The firms that genuinely benefit are the ones building the capability systematically:

• Standardised scripts that can be reused across engagements
• A data access playbook that speeds up negotiations with client IT functions
• A training pipeline that builds these skills into every new hire, rather than relegating them to a small specialist team

Where does that leave sample-based auditing?

To be clear, I do not think sampling is going away entirely, nor should it. There are still engagements where the underlying population is genuinely too small or too unstructured for full-population testing to add meaningful value, and there are judgement-based audit areas where sampling was never really the constraint to begin with.

But for high-volume, structured, transactional data, which is the bread and butter of so much control testing work, the default is shifting, and shifting quickly.

The question every audit and risk advisory function should be asking is not whether to ever use population testing, because that question has largely been answered. The real question, for each engagement, each control and each population of data, is whether sampling is still the right default, or whether it is simply the default we have never gotten around to reconsidering.

What is the path forward?

As a firm, we have started treating population testing as the starting assumption for structured transactional testing, with sampling as the deliberate exception rather than the automatic default. That is a meaningful reversal of how most of us were trained. It requires new tools, new skills and, admittedly, some discomfort in retiring methodologies that have served the profession reliably for a long time.

But the payoff is real: stronger assurance, fewer blind spots, and testing capabilities that lay the groundwork for the kind of continuous, forward-looking risk intelligence our clients are increasingly asking us to deliver.

The transition from sample auditing to population testing is not just a technical advancement of the method but is an important step towards the kind of assurance that the clients, Audit Committees and regulators will begin to expect as the norm instead of an exception. The firms and functions that start developing this competence now will be the ones defining the standard that the rest will have to catch up to.

How SBC applies population testing

Steadfast Business Consulting (SBC) believes that the function performed by internal audit and governance should be transformed from mere compliance exercise to a useful source of risk and control intelligence. SBC’s Financial and Risk Advisory practice applies data analytics across the internal audit process, control testing, Internal Financial Controls compliance under the Companies Act 2013 and forensic audit and investigations, coupled with standard operating procedure development and business process improvement. Rule 13 of the Companies (Accounts) Rules 2014 enables the internal auditor to be external to the company, which is what allows this work to be delivered on a co-sourced basis.

The starting point is not technology but an honest reading of where your risk intelligence currently stands and where it must be headed. If your organisation is questioning whether sampling is still the right default, the SBC internal audit team would be glad to discuss the opportunity.

Frequently Asked Questions

What is full-population testing in audit?

Full-population testing studies all transactions in a specified dataset against predetermined criteria instead of testing a representative sample and extrapolating findings. Automated scripts review the full population and reveal discrepancies, so auditors can focus on identifying anomalies instead of testing regular transactions.

Is population testing better than sampling?

Population testing is generally more advantageous when it comes to high-volume structured transaction data because it removes sampling risk and captures irregularities in clusters. The practicality of sampling is presumed to hold true when the population is small or unstructured, or if the audit inquiry of interest turns on professional judgement rather than the transaction features.

Does population testing satisfy IFC testing requirements?

Section 143(3)(i) of the Companies Act 2013 requires reporting on whether internal financial controls operate effectively. Population testing produces direct evidence of every instance in which a control operated, which is stronger evidence of operating effectiveness than an extrapolation from a sample.

What is sampling risk?

Sampling risk is the possibility that a selected sample does not accurately represent the population from which it was drawn, so that the auditor’s conclusion differs from the conclusion that testing the entire population would have produced. Population testing eliminates it, because no untested portion remains.

What skills do auditors need for data-driven testing?

In order to be successful, auditors must master data extraction skills, possess knowledge of query languages, be able to script for detecting discrepancies as well as use visualisation tools, plus know standard internal control concepts. Statistical theory remains relevant, but the practical bottleneck has moved from sample design to data access and data quality.

---

Disclaimer: This article is intended for general information and does not constitute professional advice. Statutory positions are stated as at 3 September 2026 and readers should confirm current requirements before acting.

Written by Sanjeeb Dey · Statutory references current to the Companies Act, 2013 and applicable IFC requirements.

Quick answer: No, internal audit is not yet ready, and the obstacle is capability rather than law. Section 138 of the Companies Act 2013 prescribes no interval for internal audit, and Rule 13(2) of the Companies (Accounts) Rules 2014 leaves periodicity and methodology to the Audit Committee or the Board. The annual plan is a convention, not a statutory requirement.

The annual audit plan was designed for a world where risks changed slowly. That world no longer exists. For decades internal audit has followed a familiar rhythm: build a risk-based annual plan, present it to the Audit Committee, execute it quarter by quarter and report findings after the fact. It is a model that served organisations well, until the risk landscape stopped waiting for the planning cycle. Cyber threats now emerge overnight, regulatory changes land with little warning and supply chains buckle in days rather than quarters. By the time a traditional audit is scoped, fielded and reported, the risk it was designed to catch may already have evolved into something else entirely.

Having watched the tension between the level of assurance stakeholders want and the speed at which risk actually moves, I set out below ten realities that each audit function must accept in order to shift from the current model of annual planning to a continuous risk intelligence model.

Does Indian law require the internal audit plan to be annual?

No. Most discussions of continuous auditing miss this point. It matters more in India than the global commentary suggests.

According to Section 138(1) of the Companies Act 2013, certain types of companies must appoint an internal auditor who can either be a chartered accountant or cost accountant or any other professional as per the decision of the Board. Section 138(2) empowers the government to specify how the internal audit should be done, but the by-laws drafted by it are silent about the frequency of internal audits.

In contrast, Rule 13(2) of the Companies (Accounts) Rules 2014 states that the internal audit scope, operation, periodicity, and methodology will be decided along with the internal auditor by the Audit Committee or Board.

Periodicity is therefore a governance decision taken by your Audit Committee rather than a constraint imposed by statute. A function that moves to continuous risk intelligence is not straining against the Companies Act but exercising a discretion the Act deliberately left open.

Which companies must appoint an internal auditor?

Rule 13(1) sets the thresholds, all tested against the preceding financial year:

Company type	Trigger for mandatory internal audit
Listed company	Every listed company, with no threshold
Unlisted public company	Paid-up share capital of ₹50 crore or more; or turnover of ₹200 crore or more; or outstanding loans or borrowings from banks or public financial institutions exceeding ₹100 crore at any point; or outstanding deposits of ₹25 crore or more at any point
Private company	Turnover of ₹200 crore or more; or outstanding loans or borrowings from banks or public financial institutions exceeding ₹100 crore at any point

The Explanation to Rule 13 also confirms that the internal auditor may or may not be an employee of the company, which is what makes outsourced and co-sourced internal audit models available to Indian companies.

Why is the annual audit plan becoming a historical document?

By design, a risk-based internal audit plan is a snapshot: a best guess at what risks matter, frozen at a single point in time and usually built months before execution even begins. The problem is that risk does not freeze. Thus, a plan that is approved in December might have become obsolete by March when regulations change, a merger occurs, or a system migration takes place.

This does not mean annual planning is obsolete; it means annual planning can no longer be the only mechanism for prioritising audit work. It must instead become a living document, revisited continuously rather than dusted off once a year.

Should risk assessment move from periodic to perpetual?

Yes. The shift is one of supplementation, not replacement.

Most functions still run their formal risk assessment once or twice a year, as a structured exercise involving interviews, surveys and workshops that is thorough but slow. Continuous risk intelligence flips the model: risk data is captured constantly, from operational metrics, control failures, incident logs and external signals, so that risk scores update in near real time rather than annually. The point is not to abandon structured risk assessments but to surround them with an always-on pulse of the organisation’s risk environment.

Why is data analytics no longer optional in internal audit?

Internal audit teams that still rely primarily on sampling and manual testing are structurally incapable of achieving continuous assurance, because there are simply not enough hours in the year.

Analytics changes the equation: instead of testing 30 transactions out of 30,000, audit teams can test all 30,000, flag anomalies automatically and redirect human judgement toward the exceptions that actually matter. This requires investment in tools, in data access and in skills, but the payoff is a level of coverage and speed that manual testing cannot match. The same logic already applies in asset-heavy environments, where a structured approach to fixed asset management produces the transaction-level data that continuous testing depends on.

What is the difference between continuous auditing and continuous monitoring?

These terms get used interchangeably. They should not be. They serve different purposes, sit with different owners and produce different kinds of evidence.

	Continuous monitoring	Continuous auditing
Owner	Typically management	Internal audit
Position	Embedded into business processes	Independent of the process
Purpose	Flag control breakdowns as they happen	Ongoing independent testing of controls and transactions
Typical method	Process-embedded alerts and dashboards	Automated audit scripts and audit-owned dashboards

A mature internal audit function does not simply rely on management’s monitoring; it builds its own independent continuous auditing capability, while also learning to treat management’s monitoring data as a risk signal in its own right.

What does the Audit Committee actually want from internal audit?

Expectations from Boards and Audit Committees are changing: though a report on the failures of the past quarter does provide some value, it is ultimately focused on history, whilst Committees now prefer a more forward-thinking perspective to understand better what risks are on the rise, where the controls show signs of weakness, and which additional areas need attention in future.

This is a fundamental repositioning of internal audit’s value proposition, from a rearview mirror to something closer to a radar system. It is also, under Rule 13(2), a conversation the Audit Committee is statutorily entitled to have with you about methodology and periodicity. The expectations placed on that dialogue are already visible in NFRA communication between auditors and Audit Committees, where the regulator has pressed for substantive rather than procedural exchange.

Why does technology risk break the traditional audit cycle?

Cloud migrations, artificial intelligence adoption, third-party integrations and cybersecurity threats evolve on a timeline measured in weeks, not the twelve to eighteen month cycle typical of a traditional IT audit rotation, which means that a system touched once every year or two is effectively audited as a version of itself that may no longer exist when the report is issued. Technology risk, more than almost any other risk category, demands continuous visibility rather than periodic deep dives.

How are talent requirements changing for internal auditors?

Continuous risk intelligence is not merely a technology upgrade. It is a talent transformation. Auditors need to be comfortable with data querying, with visualisation tools and, increasingly, with understanding how artificial intelligence and machine learning models work well enough to audit them, because the traditional profile of an auditor skilled primarily in controls testing and documentation review, however valuable it remains, is no longer sufficient on its own.

Forward-thinking functions now hire data scientists, engineers and analytics specialists alongside traditional auditors, and cross-train existing staff to bridge the gap. The ICAI Internal Audit Standards Board, which issues the Standards on Internal Audit, is the reference point Indian functions should be tracking as this expectation formalises.

Why do data silos block continuous risk intelligence?

Continuous risk intelligence depends on access to live data from ERP systems, GRC platforms, incident management tools, HR systems and external threat intelligence feeds. Yet in many organisations this data lives in disconnected silos, each with its own owner, format and access restrictions, and each requiring a separate negotiation before internal audit can see it.

Building the capability is as much an organisational and political challenge as a technical one. It requires data access agreements, data governance standards, and often the persuasion of other functions that sharing data with internal audit benefits everyone. Our guide to compliance, documentation and risk management sets out how that documentation layer is usually built.

Can third-party risk still be reviewed once a year?

No. Annual vendor risk assessments have become insufficient because of the speed with which third-party risks can emerge, as various incidents such as data breaches at a vendor, geopolitical disruptions and financial distress on the part of a key supplier can occur within a matter of weeks.

Continuous risk intelligence extends monitoring beyond the four walls of the organisation, incorporating real-time signals about vendor financial health, news events and even social sentiment. Many audit functions still lag here, treating third-party risk as a compliance exercise rather than a live risk category demanding ongoing attention.

Is continuous risk intelligence a replacement for traditional audits?

No. This is perhaps the most important point of all. Continuous risk intelligence does not mean abandoning traditional audit engagements. Deep-dive audits, control testing and independent assurance work still matter, especially for risks that require nuanced professional judgement, complex fraud investigation or detailed process walkthroughs that automation cannot fully replicate.

The future is not continuous risk intelligence instead of annual audit plans but a hybrid model. Continuous monitoring and analytics feed a dynamic, frequently updated risk register, which in turn informs a more agile audit plan, one that can pivot mid-year when new information demands it rather than waiting for the next annual cycle.

How mature is your internal audit function?

A simple maturity test for the internal audit process, against which most Indian functions we encounter sit at Level 1 or Level 2.

Level	Stage	What it looks like
1	Periodic audit	Annual risk assessment, sample-based testing, periodic reporting
2	Data-enabled audit	Analytics-supported testing, exception reporting, improved audit coverage
3	Continuous assurance	Continuous monitoring, automated control testing, risk-based alerts
4	Dynamic risk intelligence	Real-time risk sensing, predictive analytics, integrated governance intelligence
5	Strategic risk intelligence	Assurance supported by artificial intelligence, continuous risk intelligence, predictive control insights, board-level risk foresight

The dilemma facing the Chief Audit Executives, Chief Financial Officers, and Audit Committees is not if internal audit employs artificial intelligence but how rapidly it can notice a significant swing in risk, how quickly that signal can reach those who can implement change, and how quickly managers will react. Auditors who can answer the question will not necessarily be the auditors who perform the most audits. Rather, those auditors are the ones who combine business acumen with risk knowledge, technological skills, data analytics expertise, and professional judgement to indicate what the control is, how the data determines whether the control works, what signals indicate the risk situation is shifting, and what the management team must do before the risk crystallises. That is the transition from internal audit as an assurance function to internal audit as a risk intelligence partner.

So, is internal audit ready?

Honestly? Not yet. Not universally. Many functions are still investing heavily in traditional planning cycles, manual testing and annual risk assessments, while continuous risk intelligence remains a conference-session aspiration rather than daily practice. But the direction of travel is unmistakable, because organisations generate risk-relevant data faster than ever, stakeholders expect faster insight, and the tools for continuous assurance have never been more accessible.

The functions that will thrive are the ones that start now, by building analytics capabilities, breaking down data silos, upskilling their people, and reshaping their relationship with the Audit Committee from “here is what happened” to “here is what is coming.” The annual audit plan is not disappearing. But it can no longer stand alone. When risks move in real time, assurance cannot remain static. The next generation of internal audit will be defined not by how many audits it completes but by how early it helps the organisation see what is coming.

How SBC works with internal audit functions

Steadfast Business Consulting (SBC) views internal audit and governance not as a mere periodic compliance process but as the development of a dynamic risk and control intelligence function. SBC’s Financial and Risk Advisory practice serves listed and unlisted companies in the areas of internal audit, ongoing internal audit transformation, co-sourcing, control testing, enterprise risk management, SOP development and Internal Financial Controls compliance under the Companies Act 2013. The starting point is not technology but an honest assessment of the current status of the risk intelligence capability of the organisation. If the organisation is now thinking of moving to continuous risk intelligence, the SBC internal audit team would be glad to discuss the opportunity.

Frequently Asked Questions

Is an annual internal audit plan legally required in India?

No. Section 138 of the Companies Act 2013 prescribes no interval for internal audit. Rule 13(2) of the Companies (Accounts) Rules 2014 assigns the scope, functioning, periodicity and methodology to the Audit Committee or the Board, in consultation with the internal auditor. An annual cycle is a professional convention.

Does a listed company need to cross a threshold before internal audit applies?

No. Rule 13(1) of the Companies (Accounts) Rules 2014 applies to every listed company with no threshold at all. The turnover, borrowing, paid-up capital and deposit tests apply only to unlisted public companies and private companies, and each of those tests is measured against the preceding financial year.

Can internal audit rely on management’s monitoring data?

Not as a substitute for its own testing. Continuous monitoring is owned by management and embedded in the process, so it is not independent evidence. A mature function builds its own continuous auditing capability and treats management’s monitoring data as a risk signal in its own right, rather than as assurance.

Can an internal auditor be an employee of the company?

Yes. The Explanation to Rule 13 of the Companies (Accounts) Rules 2014 states expressly that the internal auditor may or may not be an employee of the company. This is what permits outsourced and co-sourced internal audit arrangements in India.

Does continuous risk intelligence replace deep-dive audits?

No. Deep-dive audits remain necessary for risks requiring nuanced professional judgement, complex fraud investigation and detailed process walkthroughs. The realistic model is hybrid, in which continuous analytics feed a dynamic risk register that informs a more agile audit plan.

---

Disclaimer: This article is intended for general information and does not constitute professional advice. Statutory positions are stated as at 3 September 2026 and readers should confirm current requirements before acting.