Sampling alerts is not the same as sampling money

Internal audit plans for financial-crime units often start with alert samples: was the alert dispositioned on time, was the narrative complete, was the case escalated. Those tests matter for operations. They do not test the financial integrity of the application.

A financial sample starts from amounts. We stratify cases by value, by type of financial event, and by whether the amount was system-calculated or keyed. A RM 80 fee auto-charged to a unit and a RM 1.2 million recovery are not the same population. Mixing them in one random sample of “cases” produces comfort that is statistically tidy and financially empty.

We also sample negative amounts and zeros. Write-offs reversed, holds released, and fees waived are where applications quietly lose their audit trail — a field overwritten, a status that does not keep history, an extract that drops reversed rows.

For institutions filing under Malaysian financial reporting practice, the application may feed provisioning judgements. If estimated recovery is stored on the case and later used by finance, that field is a financial estimate. It needs a sample, a policy link, and evidence of who can change it.

When we write a sampling memo, we state the population, the frame, the method, and what the sample cannot support. That last sentence is the one examination teams notice.

Bring a similar question to the Kuala Lumpur desk