An auditor is asked to select a judgmental sample from a population of 1 000 clients onboarded during the previous 12 months. Which step should the auditor take first?

Judgmental sampling is a risk-based approach where the auditor uses professional judgment to select items for testing. The essential first step is to establish a clear and consistent basis for that judgment. Reviewing the institution's Customer Due Diligence (CDD) onboarding policies and procedures provides the auditor with the institution's own defined criteria for risk (e.g., high-risk jurisdictions, industries, products). This understanding is fundamental to selecting a sample that effectively targets the areas of greatest AML risk, aligning the audit test with the institution's risk appetite and control framework.

B. Evaluating quality assurance processes is a separate audit activity, not the initial step for sample selection.
C. Initially sampling a fixed percentage (10%) is a characteristic of statistical sampling, not judgmental sampling.
D. Requesting a list of high-risk clients is a logical subsequent step, but it can only be done after understanding how "high-risk" is defined in the policies.

1. ACAMS. (2023). Advanced CAMS-Audit Certification Study Guide. Chapter 3, "The Audit Process - Planning and Conducting the Audit." The subsection on "Sampling" explains that judgmental sampling is based on risk factors and criteria, which are outlined in the institution's policies and procedures.

2. Institute of Internal Auditors (IIA). (2017). Practice Guide: Internal Auditing and the Second Line of Defense. This guide discusses how internal audit should understand the organization's risk management framework (which includes policies) before designing audit tests.