Summary: A random sample of loan files is built to catch errors spread evenly through a book. It is weak against errors that cluster: a fee table set wrong for a week, or a release that let loans fund before the borrower signed. In a fictional 10,000-loan book, a 40-loan sample has about a 45 percent chance of containing none of 200 affected loans. PCAOB AS 2315 does not change that math; the amendment taking effect December 15, 2026 touches one paragraph on nonsampling risk. What has changed is the cost of testing every loan.
How loan file sampling works today
PCAOB AS 2315 defines audit sampling as “the application of an audit procedure to less than 100 percent of the items within an account balance or class of transactions for the purpose of evaluating some characteristic of the balance or class.” Loan file testing is usually a test of controls: did the control that should have operated on every loan operate on the loans in the sample?
For tests of controls the auditor sets a tolerable rate, “the maximum rate of deviations from the prescribed control that he would be willing to accept without altering his planned assessed level of control risk.” An auditor planning to rely heavily on the control “might decide that a tolerable rate of 5 percent or possibly less would be reasonable.”
Sample size follows from the tolerable rate, the likely rate of deviations and the allowable risk of assessing control risk too low. Paragraph .41 gives the worked case: “if the tolerable rate for a population is 5 percent and no deviations are found in a sample of 60 items, the auditor may conclude that there is an acceptably low sampling risk that the true deviation rate in the population exceeds the tolerable rate of 5 percent.” Internal audit and compliance testing borrow the same approach with smaller samples; this post uses 40.
Scattered errors and clustered errors
Sampling assumes deviations are spread through the population. Paragraph .39: “Sample items should be selected in such a way that the sample can be expected to be representative of the population. Therefore, all items in the population should have an opportunity to be selected.” A fair draw is good at finding what is common and poor at finding what is rare.
In a loan book, the defects that matter are rarely spread evenly. They come from a cause with a start date and an end date: a fee table updated with the wrong value and corrected weeks later, or a new e-signature vendor that let loans fund before the borrower signed the ACH authorization, for one release cycle.
Each is a block of loans with the same defect. Inside the block the deviation rate is 100 percent; outside it, zero. Averaged over the year the rate might be 1 or 2 percent, under most tolerable rates. It is still every affected borrower, and that is the number a regulator counts.
Worked example: what share of samples finds nothing
A fictional lender, round numbers. Example Lender originates 10,000 installment loans a year, about 190 a week. In March, a configuration change applied a $25 origination fee to a product whose state limit is $15. The error ran for a little over a week before a borrower complained, so 200 loans carry it. Internal audit draws 40 loans at random from the year.
The chance that one random pick misses the affected block is 9,800 out of 10,000, or 98 percent. The chance that all 40 picks miss is 98 percent multiplied by itself 40 times, with a small adjustment because loans are drawn without replacement. The answer is about 45 percent. Nearly half the time, the sample comes back clean and the finding reads “no exceptions noted.”
The same sample against other block sizes:
| Affected loans | Share of book | Chance the 40-loan sample contains none |
|---|---|---|
| 50 | 0.5% | 82% |
| 100 | 1% | 67% |
| 200 | 2% | 45% |
| 500 | 5% | 13% |
| 1,000 | 10% | 1.5% |
A problem that touches one loan in ten gets caught almost every time, which is what the sample was designed for. A problem that touches one loan in a hundred is missed two times in three. To have a 95 percent chance of landing at least one of 100 affected loans, the sample would need about 294 loans; for 200 affected loans, about 148.
What the revised PCAOB standard changes
Less than the headlines suggest. The PCAOB adopted the amendment to AS 2315 on May 13, 2024, in Release No. 2024-005, the release that adopted the new quality control standard QC 1000. It is a conforming change to one paragraph, .11, on nonsampling risk. The revised paragraph ends: “Nonsampling risk can be reduced to a negligible level through such factors as adequate planning and supervision and proper conduct of a firm’s audit.” The current text adds “practice” and a cross-reference to AS 1110, which is being rescinded.
The effective date was originally December 15, 2025. On August 28, 2025 the PCAOB filed a rule change with the SEC that “would delay the effective date of the new and amended standards, rules, and forms described in PCAOB Release No. 2024-005 and identified in the Board’s May 24, 2024 Form 19b-4 from December 15, 2025, to December 15, 2026.” The list names AS 2315.
So tolerable rate, sampling risk and representative selection are unchanged going into 2027. What is worth re-reading is paragraph .07 on when sampling is justified: “If these factors do not justify the acceptance of some uncertainty, the only alternative is to examine all of the data.” The factors are “the cost and time required to examine all of the data” against the consequences of a wrong conclusion. When the cost of examining all of the data falls, that balance moves.
Testing the full population: what it takes and what auditors still judge
Testing every loan for one attribute needs a written rule precise enough to check: not “fees are reasonable” but “origination fee on product X in state Y is at most $15.” It needs every loan’s documents and payment history in a form the rule can be applied to. And it needs a result per loan that points at the evidence. What comes back is a count and a date range rather than a projection: 200 loans, March 3 to March 11, product X, fee $25 against a $15 limit. That is a remediation list, not an estimate.
What it does not remove is judgment. Paragraph .11 is direct: “An auditor may apply a procedure to all transactions or balances and still fail to detect a material misstatement.” A rule written wrong checks every loan wrong. Someone still decides which attributes to test, whether the extracted values are reliable, and what the exceptions mean. Paragraph .21 already allows for the split: “Any items that the auditor has decided to examine 100 percent are not part of the items subject to sampling.” The practical change is that the set of attributes worth examining 100 percent grows.
How the automated version works
MightyBot is an AI agent platform for lending and finance. Agents run the check described here on every loan rather than a sample: the rule is written in plain English, applied to each file’s extracted terms and payment history, and each finding cites the page or transaction behind it. Exceptions route to a person for approval with the evidence attached, so the reviewer’s judgment goes into the exceptions rather than the draw.
The loan-level checks are described on the compliance monitoring page, and the rule-writing side on the policy engine page.
