Sampling customer files without theatre

Supervisors rarely argue with a finding that is tied to a named file. They do argue with vague claims that “controls look strong.” Sampling is where those two worlds meet.

For a payment institution with a few thousand active merchants, we usually start by stratifying onboarding cohorts: high-risk verticals, cross-border payouts, and accounts opened in the last quarter. Random draws inside each stratum keep the sample honest without pretending every file carries equal risk.

Document the seed logic before you open the first folder. If management later expands the population, you can restate the method instead of inventing a new one under pressure.

When a file fails, record the exact control that broke—missing beneficial-owner evidence, stale ID, or an unapproved risk override—not a general remark about “culture.” Specificity is what turns a sample into a remediation list a compliance team can actually close.