An annual audit tests a control by sampling 25 changes from the 10,000 made that year. Suppose 5% of changes actually violate the control. Roughly what is the probability that the sample contains at least one violation?

The arithmetic

The chance a single sampled item is clean is 0.95. For 25 independent draws from a large population, the chance that every one is clean is 0.95^25 ≈ 0.28.

So the chance of catching at least one violation is 1 − 0.28 ≈ 0.72.

Two things follow immediately, and both change how you read an audit report.

What the number rules out

At a 1% violation rate the same sample catches something only about 22% of the time (1 − 0.99^25). The rarer the violation, the blinder the sample — and rare, high-impact violations are exactly the ones assurance exists to find. A clean sample is weak evidence of a clean population, and it is routinely reported as if it were strong evidence.

It also sets a floor on what sampling can promise. To have a 95% chance of catching a 1% rate you need roughly 300 samples, which no annual audit performs by hand. The only way out of the arithmetic is to stop sampling.

What continuous controls monitoring actually changes

Testing the whole population automatically changes the detection probability from 72% to 100% for anything the automated test can express, and it changes the latency from one year to one day. That second change is worth more than the first: a violation found within a day is a fix, and one found eleven months later is an incident report.

The honest cost: an automated test can only assert what is machine-checkable. Whether a change was appropriate remains a judgement, so sampling does not disappear — it moves to the questions machines cannot answer, with a much smaller population to draw from.

Why the other options fail

• About 5% mistakes the violation rate for the detection probability. It is the intuition that "5% are bad so we have a 5% chance", and it confuses the property of one item with the property of a sample of 25.
• About 28% is 0.95^25, the probability of missing every violation. Computing the right quantity and reporting its complement is the most common slip in this calculation, and it reverses the conclusion.
• About 95% comes from reading "statistically valid sample" as "95% confidence of detection". The confidence level in a sampling plan describes the precision of an estimated rate, not the chance of catching an instance.

When not to replace sampling

Statistical sampling in audit has been formalised since the 1970s and it is not obsolete; it is misapplied. Choose it when the population is small, when the test requires judgement, or when the control's output is not machine-readable, because a machine cannot assert what it cannot read. A sample of 25 from 40 quarterly access reviews is a reasonable way to ask whether reviewers were thinking, and no automated check answers that. The error is using sampling for the things a machine could have tested in full.