FreePublished on GitHub

audit-sampling-methods

Guides privacy audit sampling methodology including statistical and non-statistical sampling, sample size determination, stratification techniques, attribute sampling for compliance testing, confidence level selection, tolerable deviation rates, and extrapolation of results to the population. Keywords: audit sampling, statistical sampling, attribute testing, sample size, confidence level, stratified sampling, privacy audit.

The English summary is being prepared. Showing the original description.

mukul975/Privacy-Data-Protection-Skills

See how to install

Files included (5)

SKILL.md6.1 KB
assets/template.md3.3 KB
references/standards.md3.0 KB
references/workflows.md5.2 KB
scripts/process.py7.9 KB

SKILL.md (original)

Review the instructions the agent will receive before you install.

Privacy Audit Sampling Methods

Overview

Audit sampling is the application of audit procedures to less than 100% of items within a population to form a conclusion about the entire population. In privacy auditing, sampling is used to test compliance of processing activities, DSAR responses, consent records, vendor contracts, and other privacy controls without examining every individual record.

ISA 530 (International Standard on Auditing — Audit Sampling) and IIA Practice Advisory 2320-3 (Audit Sampling) provide the authoritative frameworks. For privacy audits, sampling must account for the heightened regulatory scrutiny of personal data processing and the potential for significant harm from individual non-compliant records.

Sampling Approaches

Approach	Description	When to Use
Statistical Sampling	Uses probability theory to select samples and evaluate results; allows quantification of sampling risk	When audit conclusions must be defensible to regulators; large populations; need to extrapolate results
Non-Statistical (Judgemental) Sampling	Auditor uses professional judgement to select items	Small populations; targeted testing of known risk areas; supplementary to statistical sampling

Statistical Sampling Methods

Attribute Sampling

Used to estimate the rate of deviation (non-compliance) in a population.

Parameter	Description	Typical Privacy Audit Values
Population Size	Total items in the auditable population	e.g., 1,000 DSARs, 500 vendor contracts
Confidence Level	Probability that sample results reflect the population	90% (standard); 95% (regulatory-facing)
Tolerable Deviation Rate	Maximum acceptable non-compliance rate	5% (standard); 2% (critical controls)
Expected Deviation Rate	Estimated actual non-compliance rate	Based on prior audits or risk assessment
Sample Size	Number of items to test	Calculated from above parameters

Sample Size Reference Table (Attribute Sampling)

Population	90% Confidence / 5% Tolerable	95% Confidence / 5% Tolerable	95% Confidence / 2% Tolerable
100	38	45	64
250	42	50	100
500	44	54	131
1,000	45	57	154
5,000	46	59	176
10,000+	46	59	181

Stratified Sampling

Divides the population into subgroups (strata) and samples proportionally or disproportionately from each.

Stratification Factor	Example Strata	Rationale
Business Unit	EU, US, APAC	Different regulatory requirements per jurisdiction
Data Sensitivity	Standard, sensitive, special category	Higher-risk data categories warrant more testing
Processing Purpose	Marketing, HR, customer service	Different compliance requirements per purpose
Time Period	Q1, Q2, Q3, Q4	Detect seasonal patterns or deterioration
Vendor Tier	Tier 1 (high volume), Tier 2, Tier 3	Focus sampling on highest-risk vendors

Non-Statistical Sampling Methods

Method	Description	Application
Haphazard Selection	Items selected without structured method but avoiding bias	Quick preliminary testing
Block Selection	All items in a specific period or location	Testing a specific time window (e.g., all DSARs in March)
Judgemental Selection	Auditor selects items based on risk factors	Targeting high-value items, known exceptions, or anomalies

Privacy-Specific Sampling Considerations

Consideration	Guidance
Individual harm threshold	Even a single non-compliant record can cause significant harm; auditors must not dismiss isolated findings
Regulatory expectations	Supervisory authorities may expect higher confidence levels for critical controls (breach notification, consent)
Special category data	Apply lower tolerable deviation rates (2%) for processing involving special category data under Article 9
Automated processing	For fully automated processes, increase sample to verify algorithmic consistency across edge cases
Cross-border transfers	Stratify by destination country to verify adequacy/safeguard mechanism for each transfer route

Evaluating Sample Results

Scenario	Sample Deviation Rate	Conclusion
Rate below tolerable deviation	e.g., 2% observed vs 5% tolerable	Population likely compliant; no material finding
Rate equals tolerable deviation	e.g., 5% observed vs 5% tolerable	Borderline; consider expanding sample or raising as medium finding
Rate exceeds tolerable deviation	e.g., 12% observed vs 5% tolerable	Material non-compliance; formal finding required
Zero deviations found	0% observed	Strong evidence of compliance (but does not guarantee 100%)

Extrapolation

When sample results show deviations, the auditor must project findings to the full population:

Element	Calculation
Point estimate	(Deviations found / Sample size) × Population size
Upper deviation limit	Calculated using statistical tables at the selected confidence level
Projected monetary impact	Point estimate × average impact per deviation

Reviews

No reviews yet. Tell others what you thought.

Comments

No login needed. Share how it worked for you, ask a question, or note where it did not run.

No comments yet. Be the first to write one.

More skills from this repository

42-cfr-part-2

Free

Implements 42 CFR Part 2 protections for substance use disorder patient records. Covers written consent requirements stricter than HIPAA, re-disclosure prohibition, court order procedures, qualified service organization agreements, and 2024 amendments aligning Part 2 with HIPAA. Keywords: 42 CFR Part 2, substance use disorder, SUD records, re-disclosure, consent, Part 2 amendments.

The English summary is being prepared. Showing the original description.

mukul975/Privacy-Data-Protection-Skills313Updated Mar 17, 2026

adequacy-assessment

Free

Guides assessment of third-country adequacy decisions under GDPR Article 45 for international data transfers. Covers the current EC adequacy decisions list, adequacy assessment criteria, partial adequacy handling, and monitoring of adequacy decision reviews. Keywords: adequacy decision, Article 45, third country, adequate protection, EC adequacy list.

The English summary is being prepared. Showing the original description.

mukul975/Privacy-Data-Protection-Skills313Updated Mar 17, 2026

age-gating-services

Free

Implements age-gating mechanisms for online services to restrict access based on user age. Covers hard gates versus soft gates, neutral age prompts, re-verification triggers, circumvention prevention, and regulatory requirements under GDPR, COPPA, UK Online Safety Act, and DSA. Keywords: age gate, age restriction, neutral prompt, children, online services, access control.

The English summary is being prepared. Showing the original description.

mukul975/Privacy-Data-Protection-Skills313Updated Mar 17, 2026

age-verification-methods

Free

Evaluates and implements age estimation and verification technologies for online services. Covers facial age estimation, digital ID verification, self-declaration with risk assessment, AI-based age estimation, and the accuracy versus privacy tradeoff. Includes ICO guidance and euCONSENT framework. Keywords: age verification, age estimation, facial analysis, digital ID, children, online safety.

The English summary is being prepared. Showing the original description.

mukul975/Privacy-Data-Protection-Skills313Updated Mar 17, 2026

ai-act-high-risk-docs

Free

Preparing EU AI Act compliance documentation for high-risk AI systems. Covers Annex III classification, technical documentation under Art. 11, conformity assessment, risk management systems, and CE marking requirements. Keywords: EU AI Act, high-risk AI, Annex III, conformity assessment, CE marking.

The English summary is being prepared. Showing the original description.

mukul975/Privacy-Data-Protection-Skills313Updated Mar 17, 2026

ai-automated-decisions

Free

Implements GDPR Art. 22 automated decision-making and AI Act Art. 14 human oversight requirements for AI systems. Covers identification of solely automated decisions, meaningful human intervention design, logic explanation mechanisms, and contestation procedures. Keywords: Art. 22, automated decision, human oversight, AI Act, profiling, contestation.

The English summary is being prepared. Showing the original description.

mukul975/Privacy-Data-Protection-Skills313Updated Mar 17, 2026

See all skills by mukul975

Report a problem with this skill

Install

Install with a command

npx skills add https://github.com/mukul975/Privacy-Data-Protection-Skills --skill audit-sampling-methods

Paste it into your terminal and run it (requires Node.js). You can choose which agents to install it for, such as Claude Code or Codex.

Ask your agent

Please install the following Agent Skill.
https://github.com/mukul975/Privacy-Data-Protection-Skills/tree/main/skills/privacy/audit-sampling-methods

First review SKILL.md and the bundled files and confirm there is nothing suspicious (such as sending data externally or reading credentials). Then place it in ~/.claude/skills/audit-sampling-methods/ for Claude Code, or ~/.agents/skills/audit-sampling-methods/ for Codex.

Send this text to Claude Code or Codex as is. It checks the contents before installing.

View source on GitHub

Repository: mukul975/Privacy-Data-Protection-Skills
Stars: 313
Forks: 61
Category: Testing & Security
License: Apache-2.0
Original language: English
Last updated: Mar 17, 2026

A skill is a set of instructions and scripts for an agent. cccskills does not guarantee that skills are safe. Review the contents before you install.