(a) If the specified procedures require evaluation of a representative sample from the overall population for a given data set, determine the number of results for evaluation using one of the following methods:
(1) Determine sample size using the following table:
Table 1 to Paragraph (a)(1)—Sample Size Determination
| Population
| Sample size
|
|---|
| 1-25 | The smaller of the population or 19.
|
| 26-40 | 20.
|
| 41-65 | 25.
|
| 66 or more | 29. |
(2) Determine sample size corresponding to a confidence level of 95 percent, an expected error rate of 0 percent, and a maximum tolerable error rate of 10 percent, using conventional statistical principles and methods.
(3) Determine sample size using an alternate method that is equivalent to or better than the methods specified in paragraphs (a)(1) and (2) of this section with respect to strength of inference and freedom from bias. An auditor that determines a sample size using an alternate method must describe and justify the alternate method in the attestation report.
(b) Select specific data points for evaluation over the course of the compliance period in a way that leads to a simple random sample that properly represents the overall population for the data set.