02 Jun 2026 · 7 min
Sampling methods for transaction monitoring reviews
Inflating sample sizes to look diligent is a common panic move. It burns analyst time and still fails if the population definition is fuzzy.
Transaction monitoring controls usually claim that alerts are reviewed within a stated window and escalated when risk criteria are met. Testing that claim requires a population you can regenerate — not a spreadsheet someone filtered by hand last Tuesday.
Write the population as a query
Document the exact filters: alert types in scope, date boundaries, and statuses included. If your tool cannot re-run that query, you are testing a snapshot, not a control population. Note that limitation before fieldwork.
Separate high-severity and low-severity strata
Mixing critical fraud alerts with informational noise in one sample invites either under-coverage of severe cases or wasted effort on trivia. Stratify, then size each stratum to risk — and explain the math in two plain sentences auditors can quote.
Treat migration gaps as known limitations
When systems change mid-period, do not hide the missing week. Frame it, adjust the sample frame, and agree language with management early. Surprises in the closing meeting cost more than an honest limitation paragraph.
Keep deviation language specific
“Late review” means little without timestamps from the system of record. Capture opened-at and closed-at fields in your evidence pack so conclusions are re-performable.
Our Transaction Monitoring Sample Lab drills these choices with live critique. See courses or ask for dates.