Blog
September 2026

Providers picture an audit as auditors talking to everyone. They do not. The audit scheme sets the number, a formula does the sum, and the auditor chooses who. Knowing the arithmetic changes how you prepare, because it tells you that the sample is small, that it is not yours to shape, and that it grows when something is found.
Take the number of participants you support. Remove any who receive only supports that sit outside the certification scope, the verification-only classes. Take the square root of what is left, and round up. That is the minimum number of participants the auditor will sample at a full certification audit.
Worked:
At a mid-term audit, the surveillance check between full audits, the sample is 0.6 of that number, rounded up. Fifty participants gives 8 at certification and 5 at mid-term.
The same formula applies to sites. Square root of the number of sites, rounded up, and the head office is always included on top.
Confirm the rounding in your own auditor's guidebook. The scheme sets the formula; auditors restate it, and they restate it consistently, but it is their restatement your audit runs on.

Not you. The scheme is explicit that the provider must not pre-select the sample. You provide a sampling plan before stage two, listing participants with the classes and sites they belong to, and the auditor picks from it. They pick to cover your classes and your sites, and they pick the cases that will test the system: the newest participant, the one with the most incidents, the one whose plan changed last month.
Participation is opt-out, not opt-in. Participants are in the pool unless they decline, and the provider's job is to have asked, usually through the service agreement, and to have recorded the answer.
This is the part that matters most and is least known. If the auditor finds a non-conformity inside the minimum sample, the sample increases, by the number of non-conformities found, to test whether the problem is systemic. One bad file in a sample of eight becomes a sample of nine. Three bad files become a sample of eleven.
So a provider with one weak participant file is not carrying one risk. It is carrying the risk that the auditor, having found it, looks harder. The arithmetic rewards consistency across every file more than excellence in a few.
A provider with three participants has a sample of two. There is no hiding in a sample that size, and there is no hiding a provisional audit either: with no participants yet, the auditor assesses the templates and the key personnel, and every field on every form is the evidence.
Your audit is eight files and eight conversations you did not choose. If you can name the eight you would rather they did not open, so can they.
Everything above is drawn from the AQA Scheme Guidelines' sampling rules as restated in the auditors' published guidebooks, and from the sampling recorded in the real audit reports in our reference pack. Confirm the rounding convention with your own auditor.
We’ll show you a certification done in ten hours.
You decide whether it holds up.