Answer:
If you are performing an "audit" of your bank's procedures, taking sample is certainly permissible. The complexity of your financial institution's procedures are driven by the initial risk assessment. The procedures that are implemented must be applied to ALL covered accounts. However, the regulation does not permit you to pick & choose which consumers will be protected. There was an excellent response to this question published earlier this year right here on BOL.
First published on BankersOnline.com 2/09/09