The principle here should be the same as the principle of proper auditing.

Take the population of x , then sample y and if the sample passes the tests then you have z degree of confidence of projecting the results of the sample over the entire population.

Its not hard. Its only that bureaucrats are generally not hired for the industry knowledge but instead career paper pushers and ticking boxes on their way up, instead of, you know, getting dirty with actual work