This will depend on a provider's agreed sampling strategy and on how the strategy is intended to be applied. It could yield the same sample and it may not. It is more than likely that the chosen samples will be different for internal verification and external authentication, as both processes have very different functions.