I wrote all of this and then realized Mohammed basically stated the same idea. I think we are both saying the same thing.
I think that is the problem with just declaring "X" number of samples for each zone. Or, even using sites picked at random. While these are sometimes accepted during audits, there is certainly room for interpretation as to how risk was used to determine them and usually leave a lot of room for risk.
What I have done in the past is to create a register of all possible areas to sample . All zone 1, zone 2, zone 3, and zone 4. You can further break it down by difficulty to clean as is shown in the 3m environmental monitoring handbook.
https://multimedia.3...ng-handbook.pdf
The highest risk areas (zone 1 or zone 1 hard to clean) would be assigned the highest frequency - like weekly. The second highest risk areas (zone 2 or zone 1 easy to clean) would be assigned a frequency less than that of higher risk areas - in this case call it monthly. Then continue until all risk areas are assigned a frequency. When areas test positive then can be moved to a higher risk category. You would still have the opportunity for someone to questions why you chose "X" frequency and not something else. IMO people are less likely to question this as opposed to random numbers of samples and /or sites.