Engagement Evaluation Criteria

Introduction
Engagement evaluation criteria are one of the most heavily tested concepts in the engagement planning domain of the CIA Challenge Exam. Every audit finding, conclusion and recommendation depends on comparing what is against what should be. The criteria are the what should be. Without them, an internal auditor has no objective basis to say whether something is working well or poorly.

Why Engagement Evaluation Criteria Are Important
1. They provide an objective basis for judgment. Criteria turn personal opinion into a professional, defensible assessment. Management is far more likely to accept a finding measured against an agreed standard than one based on the auditor's preferences.
2. They are required by the IIA Standards. Under the Global Internal Audit Standards (Standard 13.4, Evaluation Criteria) and the former Standard 2210.A3, internal auditors must identify the criteria needed to evaluate the activity under review. When criteria are inadequate, auditors must work with management to develop appropriate ones.
3. They anchor the elements of a finding. A finding has four parts: Criteria (what should be), Condition (what is), Cause (why the gap exists) and Effect or consequence (the risk or impact of the gap). A common memory aid is the 4 Cs: Criteria, Condition, Cause, Consequence. Without criteria there is no gap and no finding.
4. They reduce disputes and support communication. Discussing criteria with management during planning prevents disagreements at the reporting stage.
5. They help assess governance, risk management and control. Criteria show whether management has set clear objectives and performance measures. The absence of criteria can itself signal a control weakness.

What Engagement Evaluation Criteria Are
They are the standards, measures, expectations or benchmarks against which the activity under review is evaluated. They describe the desired state or expected performance.

Common sources of criteria:
- Internal sources: organizational policies and procedures, budgets, strategic plans, KPIs, service level agreements, board-approved risk appetite statements, job descriptions and approved process designs.
- External sources: laws and regulations, contractual terms, industry standards and best practices, professional frameworks (COSO Internal Control and ERM, COBIT, ISO standards, NIST), and benchmarks from peer organizations.
- Developed criteria: when no adequate criteria exist, criteria agreed between the internal auditor and management, possibly with input from the board or subject matter experts.

Characteristics of good criteria:
- Relevant: aligned with the objectives of the activity and the engagement.
- Reliable: produce consistent conclusions when applied by different auditors.
- Neutral or objective: free from bias.
- Understandable: clear to auditors, management and report users.
- Complete: cover all significant aspects relevant to the objectives.
- Measurable: allow evaluation of performance (some texts add attainable, timely and comparable).

How It Works: The Process in Engagement Planning
Step 1: Understand the activity under review. The auditor learns the activity's objectives, the means by which performance is monitored, significant risks and the controls in place.

Step 2: Identify existing criteria. The auditor determines whether management has established criteria, such as policies, performance targets, regulatory requirements and contractual obligations.

Step 3: Assess the adequacy of the criteria. The auditor asks whether the criteria are appropriate and sufficient to determine whether objectives and goals have been achieved. Criteria may be outdated, vague, incomplete, inconsistent with laws, or misaligned with organizational strategy.

Step 4: Respond to the assessment.
- If criteria are adequate, the auditor uses them in the evaluation.
- If criteria are inadequate or missing, the auditor works with management to develop appropriate criteria. The auditor may suggest frameworks or best practices, but management owns and approves them. The Standards emphasize collaboration; the auditor does not simply impose criteria.
- If management and the auditor cannot agree, the matter may be escalated to senior management or the board, and the engagement communication should disclose the criteria used.

Step 5: Document and communicate. The criteria are documented in the engagement work program and workpapers. They are typically discussed with management at the opening meeting or in the engagement memo. Final communications should state the criteria used, especially in assurance engagements.

Step 6: Apply criteria during fieldwork. Testing compares the observed condition with the criteria. Any significant gaps lead to findings, root cause analysis and recommendations.

Criteria in Different Engagement Types
- Compliance audits: laws, regulations, contracts and internal policies.
- Operational or performance audits: efficiency and effectiveness measures, KPIs, benchmarks and budgets.
- Financial audits: accounting frameworks (IFRS, GAAP) and internal accounting policies.
- IT audits: COBIT, ISO 27001, NIST and internal IT security policies.
- Consulting engagements: criteria are often agreed with the client and depend on the engagement's purpose.

Example
An internal auditor is planning a review of the procurement function. Company policy requires three competitive bids for purchases above 50,000 dollars. This policy is the criterion. However, the auditor notes the policy was last updated eight years ago and conflicts with a new government procurement regulation. The auditor concludes the criteria are inadequate. The correct response is to discuss with management and agree on updated criteria that reflect current regulation, rather than auditing against the outdated policy or inventing criteria unilaterally.

Exam Tips: Answering Questions on Engagement Evaluation Criteria
Tip 1: Know the Standard's key action. When a question says criteria are missing, vague or inadequate, the best answer is almost always that the internal auditor should work with management to develop appropriate evaluation criteria. Distractors include: the auditor develops criteria alone, the auditor cancels the engagement, the auditor relies on personal judgment, or the auditor reports a finding without criteria.

Tip 2: Remember who owns the criteria. Management is responsible for setting objectives and criteria. The auditor assesses and recommends but does not take ownership. Taking ownership would impair objectivity. Options in which the auditor approves or implements criteria are usually wrong.

Tip 3: Link criteria to the elements of a finding. If asked which element describes what should be, the answer is criteria. Condition is what is. Cause is why. Effect is the risk or impact. Expect scenario questions asking you to label parts of a finding.

Tip 4: Identify the timing. Criteria are identified during engagement planning, not fieldwork or reporting. If a question asks when criteria should be established and agreed, choose planning, ideally before testing begins.

Tip 5: Recognize the hierarchy of reliability. Authoritative external sources (laws, regulations, recognized frameworks) and formally approved internal policies are generally the most reliable. Informal practices and verbal assurances are weaker. Where a law conflicts with an internal policy, the law usually prevails.

Tip 6: Watch for 'most appropriate' or 'best' wording. Several options may seem plausible. Choose the one that is collaborative, objective, aligned with the Standards and documented. For example, 'discuss and agree criteria with management and document them' beats 'use industry benchmarks without consultation.'

Tip 7: Know the characteristics of good criteria. Questions may ask which attribute is lacking. If two auditors reach different conclusions using the same criteria, the criteria lack reliability. If criteria ignore a key objective, they lack completeness. If they favor one party, they lack neutrality.

Tip 8: Distinguish assurance from consulting. In consulting engagements, criteria are more flexible and are agreed with the engagement client. In assurance engagements, criteria must be adequate and objective, because a third party (the board) relies on the conclusions.

Tip 9: Absence of criteria may itself be a finding. If management has not established performance measures or objectives, this may indicate weak governance or control. Answers recognizing this are often correct.

Tip 10: Use elimination. Eliminate answers that (a) compromise independence or objectivity, (b) skip communication with management, (c) postpone criteria until reporting, or (d) rely on undocumented personal opinion.

Sample Exam-Style Question
During planning, an internal auditor finds that the department under review has no defined performance measures for its customer service objectives. What should the auditor do?
A. Use the auditor's own experience to judge performance.
B. Cancel the engagement until management sets measures.
C. Work with management to develop appropriate evaluation criteria.
D. Report a finding that no criteria exist and end the engagement.
Answer: C. The Standards require auditors to work with management to develop appropriate criteria when they are inadequate. Option D may be part of the communication but is not the complete planning response.

Summary
Engagement evaluation criteria define what should be and form the backbone of every audit conclusion. During planning, the internal auditor identifies criteria, assesses their adequacy, and works with management to develop appropriate criteria when they are lacking. The criteria are then documented, communicated and applied during fieldwork. For the exam, remember four ideas: collaborate with management, management owns the criteria, criteria are set during planning, and criteria are the first element of a finding.