Developing evaluation criteria is a critical step in engagement planning that establishes the standards against which the auditor will assess the adequacy and effectiveness of controls, processes, and operations under review. According to IIA Standard 2210.A3, adequate criteria are needed to evalua…Developing evaluation criteria is a critical step in engagement planning that establishes the standards against which the auditor will assess the adequacy and effectiveness of controls, processes, and operations under review. According to IIA Standard 2210.A3, adequate criteria are needed to evaluate governance, risk management, and controls. Internal auditors must determine the extent to which management has established adequate criteria to ascertain whether objectives and goals have been accomplished. Evaluation criteria provide a benchmark or 'what should be' condition that is compared to the actual condition found during fieldwork. This comparison allows auditors to identify gaps, deficiencies, or areas of noncompliance. Suitable criteria should be relevant, reliable, neutral, understandable, and complete. Sources of evaluation criteria include internal sources such as organizational policies, procedures, objectives, budgets, performance targets, and prior audit results. External sources include laws and regulations, industry standards, benchmarking data, leading practices, and frameworks such as COSO or COBIT. When management has established adequate criteria, auditors should use those criteria in their evaluation. However, if criteria are inadequate or absent, Standard 2210.A3 requires internal auditors to work with management to develop appropriate evaluation criteria. In some cases, auditors may need to consult with subject matter experts or refer to recognized professional standards. The development of clear, agreed-upon criteria early in the planning process helps ensure objectivity, reduces disputes over findings, and strengthens the credibility of the audit conclusions. It also aligns the engagement with stakeholder expectations and organizational objectives. Ultimately, well-defined evaluation criteria support the auditor in forming sound, evidence-based conclusions and recommendations. Without appropriate criteria, findings may lack the foundation necessary to persuade management to take corrective action. Therefore, establishing evaluation criteria is foundational to delivering value-added, reliable, and defensible internal audit engagements that meet professional standards and serve the organization's governance needs effectively.
Developing Evaluation Criteria
Developing Evaluation Criteria is a critical component of engagement planning within internal auditing. It forms the foundation upon which auditors assess whether the activity, process, or control under review is performing as intended. Without clear criteria, an auditor cannot meaningfully determine whether a condition is satisfactory or deficient.
Why It Is Important Evaluation criteria provide the benchmark or standard against which actual conditions are measured. They are essential because:
• They establish an objective basis for forming conclusions and opinions. • They ensure consistency and fairness in the audit assessment. • They allow auditors to clearly identify and communicate findings (conditions versus criteria). • They help avoid subjective or arbitrary judgments that could undermine the credibility of the engagement. • They support the defensibility of audit conclusions when discussed with management.
According to the IIA Standards, internal auditors must identify adequate criteria to evaluate governance, risk management, and control processes. If criteria are inadequate, the auditor must work with management and the board to develop appropriate criteria.
What It Is Evaluation criteria are the standards, measures, or expectations used to determine whether a process or control is operating effectively. A finding in internal auditing typically has four elements:
• Criteria – what should be (the standard). • Condition – what is (the actual situation found). • Cause – why the difference exists. • Effect – the consequence or risk of the difference.
Criteria answer the question: What should the situation look like if everything were working correctly?
Sources of Evaluation Criteria Auditors may draw criteria from various sources, including:
• Laws, regulations, and statutory requirements. • Organizational policies, procedures, and plans. • Industry standards and best practices (benchmarking). • Contractual agreements. • Management's own objectives and performance targets. • Professional standards and frameworks (e.g., COSO, COBIT).
How It Works During engagement planning, the auditor performs the following steps related to criteria:
1. Identify objectives of the area or process under review. 2. Determine appropriate criteria that define successful achievement of those objectives. 3. Assess adequacy of existing criteria – are they relevant, reliable, measurable, and complete? 4. Develop or supplement criteria where management has not established adequate standards, in consultation with management and the board. 5. Use the criteria during fieldwork to compare against actual conditions and form conclusions.
Good criteria should generally be relevant, reliable, neutral, understandable, and complete.
How to Answer Questions in an Exam Exam questions on this topic typically test whether you understand the role of criteria within a finding, where criteria come from, and what the auditor should do when criteria are missing or inadequate. Read the question carefully to distinguish between criteria, condition, cause, and effect, as these are often confused.
Exam Tips: Answering Questions on Developing Evaluation Criteria
• Remember that criteria = what should be (the standard), not what was found (that is the condition). • If a question states that management has NOT established adequate criteria, the correct answer is usually that the auditor should work with management and the board to develop appropriate criteria—not simply create them unilaterally or skip the evaluation. • Watch for answer choices that confuse the elements of a finding. Be precise about criteria, condition, cause, and effect. • Good criteria must be objective and measurable; eliminate answers that suggest vague or subjective standards. • Criteria should align with the engagement's objectives and the organization's goals. • Recognize common sources of criteria (laws, policies, best practices, contracts, management objectives) in scenario questions. • Criteria are established during the planning phase, before fieldwork begins—this timing is frequently tested. • Apply the qualities of good criteria: relevant, reliable, neutral, understandable, and complete.
By mastering the concept of evaluation criteria, you will be well prepared to analyze audit findings and respond accurately to related exam scenarios.
