Establishing Criteria When Management Has Not Defined Any: CIA Part 2 Engagement Planning Guide
Introduction
In every assurance engagement, internal auditors compare what is (the condition) with what should be (the criteria). Without criteria, an auditor has no defensible benchmark for concluding whether governance, risk management, and control processes are adequate and effective. A frequent CIA Part 2 scenario asks what the auditor should do when management has not defined criteria, or has defined criteria that are inadequate. This guide explains the concept, why it matters, how it works in practice, and how to answer exam questions on it.
What Are Evaluation Criteria?
Evaluation criteria are the standards, measures, or expectations used to judge whether an activity under review is achieving its objectives. They answer the question: Against what are we measuring performance or control effectiveness?
Examples include:
- Internal criteria: policies, procedures, budgets, KPIs, service-level targets, approval limits, and strategic objectives.
- External criteria: laws, regulations, contractual terms, and requirements set by regulators or standard-setters.
- Leading practices: recognized frameworks and benchmarks such as COSO Internal Control and ERM, ISO standards, COBIT, NIST, and industry benchmarks or peer comparisons.
What the Standards Require
Under the IIA's former Standard 2210.A3, and carried forward into the Global Internal Audit Standards (Standard 13.4, Evaluation Criteria), the logic follows three steps:
1. Ascertain the extent to which management and/or the board have established adequate criteria for determining whether objectives and goals have been accomplished.
2. If the criteria are adequate, internal auditors must use them in their evaluation.
3. If the criteria are inadequate or absent, internal auditors must identify appropriate evaluation criteria through discussion with management and/or the board.
The key phrase to memorize is through discussion with management and/or the board. The auditor does not simply impose criteria. The auditor identifies or proposes appropriate criteria and seeks agreement on them.
Why It Is Important
- Basis for conclusions: Findings and opinions are only credible if the benchmark behind them is clear and accepted.
- Avoids disputes: If management has agreed to the criteria in advance, it is much harder to reject findings later.
- Objectivity and fairness: Agreed criteria reduce the perception that the auditor applied personal or arbitrary standards.
- Supports the attributes of a finding: Every finding rests on criteria, condition, cause, and effect (often with a recommendation). Missing criteria means an incomplete finding.
- Adds value: Helping management define appropriate criteria often improves the governance and control environment itself.
- Signals a possible weakness: The absence of performance measures or control expectations may itself be a governance or control deficiency worth reporting.
How It Works in Practice
Step 1: Identify the engagement objectives and scope. Criteria must relate directly to what the engagement is trying to evaluate.
Step 2: Gather existing criteria. Review policies, procedures, objectives, KPIs, contracts, and regulations that apply to the activity.
Step 3: Assess adequacy. Good criteria are generally:
- Relevant: linked to the activity's objectives.
- Reliable: produce consistent conclusions when applied by different auditors.
- Neutral: free from bias.
- Understandable: clear and not open to differing interpretations.
- Complete: cover all significant aspects in scope.
Step 4: If criteria are missing or inadequate, identify suitable alternatives. Draw on regulations, recognized frameworks, industry benchmarks, leading practices, prior engagement results, or comparable units in the organization.
Step 5: Discuss and agree with management and/or the board. Present the proposed criteria, explain the reasoning, and obtain agreement, ideally documented in the engagement planning memo or work program. Where criteria relate to strategic or governance matters, involve the board or audit committee.
Step 6: Document. Record the criteria, their sources, and the agreement in the engagement workpapers.
Step 7: Apply and report. Use the agreed criteria to evaluate the condition. Where appropriate, report the original absence of criteria as an observation.
Illustrative Example
An internal audit team is assigned to review the efficiency of the procurement function. Management has no defined targets for purchase order cycle time or cost savings. The auditors research industry benchmarks for procurement cycle times and review the organization's strategic cost-reduction goals. They then meet with the procurement director and CFO to propose criteria, such as a 5-day average PO cycle time and documented competitive bidding above a set threshold. Once these are agreed, the auditors test against them. The final report also notes that the lack of defined performance measures limited management's own ability to monitor procurement.
Common Misconceptions
- The auditor should develop criteria independently and apply them without consultation. Wrong. Criteria must be identified through discussion with management and/or the board.
- The engagement should be cancelled or postponed. Generally wrong. The solution is to establish criteria, not abandon the work.
- Use management's inadequate criteria anyway. Wrong. Criteria are used only if they are adequate.
- Management alone decides the criteria. Incomplete. The auditor identifies appropriate criteria and agrees them with management. Management does not dictate criteria that would compromise the evaluation.
- Criteria are only needed for compliance audits. Wrong. They are needed for operational, performance, IT, and governance engagements too.
Exam Tips: Answering Questions on Establishing Criteria When Management Has Not Defined Any
1. Look for the magic phrase. The best answer usually involves identifying appropriate criteria through discussion with management and/or the board. Options mentioning collaboration, consultation, or agreement with management are strong candidates.
2. Eliminate unilateral answers. Choices such as 'the auditor should use professional judgment to set criteria' or 'use criteria from the last audit without discussion' are usually distractors because they skip the discussion step.
3. Eliminate avoidance answers. Cancelling the engagement, reducing scope, or reporting only that criteria do not exist without performing the evaluation are rarely correct.
4. Apply the sequence. First ascertain whether criteria exist and are adequate. If adequate, use them. If not, identify appropriate criteria with management and/or the board. Questions may test the first step, such as 'What should the auditor do first?', in which case the answer is to determine whether management has established adequate criteria.
5. Recognize the timing. Criteria are established during engagement planning, before fieldwork testing. An answer that defers establishing criteria until reporting is likely wrong.
6. Know the sources. Expect questions asking which source is acceptable. Laws, regulations, industry benchmarks, recognized frameworks such as COSO and ISO, and leading practices are all valid sources when internal criteria are lacking.
7. Remember the attributes of findings. If a question asks which element of a finding would be missing without established standards, the answer is criteria. Condition is what exists, cause is why, and effect is the impact.
8. Watch for the 'board' angle. For strategic, governance, or high-level performance criteria, discussion with the board or audit committee is appropriate, not just operating management.
9. Consider the control-weakness angle. In a scenario question, the absence of criteria may be reportable as a deficiency in management's monitoring or performance measurement. That is a value-adding observation, but it does not replace establishing criteria for the engagement.
10. Read qualifiers carefully. Words such as 'most appropriate', 'first', and 'best' change the answer. Distinguish between what the auditor must do, which is to ascertain criteria and agree on them, and what is merely helpful.
Quick Memory Aid: A-U-D-I-T
- Ascertain whether criteria exist.
- Use them if adequate.
- Discuss with management and/or the board if they are not.
- Identify appropriate sources such as frameworks, regulations, and benchmarks.
- Take note: document the criteria and the agreement.
Summary
When management has not defined criteria, or has defined inadequate ones, internal auditors must not proceed blindly or impose their own standards. They must identify appropriate evaluation criteria through discussion with management and/or the board, drawing on relevant internal, external, and leading-practice sources. They should document the agreed criteria during planning and use them to evaluate the activity. On the CIA exam, choose answers that reflect this consultative, planning-stage approach. Reject options that bypass management, abandon the engagement, or rely on inadequate benchmarks.
