Audit objectives vs evaluation criteria: write both clearly
An objective states what the engagement must determine. A criterion is the benchmark used to evaluate the condition. A procedure obtains the evidence. Keep these separate: “review ten files” describes work, but it does not say what conclusion the work should support.
One access-control audit, four different statements
| Decision | How to apply it | Mistake to avoid |
|---|---|---|
| Objective | Determine whether departed employees lose access promptly. | Writing “inspect records” without stating the question. |
| Criterion | For this case, the approved policy requires disablement within one business day. | Inventing a deadline after observing the delays. |
| Procedure | Compare a validated departure population with account-disablement timestamps. | Treating the existence of a policy as proof that the deadline was met. |
Objective
Determine whether departed employees lose access promptly.
Avoid: Writing “inspect records” without stating the question.
Criterion
For this case, the approved policy requires disablement within one business day.
Avoid: Inventing a deadline after observing the delays.
Procedure
Compare a validated departure population with account-disablement timestamps.
Avoid: Treating the existence of a policy as proof that the deadline was met.
A decision path you can use
- 1State the question to answer
- 2Establish a suitable benchmark
- 3Design evidence-producing procedures
Understand the method
Work through the reasoning
Write an objective as a question the engagement can answer
An objective states the evaluation to be made. “Determine whether departed employees lose access within the required period” identifies a conclusion the work should support. “Review access files” describes activity without explaining its purpose. A useful objective connects an organizational goal or risk with an evaluable condition.
Keep the objective realistic for the proposed coverage. A review of one application should not quietly promise a conclusion on all identity management. If the engagement has several objectives, identify each and link procedures to them. This helps expose objectives for which no evidence-producing work has been planned.
Select a suitable benchmark before interpreting results
Criteria establish what the observed condition will be compared against. They may come from requirements, approved policy, agreements, or other suitable benchmarks. Evaluate whether the criterion is relevant to the objective and clear enough to apply consistently. A policy that says access should be removed “quickly” may require clarification before elapsed times can be classified.
Where management or the board has established adequate criteria, use them. Where criteria are inadequate, identify appropriate criteria through discussion with the relevant board or senior management stakeholders as required by the Standards. Do not select a benchmark after seeing results merely because it produces a preferred finding rate.
Keep procedure and evidence separate from the criterion
For the hypothetical one-business-day policy, the criterion is the deadline. The procedure compares validated departure dates with reliable disablement timestamps. The evidence consists of the records and analysis that establish those events. Confusing these elements can lead to testing whether a policy exists while claiming to evaluate compliance with it.
Define measurement conventions before calculation. Which event starts the clock? Does the deadline use business days? Which systems are included? Resolve ambiguities with an appropriate basis and record the decision. A technically correct calculation can still misclassify cases if its definitions do not match the criterion.
Handle disagreement without changing the benchmark opportunistically
Management may challenge a criterion because it is outdated, inconsistent, or infeasible. Investigate the substance of the challenge. An obsolete requirement should not be applied uncritically, but a manager’s preference for a looser threshold is not itself a replacement for an applicable approved requirement.
Document the criterion, its authority, relevant discussions, and any unresolved disagreement. Consider whether an inadequate policy is itself a design issue and distinguish that from operating failures under a valid policy. This produces a clearer report than blending disagreement about expectations with disagreement about the facts.
Original teaching example
Apply the method to a decision
The scenario
The objective is to assess timely removal of leaver access. A policy sets one business day, but IT’s spreadsheet classifies anything within a week as compliant.
The decision
Use the applicable approved criterion and investigate the inconsistent reporting definition.
The spreadsheet’s status label is not the criterion. Calculate elapsed time using the required business-day convention and reliable timestamps. If the policy is unsuitable or ambiguous, address that before interpreting the results.
Independent hypothetical case. It is not an official IIA question, an actual investigation, or a scoring prediction.
A second application
“Promptly” means three different things
The situation
HR interprets prompt removal as the departure day, IT uses five working days, and the dashboard labels anything within a month as compliant. No approved deadline exists.
Reason through it
The team lacks a consistently evaluable benchmark. It should establish suitable criteria through the appropriate discussion, considering the risk and applicable requirements, and document the conflicting definitions as part of its assessment.
Take the decision
Do not classify every account using whichever threshold produces the desired result. Resolve the benchmark and distinguish policy design from operating evidence.
Original hypothetical teaching case.
Check your understanding
Choose the best answer, then check the reasoning for each alternative. These short learning checks are not a full exam simulation. Answers are not saved or sent.
Questions about this topic
What if management has no suitable criteria?
Identify the gap and discuss appropriate criteria with the relevant parties. Use a defensible basis such as applicable requirements, organizational objectives, or a suitable benchmark, rather than silently judging by personal preference.
Must every advisory engagement use the same criteria as assurance work?
No. The need for evaluation criteria in advisory work depends on the agreement with relevant stakeholders. Clarify the intended deliverable; do not imply an assurance conclusion when the work only supports advice or facilitation.
Sources and syllabus scope
Prepared by MiloPrep editorial team. Source links checked 2026-10-10. These notes and cases are independent teaching material; the IIA sources do not verify or endorse them.
- IIA expanded syllabus
Establishes the examined topics. Primary domain: Engagement Planning (50% of Part 2). This is a domain allocation, not a separate weight for this lesson.
- Global Internal Audit Standards reference
- Locator: Standards 13.3-13.4. Supports the professional requirements cited here; our scenarios and solution steps are original applications. Current IIA Standards resources.
Part 2: Internal Audit Engagement. Selected learning notes, not complete curriculum coverage. Browse all CIA topics.