An auditor tests whether a warehouse "manages inventory well." Nobody can say what result would count as a pass. The engagement produced observations, and every one of them was argued away, because there was never a benchmark to fail against.
Evaluation criteria are the benchmarks against which the condition you observe is compared to determine whether it is acceptable. They are the "what should be" half of every observation. Without them, you have facts and no finding.
Criteria are determined from the information gathered, which is why this step sits after preliminary information gathering and process understanding, not before. Selecting the most relevant criteria means starting from the activity, not from a library. You do not import a benchmark and then hunt for a process it fits. You learn what the process is supposed to achieve, then select the benchmark that measures it.
KEY: Condition minus criteria equals the observation. If you cannot state the criterion in one sentence with a number, a rule, or a named requirement, you do not yet have a finding...
Common mistakes
- Adopting management's benchmark without testing alignment. A "1 business day" target that permits 24 hours against a 4-hour contract passes specificity and practicality and still fails, because the process can conform while the obligation is breached.
- Leaving qualitative words in the criterion. "Adequate," "timely," and "reasonable" have no threshold. Convert each to a number and a unit before the workprogram is approved.
- Choosing an industry benchmark over an internal one. A 6-hour survey median never bound the organization. Internal policy, contract terms, and board tolerance outrank external comparatives whenever they exist and cover the objective.
Bottom line
- Criteria are the "what should be" benchmark; the observation is condition compared against criteria.
- Criteria are determined from information gathered during planning, after process understanding, never imported first.
- Source preference: laws and regulations, contracts and service level agreements, board-approved policy and risk tolerance, management procedures, recognized frameworks, industry benchmarks, then auditor-developed as last resort.
- Higher-authority sources win conflicts, so a 30-day contract term overrides a 45-day internal policy.
Exam shortcut
Run the stem's candidate benchmarks through two filters in order: authority, then the five tests. Authority resolves most conflict questions in one step, because law beats contract only when they collide, contract beats policy, and policy beats industry averages. Stem signals: any qualitative word in an answer choice ("appropriate controls," "timely processing," "sufficient documentation") marks that option as a specificity failure, so eliminate it first.
The full lesson (about 2,467 words, 16 min read) adds 2 worked examples, all 6 common mistakes, a self-check, free in the app.
Learning objectives
- 2
Browse all free CIA Part 2 lessons or jump into free CIA Part 2 practice questions.