CIA-2 - Engagement Planning (50% of the exam) - Section A.2
Determine evaluation criteria based on relevant information gathered, judging whether the criteria are specific, practical, relevant, and produce reliable comparisons.
Identify the most relevant criteria against which the activity under review will be evaluated, drawing on policies, standards, benchmarks, or leading practice as appropriate to the engagement. Judge whether a proposed set of evaluation criteria is specific, practical, relevant to and aligned with both the organisation's objectives and the activity under review, and capable of producing reliable, comparable conclusions.
Evaluation criteriaEngagement objectives
Practice question for this objective
lock_openFree sampleEngagement Planningmedium
During planning of an assurance engagement over a procurement process, an internal auditor must establish evaluation criteria. Which statement best describes the purpose of evaluation criteria in an engagement?
AThey define the standards or benchmarks against which the audited condition is compared to reach conclusions.check_circle Correct
BThey list the specific audit procedures the team will perform to gather sufficient evidence.
CThey set the scope boundaries that determine which units and periods the engagement will examine.
DThey record the residual risk ratings that management has accepted for the process under review.
Evaluation criteria are the benchmarks against which an audited condition is compared to reach engagement conclusions. A finding is built from criteria, condition, cause, and effect. The criteria supply the expected state, and comparing the observed condition to that benchmark is what produces a defensible conclusion rather than an opinion.
Why A is correct: Evaluation criteria are the benchmarks (such as policy, regulation, or good practice) against which the actual condition is measured to form findings and conclusions.
Why B is wrong: This is tempting because procedures also appear in the plan, but procedures are the work programme, not the standards used to judge the condition against a benchmark.
Why C is wrong: Scope defines coverage and boundaries, which candidates confuse with criteria, but scope does not supply the benchmark used to evaluate whether the condition is acceptable.
Why D is wrong: Residual risk ratings inform risk-based planning and sound plausible, but they are management's risk position, not the yardstick the auditor uses to evaluate the condition.
Answers that look right on this material and are not. Each one is a distractor from a different question in the CIA-2 bank for this domain.
The criteria are drawn from the most recently published external standard available at the planning date.
errorWhy it is wrong: Recency of a standard is tempting but does not establish relevance; a current standard can still be unrelated to this engagement's objectives and risks.
They set the sample size the auditor must test before drawing any conclusion about the process.
errorWhy it is wrong: Tempting because sampling is part of fieldwork planning, but sample size is driven by risk and confidence levels, not by the criteria that define what 'good' looks like.
State broad aspirational objectives such as ensuring payroll is well managed, so the team retains flexibility to pursue whatever issues emerge during fieldwork.
errorWhy it is wrong: Tempting for the flexibility it offers, but vague objectives cannot be evidenced or bounded, leaving the engagement without a testable conclusion.