One of the five attributes that internal auditors include when documenting a deficiency is the criteria used to make the evaluation. The criteria represent the standards, measures, or expectations used in the evaluation process. Documenting the criteria is essential as it provides a benchmark against which the actual conditions can be compared, thereby helping to identify and explain deficiencies in controls or processes.
References:
* The Institute of Internal Auditors (IIA) Standard 2410 - Criteria for Communicating: "Final communication of engagement results must, where appropriate, contain the internal auditors' overall opinion and/or conclusions, as well as the criteria used for evaluation."
* IIA Practice Guide on "Documenting Internal Audit Observations"