Defining the Assessment Criteria and Scope
Setting the reference to audit against
Before starting fieldwork, the audit team must precisely define the criteria against which it will assess, that is, the standard, internal policy or control framework that will serve as the yardstick, along with the concrete scope of systems, processes and periods the assessment will cover. Without explicit criteria, two auditors can reach different conclusions from the same evidence, simply because each implicitly applied a different standard. In practice, this definition is documented in an audit plan that stakeholders review and approve before starting, thus avoiding later discussions about whether a finding is valid or whether an area was really within the agreed scope. A common mistake is setting criteria that are too general, such as complying with industry best practices, instead of verifiable, measurable references.