Audit criteria are the reference point against which every audit finding is measured. Without clearly defined audit criteria, an auditor has no basis for concluding whether something conforms or does not conform. Yet in practice, many auditors and auditees alike have a fuzzy understanding of what audit criteria actually are, where they come from, and how they interact with audit scope and objectives. This article unpacks the concept thoroughly so you can apply it with confidence, whether you are planning an internal audit, preparing for a certification audit, or working towards your lead auditor qualification.
On this page
What Are Audit Criteria?
Audit criteria are the set of policies, procedures, requirements, or other references against which audit evidence is compared. The definition comes directly from ISO 19011:2018 and is carried into the 2026 revision. In simple terms, audit criteria answer the question: what should be happening here? Audit evidence then answers: what is actually happening? The gap between the two is where findings live.
It helps to think of audit criteria as the yardstick. The auditor measures conformity by holding what they observe, read, or hear up against that yardstick. If the evidence matches the criteria, there is conformity. If it does not, there is a nonconformity. If the evidence suggests an area could be improved without a clear breach, that might become an observation or an opportunity for improvement.
Audit criteria are not the same as audit objectives or audit scope, though the three are closely related. The scope defines the boundaries of the audit. The objectives define what the audit is trying to achieve. The criteria define the standard of reference used to make judgements within that scope. All three must be defined before an audit begins, and they must be consistent with each other.
Exemplar Global Certified Training ProviderRTP No. 310970
Where Do Audit Criteria Come From?
Audit criteria can come from a wide range of sources. Understanding this is important because the source determines the nature of the obligation and the weight you give to any finding raised against it.
ISO Standards
The most obvious source is the ISO standard itself. If you are auditing against ISO 9001, the clauses of that standard become your primary audit criteria. The shall statements within each clause define what is required. When an auditor checks whether an organisation has established a quality policy that includes a commitment to continual improvement, they are comparing the evidence against the criterion set out in Clause 5.2 of ISO 9001.
For a certification audit, the relevant standard is always part of the audit criteria. For an internal audit, the standard may or may not be included depending on the objectives. Some internal audits are run purely against internal procedures, without reference to the standard at all.
Organisational Policies and Procedures
An organisation's own documented information is a common and important source of audit criteria. If a procedure states that all corrective actions must be reviewed for effectiveness within 90 days, that procedure becomes a criterion. An auditor checking corrective action records will measure what they find against that 90 day requirement.
This is where internal audits often catch organisations out. Procedures that were written years ago may set requirements that are no longer practical or that staff no longer follow. When the auditor finds evidence that the procedure is not being followed, they raise a nonconformity against the organisation's own documented requirement. The organisation wrote the rule. The organisation is not meeting it.
Legal and Regulatory Requirements
Applicable legislation, regulations, codes of practice, and licence conditions can all form part of the audit criteria. This is particularly relevant for environmental and safety audits. Under ISO 14001, an organisation is required to identify its compliance obligations, which include legal requirements. An auditor checking environmental compliance will often include relevant legislation as part of the criteria set.
It is worth noting that auditors are not legal experts. When legislation is included in the audit criteria, the auditor is checking whether the organisation has a process for identifying and meeting those requirements, and whether there is evidence that the process is working. They are not providing legal advice or making legal determinations.
Contractual Requirements
In second party audits, such as supplier audits, the contract between the organisation and its customer often forms a significant part of the audit criteria. The auditor checks whether the supplier is meeting the specific requirements agreed in the contract, which may go beyond what any ISO standard requires.
This is one reason why supplier audits require careful preparation. The auditor needs to read and understand the relevant contract or specification documents before the audit begins, so they can identify the criteria they will be auditing against.
Industry Standards and Codes
Sector specific standards, codes of practice, and industry guidelines may also be included. In food manufacturing, for example, the audit criteria for an internal audit might include the relevant food safety standard, the organisation's HACCP plan, and applicable food safety regulations. In construction, relevant codes and standards around inspection and test plans might be referenced.
How Audit Criteria Relate to Audit Scope and Objectives
These three elements must be defined together and must be coherent. A mismatch between them creates problems during the audit and when findings are reported.
Consider this example. An organisation decides to run an internal audit of its corrective action process. The scope is the corrective action process across all departments. The objective is to verify that corrective actions are being completed effectively and on time. The criteria should then include the relevant clause of the ISO standard (Clause 10.2 for ISO 9001), the organisation's corrective action procedure, and any specific timeframes or requirements set out in that procedure.
If the auditor arrives and starts raising findings against clauses of the standard that fall outside the corrective action process, they have drifted outside scope. If they raise findings against criteria that were never defined, those findings are difficult to defend. Defining the criteria upfront protects both the auditor and the auditee.
For a deeper look at how objectives and criteria work together, see our article on setting audit objectives and criteria.
Audit Criteria in Practice: What Auditors Actually Do
Understanding audit criteria in theory is one thing. Applying them on the floor of an audit is another. Here is how experienced auditors work with criteria in practice.
Reviewing Criteria Before the Audit
Before any audit begins, the auditor reviews the criteria documents. For a certification audit, this means reading the standard carefully and understanding the shall statements. For an internal audit, it means reviewing the procedures, work instructions, and any other documents that define what the organisation has committed to doing.
This review serves two purposes. First, it ensures the auditor understands what conformity looks like before they start collecting evidence. Second, it helps them identify the key risk areas and decide where to focus their sampling.
Translating Criteria Into Audit Questions
Each criterion can be translated into one or more audit questions. If the criterion is that all suppliers must be evaluated before being added to the approved supplier list, the audit question becomes: can you show me evidence that this supplier was evaluated before they were approved? The criterion tells the auditor what to look for. The question is how they go about finding it.
This is one of the practical skills developed in auditor training. Writing good audit questions that are directly linked to specific criteria is a core competency. Questions that float free of any particular criterion tend to produce unfocused conversations and weak evidence.
Documenting Which Criterion Has Been Breached
When a nonconformity is raised, the auditor must state the criterion against which the finding is raised. A nonconformity report that simply says corrective actions are not being completed is incomplete. It needs to identify the specific requirement that has not been met, for example: Clause 10.2.1(f) of ISO 9001:2015 requires the organisation to review the effectiveness of any corrective action taken. Review of 12 corrective action records showed that no effectiveness review had been conducted for any action closed in the past six months.
The criterion, the evidence, and the finding are all present. The auditee knows exactly what requirement they have failed to meet, and the certification body or audit client can assess the severity of the finding. For more on writing findings that hold up, see our article on how to write audit findings that stand up to challenge.
Common Mistakes Auditors Make With Audit Criteria
Even experienced auditors can fall into traps when it comes to audit criteria. Here are the ones that come up most often.
Auditing Against Personal Preferences
This is one of the most common issues, particularly with less experienced auditors. The auditor has a view about how something should be done, and they raise a finding because the organisation is not doing it that way. But if there is no criterion that requires the organisation to do it the auditor's way, there is no basis for a finding. Audit findings must be grounded in defined criteria, not in the auditor's personal preferences or past experience from other organisations.
Using Outdated Criteria
Standards are revised. Procedures are updated. An auditor who turns up with a checklist based on an old version of a standard, or who references a procedure that has since been superseded, is auditing against the wrong criteria. Always confirm which version of any document is current before the audit begins.
This is particularly relevant right now, with ISO 14001 having moved to the 2026 edition and ISO 9001:2026 on the horizon. Auditors need to ensure their criteria documents reflect the current requirements, not the previous edition.
Criteria That Are Too Broad
Setting audit criteria as simply ISO 9001:2015 without specifying which clauses are in scope can lead to unfocused audits. For a full system audit, that might be appropriate. But for a process audit or a focused internal audit, the criteria should be specific enough to guide the auditor towards the relevant requirements.
Failing to Communicate Criteria to the Auditee
The auditee has a right to know what criteria they are being audited against. This should be communicated in the audit plan and confirmed at the opening meeting. An auditee who does not know the criteria cannot prepare effectively, and findings raised against undisclosed criteria are difficult to accept as fair.
Audit Criteria in Different Audit Types
The sources and nature of audit criteria vary depending on the type of audit being conducted.
Internal Audits
Internal audits typically use a combination of the relevant ISO standard, the organisation's own procedures and work instructions, and any applicable legal or regulatory requirements. The organisation has significant flexibility in defining what criteria to include. A risk based internal audit programme might focus on the criteria most relevant to the organisation's key risks, rather than working through every clause of the standard in equal depth.
Certification Audits
For a Stage 1 or Stage 2 certification audit, the audit criteria are primarily defined by the relevant standard and the scope of certification. The certification body will audit against the full requirements of the standard as they apply to the organisation's scope. The organisation's own documented information also forms part of the criteria, because the standard requires the organisation to implement what it has documented.
Supplier and Second Party Audits
In supplier audits, the criteria often combine the relevant standard with specific contractual or technical requirements. The purchasing organisation defines what criteria matter to them and communicates these to the supplier before the audit. This is one of the reasons supplier audits require more bespoke preparation than internal audits against a fixed standard.
For a practical walkthrough of how criteria are applied in supplier audits, see our article on supplier audit technique.
Audit Criteria and the Audit Report
The audit report should clearly state the audit criteria used. This serves several purposes. It provides transparency for the audit client. It allows anyone reviewing the report to understand the basis for the findings. It creates a reference point for future audits, so that subsequent auditors can see what criteria were used previously and whether they have changed.
In practice, the audit criteria section of an audit report is often brief, listing the standard version, the specific clauses or processes in scope, and any additional documents such as procedures or legal requirements that were used as reference. Brief does not mean unimportant. A report without clearly stated criteria is incomplete.
Exemplar Global Certified Training ProviderRTP No. 310970How Audit Criteria Connect to Audit Conclusions
The audit conclusion is the auditor's overall assessment of the degree to which the audit criteria have been met. It is not just a summary of the findings. It is a considered judgement about the overall state of conformity, taking into account the nature and significance of any findings, the areas where no issues were found, and any positive observations about how the system is operating.
A conclusion can only be credible if the criteria were clearly defined, consistently applied, and supported by sufficient evidence. An auditor who has not defined their criteria properly cannot make a defensible conclusion. This is why the upfront work of defining criteria is so important, and why it is covered in depth in both internal auditor and lead auditor training.
If you want to understand how audit conclusions are formed and what they should contain, our article on what is an audit conclusion covers this in detail.
Developing Your Competence With Audit Criteria
Working confidently with audit criteria is a skill that develops with practice and good training. New auditors often struggle to distinguish between a criterion and a finding, or between a criterion and an observation. They may raise findings that are not grounded in any defined requirement, or miss findings because they did not identify the relevant criterion in the first place.
The best way to develop this competence is to practise writing audit questions that are directly linked to specific criteria, and then practise evaluating evidence against those criteria in realistic audit scenarios. This is exactly the kind of practical work that structured auditor training provides.
At Audit Workshop, our internal auditor and lead auditor courses for ISO 9001, ISO 14001, ISO 45001, ISO 27001, and other standards all include practical exercises in defining audit criteria, writing criteria based findings, and applying criteria consistently across an audit. The training is built around real audit scenarios, not abstract theory. Whether you are completing a Foundation course to understand the basics or working through a Lead Auditor programme to prepare for certification auditing, understanding audit criteria is central to everything you will do on an audit. You can explore the available courses at auditworkshop.com.
