Internal audit criteria