Criteria, not common practice: the yardstick in performance audits and compliance audits within government internal oversight

An audit finding arises from comparing the existing state with criteria. In practice, that yardstick sometimes shifts, unnoticed, from the applicable criteria to common practice. The shift usually surfaces in a familiar line of defence: that everyone does it this way anyway. This note argues that the shift is caused not by an absence of criteria, but by uneven knowledge of the criteria and by habits that may also be followed in the auditor's own agency. What is lost is not only the accuracy of findings, but also the reason to propose a better way of working. From there the note sets out six working rules. It also makes clear the limits of its argument: procedures updated on the basis of field practice remain legitimate as long as they are tested against the higher-level requirements that govern them. The note does not name any audited entity, audit result, or individual's data. This is an English translation of the Indonesian original, "Kriteria, bukan kelaziman" (version 1.2, https://doi.org/10.5281/zenodo.22959487). The record holds two files with the same content: a PDF for reading and citing, and the Markdown (.md) source text, included so that other institutions can easily copy it and adapt it into their own guidance under the CC BY 4.0 licence.