@75 “criteria” is the measuring stick on which you base you opinion or conclusion, etc. In a financial statement audit, for example, the auditor seeks to determine if the financial statements are presented fairly in accordance with the “criteria”, whether that be GAAP, cash basis, tax basis, regulatory, contract, or some other set of accounting principles. Alternatively, when the auditor gives an opinion on the operating effectiveness of internal control, the “criteria” might be COSO Internal Control Framework. It all depends on the type and purpose of the engagement, but each attest engagement must have some kind of criteria on which the auditor can judge the client's financial statements, compliance, internal control, etc. So, as a precondition for accepting an engagement the auditor should ensure whatever criteria management is using acceptable.
In regards to your second question, “management's written assertion” (as it relates to an examination, review or agreed-upon procedures under SSAE) is a written report obtained from management when purpose of engagement is to issue an opinion or conclusion on whether or not “management's assertion” is fairly stated. This assertion should be clearly stated in management's written report and accompanies the examination, review or agreed-upon procedures report. On the other hand, management's written representation is the letter provided to the auditor by management that expressly states management's responsibility in relation to the engagement (i.e., management is responsible for the financial statements, internal control, internal control over fraud, and has disclosed to the auditor all known related party transactions, fraud, noncompliance contingent liabilities, litigation, etc.)
Hope this helps!
.