But as far as criteria - I would say that your number one issue for f/s audits is going to depend on your ownership. If you are a public co. with a widely-distributed ownership, you'd want a firm with a well-known public reputation. If it is family-owned, you would be more concerned that the family knows they are competent.
For internal audit, I would say that your audit committee's comfort with the firm's competence would be your first priority.
Of course, $$$ is always an issue.
How to put that in your audit policy, I don't know, but hopefully that can get you started. Maybe some others will list ideas.