Constitutional Court Decision Number 28/PUU-XXIV/2026 provides a constitutional interpretation of the phrase “state financial audit institution” in the Elucidation of Article 603 of Law Number 1 of 2023 concerning the Criminal Code. The ruling upholds Indonesia's Audit Board (BPK) as constitutionally authorized to investigate state financial losses, affecting evidence standards in graft prosecutions, especially regarding overpayment. This research aims to analyze the boundaries of criminal liability for state financial losses originating from overpayment findings and to examine the juridical implications of Constitutional Court Decision Number 28/PUU-XXIV/2026 on the authority of audit institutions in proving state financial losses. This study employs normative legal methodology combining statutory, conceptual, and case-based perspectives examining Constitutional Court rulings statutes and scholarship. Findings show that Constitutional Court Decision Number 28/PUU-XXIV/2026 does not change the actual loss doctrine that was established through Constitutional Court Decision Number 25/PUU-XIV/2016, but rather affirms that BPK is the audit institution possessing constitutional authority in the examination of state financial losses as referred to in the Elucidation of Article 603 of the National Criminal Code. Nevertheless, BPK’s audit results do not automatically give rise to criminal liability, because proving corruption still requires the fulfillment of the elements of real state financial loss (actual loss), unlawful conduct (actus reus), and the perpetrator’s fault (mens rea). Overpayment findings caused solely by administrative or technical errors cannot automatically be qualified as corruption crimes and, in principle, are more appropriately resolved through administrative law or civil law mechanisms in accordance with the principle of ultimum remedium.