Streamline Audit Preparation and Compliance

This skill is expert in audit preparation, internal controls, and compliance frameworks, with extensive experience in SOX compliance, financial audits, IT audits, and regulatory examinations. Its pre-audit planning principles cover scope definition and materiality thresholds, realistic timelines with buffer periods, dedicated resource allocation per workstream, and clear escalation and status-reporting protocols. Its documentation framework requires current process flowcharts and control matrices, systematic evidence filing with version control, documented segregation-of-duties approval hierarchies, and exception logs tracking control failures and remediation. It structures SOX control documentation with a fixed template (control ID, owner, objective, activity, frequency, evidence, testing procedures, remediation process) across four control categories - entity-level (tone at the top, risk assessment, monitoring), process-level (authorization, completeness, accuracy, validity), general IT controls (access management, change management, backup/recovery), and application controls (input validation, processing, output).

Use this skill when preparing for or managing a financial, SOX, or IT audit that needs systematic evidence and request tracking rather than ad hoc document gathering. It covers financial statement audit specifics (a standard account reconciliation format reconciling book and bank/system balances to a zero difference, journal entry support, calculation workpapers, third-party confirmations, and signed management representations), IT audit specifics (access control verification queries, change management documentation covering formal approval, UAT/SIT evidence, deployment logs, and dev/test/prod segregation of duties), and control testing methodology with concrete sample sizes (25 items for weekly controls, 40 for monthly manual controls) plus separate approaches for automated controls and walkthrough procedures. It is not meant for a one-time audit push - its closing guidance frames audit preparation as a continuous process for sustained readiness, not a periodic scramble before an audit date.

-- Sample query for access verification
SELECT 
    u.username,
    u.department,
    u.role,
    u.last_login,
    u.status,
    r.permissions,
    u.manager_approval_date,
    u.last_access_review
FROM users u
JOIN roles r ON u.role = r.role_name
WHERE u.status = 'Active'
ORDER BY u.last_access_review ASC;

Given an audit engagement, the skill produces a Control Documentation Template per control, an AuditRequest tracking class for managing information requests with status/documents/notes, a standard reconciliation format like book-versus-bank balance above, access-verification queries like the one above, remediation guidance for common deficiencies (untimely reviews, inadequate documentation, access control gaps, calculation errors) with root-cause analysis and validation testing, and an Audit Readiness Status Report for audit committee communication with a Green/Yellow/Red readiness level, risk areas by severity, and resource requirements.

Internal audit, controls, and compliance teams managing SOX, financial, or IT audit readiness who need standardized documentation templates, a request-tracking system, and executive-level status reporting rather than building the process from scratch each cycle. It suits teams that treat remediation as root-cause work rather than symptom patching, and that need to communicate readiness status and risk clearly to an audit committee.