internal-audit

Build a risk-based internal-audit universe and annual plan by traversing the internal-audit decision tree (assurance-vs-advisory → risk-ranking the universe → coverage/cycle → resourcing), then return the scored audit universe, the resource-balanced annual plan (assurance/advisory mix, cycle coverage), the IIA-Standards/Three-Lines positioning, and the audit-committee residual-risk narrative. Reach for this when the user asks 'how do we rank our audit universe?', 'what should be on this year's audit plan?', 'how much of the universe can we cover?', or 'how do we stay IIA-conformant and independent?'. Used by internal-audit-lead (primary).

Plan and execute a single internal-audit engagement by traversing the internal-audit decision tree (assurance-vs-advisory → scope & criteria → sampling approach → evidence), then return the planning memo, the risk & control matrix (risk → control → type → tests), the walkthrough, the test of design + test of operating effectiveness with an attribute-sampling plan and sample size, and review-ready workpapers. Reach for this when the user asks 'draft the planning memo and RCM', 'how do we test this control?', 'what sample size?', or 'are our workpapers sufficient?'. Used by audit-engagement-specialist (primary).

Turn tested control gaps into well-formed internal-audit findings and report them by traversing the issue-rating branch of the internal-audit decision tree, then return each finding on the 5 C's (Criteria/Condition/Cause/Consequence/Corrective action), an impact×likelihood rating (high/medium/low), the agreed management action plan (owner + date), the audit-committee summary, and the follow-up / remediation-validation plan. Reach for this when the user asks 'write this control gap as a finding', 'how bad is this issue / what rating?', 'draft the audit report or committee summary', or 'how do we validate the fix closed?'. Used by audit-engagement-specialist (primary) and internal-audit-lead.