audit-category-pointer

Stars8

Forks2

UpdatedJune 12, 2026 at 00:11

Pointer to a library of 10 specialized audit/compliance skills — ISACA, COSO, AICPA SOC, Audit Workpapers, NIST 800-53/RMF, NIST CSF 2.0, HIPAA Security Rule, PCI DSS, SOX §302 disclosure controls, and FedRAMP cloud authorization. Use when working on IT audit, internal controls, SOC reporting, audit documentation, federal control baselines, cybersecurity maturity, HIPAA security, PCI DSS payment-security, SOX §302 disclosure-controls certification, or FedRAMP cloud-authorization tasks.

Installation

Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.

Source

amurthygithub

amurthygithub/Audit-skills

View GitHub Repository View Creator Repositories

Download

Related occupationsSOC

Based on SOC occupation classification

Compliance OfficersBusiness and Financial Operations Occupations·SOC 13-1041

File Explorer

100 files

SKILL.md

readonly

More from this repository

same repository

nist-800-53-rmf

amurthygithub/Audit-skills

Perform NIST SP 800-53 Rev 5 control selection, implementation, assessment, and continuous monitoring using the NIST Risk Management Framework (SP 800-37 Rev 2 RMF). Covers FIPS 199 categorization, baseline selection (Low/Moderate/High), 800-53A assessment procedures, control inheritance (FedRAMP/shared services/cloud), SAR/POA&M and ATO determination. Activate when performing RMF Step 2 (categorize), Step 3 (select), Step 4 (implement), Step 5 (assess), Step 6 (authorize), or Step 7 (monitor); when mapping SOC 2 / ISO 27001 / PCI / HIPAA to 800-53; when planning or executing a FedRAMP authorization; or when responding to a federal/DoD assessment.

2026-06-128

fedramp-authorization

amurthygithub/Audit-skills

FedRAMP cloud-authorization program (Rev 5) — the FedRAMP Authorization Act of 2022 (44 U.S.C. 3607-3616), OMB M-24-15, the Rev 5 baselines (Low 156 / Moderate 323 / High 410 / LI-SaaS 156, tailored from NIST SP 800-53 Rev 5), the SSP/SAP/SAR/POA&M package, the 3PAO assessment, monthly Continuous Monitoring, and the FedRAMP 20x direction. Two load-bearing facts: FedRAMP baselines ARE tailored 800-53 controls (not a separate catalog — that is nist-800-53-rmf), and the current authorizer is the statutory FedRAMP Board, NOT the retired JAB. Use to categorize a system (FIPS 199 high-water mark) and select a baseline, scope an authorization package, plan a 3PAO assessment, run monthly ConMon and POA&M, or determine LI-SaaS eligibility. Activate when the user says 'FedRAMP', 'cloud authorization', 'ATO', 'P-ATO', 'agency authorization', '3PAO', 'SSP', 'SAR', 'POA&M', 'ConMon', 'continuous monitoring', 'Li-SaaS', 'FedRAMP baseline', 'FedRAMP Moderate/High', 'FedRAMP 20x', 'authorization to operate', or 'cloud servic

2026-06-118

audit-workpapers

amurthygithub/Audit-skills

Create, organize, evaluate, and review audit workpapers per PCAOB AS 1215, AS 2315, AS 1105, and AS 3105, AICPA AU-C 230, ISA 230, COSO ICIF-2013, and ISACA ITAF. Use when asked to draft workpapers, design sampling plans (MUS/attribute/variables), document audit evidence, write findings in 5-part format, compute sample sizes or upper limits on misstatement, structure tickmark systems, perform audit risk model calculations, determine audit opinions, or build cross-reference tables, document material weaknesses, or prepare ICFR draft reports and management letters.

2026-06-118

sox-302-disclosure-controls

amurthygithub/Audit-skills

SOX §302 Disclosure Controls & Procedures (DC&P) certification — 15 U.S.C. 7241; SEC Rules 17 CFR 240.13a-14 / 240.13a-15; Reg S-K Items 307, 308. The 6-element officer certification (PEO + PFO), quarterly DC&P evaluation, and the load-bearing DC&P-vs-ICFR and §302-vs-§404 boundaries. Use to draft or review a §302 certification, conclude on DC&P effectiveness after a material weakness, determine a newly-public filer's certification obligations, design a multi-entity sub-certification cascade, or scope the non-financial disclosure universe (risk factors, legal, MD&A, cyber 8-K). Activate when the user says 'SOX 302', 'Section 302', 'disclosure controls and procedures', 'DC&P', 'officer certification', '13a-14', '13a-15', 'Item 307', 'Item 308', 'disclosure committee', 'sub-certification', or 'PEO/PFO certification'.

2026-06-118

coso-internal-controls

amurthygithub/Audit-skills

Perform COSO 2013 ICIF-based internal control assessments including SOX 404 ICFR evaluation, PCAOB AS 2201 top-down audit, deficiency classification, walkthrough procedures, Risk and Control Matrix documentation, entity-level and process-level control assessment, COSO 2017 ERM integration, and emerging technology controls. Activate for COSO framework application, ICFR assessment, SOX 404 compliance, internal control deficiency evaluation, or PCAOB AS 2201 audit procedures.

2026-06-118

pci-dss-assessment

amurthygithub/Audit-skills

PCI DSS v4.0.1 (Payment Card Industry Data Security Standard, Requirements and Testing Procedures): 6 goals, 12 principal requirements, 63 sections, 249 main-body defined requirements, plus appendices A-G. Serves BOTH an auditee path (merchant/service-provider scoping, SAQ selection, self-assessment) and an assessor path (QSA/ISA workflow, ROC vs AOC, customized-approach and compensating-control validation). Use to scope a cardholder data environment (CDE), select among the 10 SAQ types, walk Requirements 1-12, distinguish the defined vs customized approach, build a compensating-control worksheet, or confirm v4.0.1 currency. Activate when the user says 'PCI DSS', 'PCI compliance', 'cardholder data', 'CDE', 'SAQ', 'ROC', 'AOC', 'QSA', 'network security controls', 'account data', 'segmentation', 'customized approach', or 'compensating control'.

2026-06-118

Audit Capability Library

This is a pointer skill. The 10 specialized skills are stored on disk to keep your startup context minimal. Counts and framework facts live in each skill (verified against live sources at its G4.5 gate) — this pointer deliberately repeats none of them.

Available skills in this category

isaca-audit-methodology — ISACA CISA audit methodology, COBIT 2019, ITAF (5th Edition), ITGC/ITAC testing, risk-based audit planning, maturity assessment.

coso-internal-controls — COSO 2013 ICIF and 2017 ERM, SOX 404 readiness, PCAOB AS 2201 top-down approach, deficiency classification (MW/SD/D), walkthroughs, RCM.

aicpa-soc-reporting — SOC 1/2/3 engagements, Trust Services Criteria (TSP §100), CUECs/CSOCs, bridge letters, management assertions, opinion determination.

audit-workpapers — workpaper standards (PCAOB AS 1215, AU-C 230, ISA 230), evidence hierarchy, sampling (MUS/attribute/variables), finding formats, engagement completion.

nist-800-53-rmf — NIST SP 800-53 Rev 5 control baselines, SP 800-37 RMF steps, FIPS 199 categorization, FedRAMP context, SOC 2/ISO/PCI/HIPAA crosswalks, ATO artifacts.

nist-csf-2 — NIST CSF 2.0 organizational profiles, tiers, gap analysis, board-level maturity reporting, crosswalks to 800-53/ISO/SOC 2/CMMC.

hipaa-security-rule — 45 CFR Part 164 Subpart C safeguards, required-vs-addressable dispositions, risk analysis, BAA requirements, OCR readiness, enforcement and (proposed) NPRM context.

pci-dss-assessment — PCI DSS v4.0.1 scoping and segmentation, SAQ selection, ROC/AOC validation, defined-vs-customized approach, compensating controls, QSA workflow.

sox-302-disclosure-controls — SOX §302 disclosure controls & procedures (DC&P) certification, DC&P-vs-ICFR boundary, 302-vs-404, the 6-element officer certification, disclosure committee and sub-certification cascade.

fedramp-authorization — FedRAMP cloud-authorization program (Rev 5): the FedRAMP Authorization Act of 2022 and OMB M-24-15 governance (FedRAMP Board, not the retired JAB), FIPS 199 categorization and the Low/Moderate/High/LI-SaaS baselines (tailored from NIST SP 800-53 Rev 5), the SSP/SAP/SAR/POA&M package, 3PAO assessment, monthly ConMon, and the FedRAMP 20x direction.

How to load a skill

Identify the skill name above matching your task.

Read skills/<skill-name>/SKILL.md (the router); load the chunks its §11 routing table selects for your intent. In an installed environment, read the skill's SKILL.md from wherever this library was installed.

Follow those instructions to complete the request.

Do not guess best practices — always read from the skill file first.

Quick reference: Which skill to use?

Task

Skill

IT audit planning, COBIT assessment, ITGC/ITAC testing

isaca-audit-methodology

SOX 404, internal control evaluation, deficiency classification

coso-internal-controls

SOC 1/2/3 scoping, TSC criteria, service org reporting

aicpa-soc-reporting

Workpapers, sampling, evidence documentation, findings

audit-workpapers

FIPS-199 categorization, 800-53 baselines, ATO/POA&M, FedRAMP

nist-800-53-rmf

Cyber maturity profiles, board reporting, framework crosswalks

nist-csf-2

HIPAA safeguards, addressable decisions, BAAs, OCR readiness

hipaa-security-rule

PCI DSS scoping, SAQ selection, ROC/AOC, compensating controls

pci-dss-assessment

SOX §302 DC&P certification, disclosure committee, sub-cert cascade

sox-302-disclosure-controls

FedRAMP authorization, baseline selection, SSP/SAR/POA&M, 3PAO assessment, ConMon, ATO path