audit-workpapers

Stars8

Forks2

UpdatedJune 11, 2026 at 22:38

Create, organize, evaluate, and review audit workpapers per PCAOB AS 1215, AS 2315, AS 1105, and AS 3105, AICPA AU-C 230, ISA 230, COSO ICIF-2013, and ISACA ITAF. Use when asked to draft workpapers, design sampling plans (MUS/attribute/variables), document audit evidence, write findings in 5-part format, compute sample sizes or upper limits on misstatement, structure tickmark systems, perform audit risk model calculations, determine audit opinions, or build cross-reference tables, document material weaknesses, or prepare ICFR draft reports and management letters.

Installation

Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.

Source

amurthygithub

amurthygithub/Audit-skills

View GitHub Repository View Creator Repositories

Download

Related occupationsSOC

Based on SOC occupation classification

Accountants and AuditorsBusiness and Financial Operations Occupations·SOC 13-2011

File Explorer

42 files

SKILL.md

readonly

More from this repository

same repository

nist-800-53-rmf

amurthygithub/Audit-skills

Perform NIST SP 800-53 Rev 5 control selection, implementation, assessment, and continuous monitoring using the NIST Risk Management Framework (SP 800-37 Rev 2 RMF). Covers FIPS 199 categorization, baseline selection (Low/Moderate/High), 800-53A assessment procedures, control inheritance (FedRAMP/shared services/cloud), SAR/POA&M and ATO determination. Activate when performing RMF Step 2 (categorize), Step 3 (select), Step 4 (implement), Step 5 (assess), Step 6 (authorize), or Step 7 (monitor); when mapping SOC 2 / ISO 27001 / PCI / HIPAA to 800-53; when planning or executing a FedRAMP authorization; or when responding to a federal/DoD assessment.

2026-06-128

audit-category-pointer

amurthygithub/Audit-skills

Pointer to a library of 10 specialized audit/compliance skills — ISACA, COSO, AICPA SOC, Audit Workpapers, NIST 800-53/RMF, NIST CSF 2.0, HIPAA Security Rule, PCI DSS, SOX §302 disclosure controls, and FedRAMP cloud authorization. Use when working on IT audit, internal controls, SOC reporting, audit documentation, federal control baselines, cybersecurity maturity, HIPAA security, PCI DSS payment-security, SOX §302 disclosure-controls certification, or FedRAMP cloud-authorization tasks.

2026-06-128

fedramp-authorization

amurthygithub/Audit-skills

FedRAMP cloud-authorization program (Rev 5) — the FedRAMP Authorization Act of 2022 (44 U.S.C. 3607-3616), OMB M-24-15, the Rev 5 baselines (Low 156 / Moderate 323 / High 410 / LI-SaaS 156, tailored from NIST SP 800-53 Rev 5), the SSP/SAP/SAR/POA&M package, the 3PAO assessment, monthly Continuous Monitoring, and the FedRAMP 20x direction. Two load-bearing facts: FedRAMP baselines ARE tailored 800-53 controls (not a separate catalog — that is nist-800-53-rmf), and the current authorizer is the statutory FedRAMP Board, NOT the retired JAB. Use to categorize a system (FIPS 199 high-water mark) and select a baseline, scope an authorization package, plan a 3PAO assessment, run monthly ConMon and POA&M, or determine LI-SaaS eligibility. Activate when the user says 'FedRAMP', 'cloud authorization', 'ATO', 'P-ATO', 'agency authorization', '3PAO', 'SSP', 'SAR', 'POA&M', 'ConMon', 'continuous monitoring', 'Li-SaaS', 'FedRAMP baseline', 'FedRAMP Moderate/High', 'FedRAMP 20x', 'authorization to operate', or 'cloud servic

2026-06-118

sox-302-disclosure-controls

amurthygithub/Audit-skills

SOX §302 Disclosure Controls & Procedures (DC&P) certification — 15 U.S.C. 7241; SEC Rules 17 CFR 240.13a-14 / 240.13a-15; Reg S-K Items 307, 308. The 6-element officer certification (PEO + PFO), quarterly DC&P evaluation, and the load-bearing DC&P-vs-ICFR and §302-vs-§404 boundaries. Use to draft or review a §302 certification, conclude on DC&P effectiveness after a material weakness, determine a newly-public filer's certification obligations, design a multi-entity sub-certification cascade, or scope the non-financial disclosure universe (risk factors, legal, MD&A, cyber 8-K). Activate when the user says 'SOX 302', 'Section 302', 'disclosure controls and procedures', 'DC&P', 'officer certification', '13a-14', '13a-15', 'Item 307', 'Item 308', 'disclosure committee', 'sub-certification', or 'PEO/PFO certification'.

2026-06-118

coso-internal-controls

amurthygithub/Audit-skills

Perform COSO 2013 ICIF-based internal control assessments including SOX 404 ICFR evaluation, PCAOB AS 2201 top-down audit, deficiency classification, walkthrough procedures, Risk and Control Matrix documentation, entity-level and process-level control assessment, COSO 2017 ERM integration, and emerging technology controls. Activate for COSO framework application, ICFR assessment, SOX 404 compliance, internal control deficiency evaluation, or PCAOB AS 2201 audit procedures.

2026-06-118

pci-dss-assessment

amurthygithub/Audit-skills

PCI DSS v4.0.1 (Payment Card Industry Data Security Standard, Requirements and Testing Procedures): 6 goals, 12 principal requirements, 63 sections, 249 main-body defined requirements, plus appendices A-G. Serves BOTH an auditee path (merchant/service-provider scoping, SAQ selection, self-assessment) and an assessor path (QSA/ISA workflow, ROC vs AOC, customized-approach and compensating-control validation). Use to scope a cardholder data environment (CDE), select among the 10 SAQ types, walk Requirements 1-12, distinguish the defined vs customized approach, build a compensating-control worksheet, or confirm v4.0.1 currency. Activate when the user says 'PCI DSS', 'PCI compliance', 'cardholder data', 'CDE', 'SAQ', 'ROC', 'AOC', 'QSA', 'network security controls', 'account data', 'segmentation', 'customized approach', or 'compensating control'.

2026-06-118

name	audit-workpapers
description	Create, organize, evaluate, and review audit workpapers per PCAOB AS 1215, AS 2315, AS 1105, and AS 3105, AICPA AU-C 230, ISA 230, COSO ICIF-2013, and ISACA ITAF. Use when asked to draft workpapers, design sampling plans (MUS/attribute/variables), document audit evidence, write findings in 5-part format, compute sample sizes or upper limits on misstatement, structure tickmark systems, perform audit risk model calculations, determine audit opinions, or build cross-reference tables, document material weaknesses, or prepare ICFR draft reports and management letters.
category	audit
risk	high
source	PCAOB AS 1215, AS 1105, AS 3105, AS 2110, AS 2315, AS 2201; AICPA AU-C 230; ISA 230; COSO ICIF-2013; ISACA ITAF; arXiv:2604.06116; arXiv:2403.14069
date_added	"2026-05-25T00:00:00.000Z"
version	0.2.0
status	draft
industries	["financial-services","public-sector","saas-technology","healthcare","other"]
frameworks	["PCAOB-AS-1215","PCAOB-AS-1105","PCAOB-AS-3105","PCAOB-AS-2315","PCAOB-AS-2110","PCAOB-AS-2201","AICPA-AU-C-230","IAASB-ISA-230","COSO-ICIF-2013","ISACA-ITAF"]
telemetry_contract	telemetry/schema.json#/$defs/SkillInvocation
token_baseline_target	{"input_p90":14000,"output_p90":4500}
context_budget	{"always_loaded_tokens":3000,"per_call_typical_tokens":6000,"per_call_max_tokens":15000,"per_call_p90_tokens":8000}
tags	["audit","workpapers","pcaob","aicpa","sampling","mus","attribute-sampling","audit-evidence","audit-risk","internal-control","coso","isaca","findings","quality-control","documentation","isa","board-deck","questionnaire-reuse","caic","sig-lite","vsaq"]

You are an expert audit agent performing PCAOB / AICPA / ISA / ISACA-compliant audit workpaper work. Use official standards terminology exclusively.

Audit Workpapers Skill (Router)

This SKILL.md is a router. The deep-dive content lives in chunks/. Load the chunks that match the user's intent. See section 11 Routing for the table.

1. When to Use / Not Use This Skill

Use This Skill When:

Creating, organizing, indexing, or reviewing any audit workpaper
Designing sampling plans (attribute, MUS/PPS, variables, non-statistical, dual-purpose)
Documenting audit evidence, re-performance, or re-computation
Writing audit findings in the 5-part C-C-C-E-R format
Computing sample sizes, upper limits on misstatement, or projected misstatements
Building tickmark legends, cross-reference tables, or lead schedules
Performing audit risk model calculations (AR = IR x CR x AP x TD)
Determining audit opinions (unqualified, qualified, adverse, disclaimer)
Preparing engagement completion documents (per AS 1215.13)
Ensuring compliance with PCAOB, AICPA, ISA, or ISACA documentation standards
Evaluating electronic workpaper controls, retention, or sign-off protocols
Integrating data analytics or ML-enhanced sampling into audit documentation
Reusing audit workpaper evidence for customer security questionnaires (CAIQ, SIG Lite, VSAQ).
Using the board-ready audit committee deck template (see aicpa-soc-reporting/assets/board_deck_template.md).

Do NOT Use This Skill When:

The task is purely tax preparation (different standards apply)
The task is a forensic investigation outside an audit engagement
The task involves advisory/consulting services with no audit documentation requirements
The task is a SOC 1/SOC 2 examination (use SOC-specific skills instead)
The user is asking about financial statement preparation (not an audit task)

2. Framework Overview

The audit workpapers skill encodes PCAOB, AICPA, IAASB (ISA), and ISACA documentation standards into a single executable playbook.

Layer	Document	Role
Documentation	[PCAOB-AS-1215] / [AICPA-AU-C-230] / [IAASB-ISA-230]	Workpaper content, retention, review, completion
Evidence	[PCAOB-AS-1105] / AU-C 500 / ISA 500	Evidence types, hierarchy, reliability, assertions
Sampling	[PCAOB-AS-2315] / AU-C 530 / ISA 530	Statistical/nonstatistical, MUS, attribute, variables
Risk	AS 1101 / [PCAOB-AS-2110] / AS 2301	Audit risk model (AR = IR x CR x AP x TD)
Opinion	[PCAOB-AS-3105] / AS 3101	Unqualified, qualified, adverse, disclaimer
Internal Control	[PCAOB-AS-2201] / [COSO-ICIF-2013]	Material weakness, significant deficiency
Deficiency Communication	[PCAOB-AS-1305]	Communication to audit committee and management
IT Audit	[ISACA-ITAF]	IT-specific workpaper standards, CAATs
Quality	QC 1000 / AS 1220 / AS 1201	Firm QC, EQR, supervisory review

Regulatory updates (2024-2026): QC 1000 eff. Dec 2025; [PCAOB-AS-1215] amendments eff. Dec 2026; [PCAOB-AS-2315] amendment eff. Dec 2026; COSO 2026 GenAI guidance.

3. Core Concepts

3.1 Workpaper Indexing (A-N)

Every workpaper receives a unique alphanumeric index: A=Permanent File, B=Planning & Risk, C=Internal Control, D=Revenue, E=Expenditures, F=Assets, G=Liabilities, H=Equity, I=Sampling, J=Analytical Procedures, K=Completion, L=Communications, M=Quality Review, N=Specialty Areas. See chunks/01-standards-and-structure.md.

3.2 Three Mandatory Elements (AS 1215.04)

Purpose, source, conclusion. See chunks/01-standards-and-structure.md for 5W1H framework and experienced auditor standard.

3.3 Tickmark System

8 standard tickmarks. See chunks/01-standards-and-structure.md.

3.4 Evidence Hierarchy

External > internal. Written > oral. See chunks/02-evidence-and-reperformance.md.

3.5 Sampling Methods

Attribute, MUS/PPS, variables, non-statistical, dual-purpose. See chunks/03-sampling.md.

3.6 Audit Risk Model

AR = IR x CR x AP x TD. See chunks/04-risk-and-opinion.md.

3.7 Five-Part Finding Format

C-C-C-E-R (Condition, Criteria, Cause, Effect, Recommendation). See chunks/05-finding-and-workflow.md.

3.8 Substantive Analytical Procedures

Expectation modeling, tolerable difference, variance analysis. See chunks/09-substantive-analytical-procedures.md.

4. Decision Logic (summary)

Full logic in chunks. Quick-ref:

Workpaper completeness -> chunks/01-standards-and-structure.md
Sample method -> 100% > specific items > statistical vs non-stat > attribute/MUS/variables -> chunks/03-sampling.md
MUS evaluation -> ULM = BP + Incremental Allowances -> chunks/03-sampling.md
Risk model -> compute TD from IR, CR, AP -> chunks/04-risk-and-opinion.md
Opinion -> scope limited? GAAP departure? material/pervasive? -> chunks/04-risk-and-opinion.md
IPE gating -> classify source x purpose -> chunks/02-evidence-and-reperformance.md
Analytical procedures -> build expectation, set tolerable difference, investigate variance -> chunks/09-substantive-analytical-procedures.md

5. Procedure Templates (summary)

7-step workflow -> chunks/05-finding-and-workflow.md
Sampling plan -> chunks/03-sampling.md
Re-performance / re-computation -> chunks/02-evidence-and-reperformance.md
Quality checklist -> chunks/07-qc-compliance-cross-refs.md
Substantive analytical procedure -> chunks/09-substantive-analytical-procedures.md

6. Output Templates (summary)

Standard workpaper template -> chunks/06-outputs-electronic-review.md
Sampling workpaper template -> chunks/06-outputs-electronic-review.md
Finding documentation template -> chunks/06-outputs-electronic-review.md
Engagement completion document -> chunks/06-outputs-electronic-review.md
IPE validation log -> chunks/06-outputs-electronic-review.md
Substantive analytical procedures workpaper template -> chunks/09-substantive-analytical-procedures.md

7. Cross-References (summary)

Internal: nist-800-53-rmf, isaca-audit-methodology, coso-internal-controls, aicpa-soc-reporting. External crosswalks in chunks/07-qc-compliance-cross-refs.md.

8. Worked Examples (high-level)

Full worked examples in use-cases/.

UC	Title	Industry	Key output
UC-01	MUS sampling workpaper for accounts receivable	financial-services	MUS plan, ULM, conclusion
UC-02	5-part finding for AP cutoff control gap	financial-services, public-sector	C-C-C-E-R finding, severity
UC-03	Audit risk model TD calculation	financial-services	TD computed from IR, CR, AP

9. Anti-Hallucination Disclaimers

PCAOB standards reorganization — paragraph numbers may have shifted post-2024. Verify against current PCAOB publications.
AS 1215 amendments (.09/.11) — effective Dec 15, 2026 per PCAOB Release No. 2024-005.
Sample size tables — illustrative. Use statistical formulas or audit software for engagement-level precision.
MUS worked examples — rounding differences up to $1 are immaterial.
ML/sequential sampling — based on arXiv preprints; emerging methodologies. Validate against current professional standards.
Opinion determination — requires professional judgment.

This skill encodes domain knowledge; it is not a substitute for professional judgment. Always verify outputs against the cited authoritative source.

10. References & Citation Manifest

Label	Title	Publisher	Identifier	Retrieval	URL
PCAOB-AS-1215	Audit Documentation	PCAOB	AS 1215	2026-05-25	https://pcaobus.org/oversight/standards/auditing-standards/details/AS1215
PCAOB-AS-1105	Audit Evidence	PCAOB	AS 1105	2026-05-25	https://pcaobus.org/oversight/standards/auditing-standards/details/AS1105
PCAOB-AS-2315	Audit Sampling	PCAOB	AS 2315	2026-05-25	https://pcaobus.org/oversight/standards/auditing-standards/details/AS2315
PCAOB-AS-3105	Departures from Unqualified Opinions	PCAOB	AS 3105	2026-05-25	https://pcaobus.org/oversight/standards/auditing-standards/details/AS3105
PCAOB-AS-2110	Identifying and Assessing Risks	PCAOB	AS 2110	2026-05-25	https://pcaobus.org/oversight/standards/auditing-standards/details/AS2110
PCAOB-AS-2201	Audit of ICFR	PCAOB	AS 2201	2026-05-25	https://pcaobus.org/oversight/standards/auditing-standards/details/AS2201
PCAOB-AS-1305	Communications About Control Deficiencies	PCAOB	AS 1305	2026-06-08	https://pcaobus.org/oversight/standards/auditing-standards/details/AS1305
AICPA-AU-C-230	Audit Documentation	AICPA	AU-C 230	2026-05-25	https://www.aicpa-cima.com/resources/landing/au-c-section-230
IAASB-ISA-230	Audit Documentation	IAASB	ISA 230 (in the 2023-2024 IAASB Handbook, Vol 1)	2026-06-10	https://www.iaasb.org/publications/2023-2024-handbook-international-quality-management-auditing-review-other-assurance-and-related
COSO-ICIF-2013	Internal Control Integrated Framework	COSO	2013	2026-05-25	https://www.coso.org/guidance-on-ic
ISACA-ITAF	IT Audit Framework (ITAF), 5th Edition	ISACA	5th Ed (2026)	2026-06-10	https://www.isaca.org/resources/it-audit

In-body citations use the form [LABEL section] and resolve to this manifest.

11. Routing

User intent	Load chunk(s)	Industry hint	Use case
"Workpaper structure" / "indexing" / "tickmarks" / "AS 1215" / "sign-off"	chunks/01-standards-and-structure.md	match industry	-
"Evidence hierarchy" / "AS 1105" / "re-performance" / "IPE validation" / "recomputation"	chunks/02-evidence-and-reperformance.md	match industry	-
"Sampling plan" / "MUS" / "attribute sampling" / "variables" / "ULM"	chunks/03-sampling.md	match industry	UC-01
"Audit risk model" / "AR = IR x CR" / "TD calculation" / "opinion" / "material weakness"	chunks/04-risk-and-opinion.md	match industry	UC-03
"Audit finding" / "C-C-C-E-R" / "workflow" / "7-step" / "draft a report"	chunks/05-finding-and-workflow.md	match industry	UC-02
"Workpaper templates" / "electronic workpapers" / "retention" / "review"	chunks/06-outputs-electronic-review.md	match industry	-
"Quality checklist" / "compliance" / "cross-reference" / "glossary"	chunks/07-qc-compliance-cross-refs.md	match industry	-
"Full audit engagement"	chunks/01,02,03,04,05,06,07	financial-services	UC-01, UC-02
"CAIQ" / "SIG Lite" / "VSAQ" / "customer questionnaire" / "workpaper evidence reuse"	chunks/08-questionnaire-reuse.md	match industry	-
"High-level question"	this SKILL.md only	-	-

Industries (load matching file from industries/): financial-services, public-sector, saas-technology, healthcare, other. Use cases (load matching file from use-cases/): UC-01 (MUS sampling AR), UC-02 (5-part finding), UC-03 (TD calculation).

12. Operational Quick-Reference

Structure the workpaper -> chunks/01-standards-and-structure.md
Document evidence -> chunks/02-evidence-and-reperformance.md
Design sampling -> chunks/03-sampling.md
Assess risk / opinion -> chunks/04-risk-and-opinion.md
Write findings -> chunks/05-finding-and-workflow.md
Use templates -> chunks/06-outputs-electronic-review.md
Validate quality -> chunks/07-qc-compliance-cross-refs.md