| name | internal-controls-and-risk-framework |
| description | Use when authoring an internal-control policy, risk-management framework, control matrix, or risk register for an East African organisation; use `finance-policy-and-manual` for finance procedures and defer accounting controls, audit evidence, and close doctrine to Chwezi Accounting Doctrine. |
| metadata | {"portable":true,"compatible_with":["claude-code","codex"]} |
Internal Controls and Risk Framework
A consulting-deliverable skill: it produces a standalone organisational document — an Internal Control & Risk Management Framework — not a business-plan section. It owns the document's structure, the consulting workflow, the control and risk parameterisation, and the East African regulatory framing — and it pulls every control design, fraud test, and risk-treatment substance from the finance engine at C:\wamp64\www\chwezi-accounting-doctrine.
Use When
- A client needs an Internal Control & Risk Management Framework, Internal Control Policy, segregation-of-duties / authorisation framework, ICFR documentation pack (process narratives, risk-control matrices, walkthroughs), fraud-risk / anti-fraud policy, whistleblowing policy, or an enterprise risk register and risk-management policy.
- Responding to an RFP/EOI for "development of an internal control and risk management framework / risk register."
- Reviewing, gap-auditing, or maturing an existing control environment against COSO ERM / ISO 31000 and the entity's actual cycles.
Do Not Use When
- Writing the internal-control chapter inside a finance manual — use
advisory-deliverables/finance-policy-and-manual (controls are one chapter there; this skill is the full standalone framework).
- Producing a standalone procurement manual — use
advisory-deliverables/procurement-policy-and-manual.
- Writing a business-plan risk section — use
pipeline/12-risk-analysis.
- Answering a single control-design or fraud-test question — go straight to the relevant finance-engine
SKILL.md.
Required Inputs
Entity type (NGO/CSO, SME, SACCO/cooperative, donor-funded project, public/LG-adjacent body); legal form, registration (URSB/NGO Bureau), and funding model (donor-restricted, own revenue, mixed); reporting framework and whether ICFR-style assertion documentation is required; existing controls, policies, or risk register; board and committee structure (Audit/Risk committee, internal audit function); operating cycles in scope (cash, procurement, payroll, assets, grants); risk appetite signals from the board; jurisdiction (default Uganda) and whether public-sector surcharge/liability applies; named approver/owner. Never fabricate these — ask.
Workflow
- Intake & scope. Fix entity type, the document(s) wanted (Framework, Policy, ICFR pack, risk register), the cycles in scope, jurisdiction, and whether a public-sector surcharge overlay applies. If a framework or register exists, run a gap audit against the blueprint before drafting.
- Select the blueprint. Load
references/document-blueprint.md for the chapter map, the control set rendered as tables, the risk-register method, and the chapter→doctrine-skill map.
- Pull control and risk substance from the doctrine — do not improvise. For each chapter read the mapped finance-engine
SKILL.md (the blueprint carries the map), anchored on 10-controls-governance-and-fraud/internal-controls-library and sox-style-icfr-documentation, plus doctrine/references/uganda-ngo-financial-management-patterns.md (NGO) or uganda-public-sector-pfm.md (public).
- Draft section by section. Set every threshold, signatory count, authorisation tier, reconciliation cadence, and review frequency as a named client parameter. Propose defaults from the Uganda patterns (clearly flagged "to be board-approved"), never copied verbatim from another entity.
- Keep statutory rates and figures OUT of the body. Any surcharge/pecuniary-liability figures, statutory penalty rates, or tax touchpoints go into a dated, live-verified Statutory Schedule appendix that points to the source register — so the framework does not go stale.
- Build the control set as tables. Segregation-of-duties matrix, amount-keyed authorisation matrix, control-activity matrix by cycle (cash/bank, procurement, payroll, assets), and the bank-signatory mandate — from
internal-controls-library plus the NGO/public patterns. No person occupies two adjacent links of the control chain.
- Build the risk-management layer. Risk register (probability × impact, owner, mitigation, monitoring), risk appetite statement, and control self-assessment — to ISO 31000 / COSO ERM, cross-referencing
srs-skills 09-governance-compliance/04-risk-assessment and pipeline/12-risk-analysis for method. For public bodies, layer pecuniary-liability / surcharge per the LG (Financial & Accounting) Regulations 2007.
- Add fraud, ethics, monitoring, forms, and version control. Fraud-risk and forensic indicators; whistleblowing per the Whistleblowers Protection Act 2010; conflict-of-interest registers and clearance-on-exit; the internal-audit / monitoring function; the standard forms-and-registers appendix; and a review-and-amendment page with effective date and approver.
Quality Bar
Every control statement is specific and testable (no "adequate controls" — name the control, owner, frequency, and evidence); segregation of duties holds even for a three-person team, with no person in two adjacent links and nobody approving in their own favour; every threshold, signatory rule, and cadence is a named parameter with an owner and review date; the risk register carries probability × impact, owner, mitigation, and monitoring against a stated appetite; statutory/surcharge figures are never hardcoded in the body; the framework maps to the entity's actual cycles and to ICFR assertions where required; the public-sector surcharge overlay is applied only where it governs; and it passes anti-ai-slop and the doctrine conformance scan. British English throughout.
Anti-Patterns
- Vague controls ("controls are in place", "management reviews regularly") instead of named control, owner, frequency, and evidence.
- Dropping the SoD matrix or collapsing the request→approve→disburse→account→review chain because the entity is "too small".
- Letting one person occupy two adjacent links, approve in their own favour, or combine procurer, approver, and inventory-keeper roles.
- Embedding surcharge, penalty, or tax figures in the body instead of the live-verified Statutory Schedule.
- A risk register that lists risks without probability × impact, owner, mitigation, monitoring, or a stated risk appetite.
- Copying one organisation's thresholds, signatory rules, or appetite statements verbatim into another.
- Asserting a control or fraud-test design without reading the mapped finance-engine skill.
- Bolting on the public-sector surcharge overlay for a private NGO, or omitting it for a body it governs.
Outputs
Internal Control & Risk Management Framework; Internal Control Policy; SoD, authorisation, and control-activity matrices; ICFR documentation pack (process narratives, risk-control matrices, walkthroughs) where required; enterprise risk register + risk-appetite statement; fraud-risk and whistleblowing policy; forms-and-registers pack (risk register, CoI register, control self-assessment checklist, exception/incident log, whistleblowing intake form); dated Statutory Schedule appendix; adoption and version-control page; quality-gate manifest.
References
references/document-blueprint.md — chapter map, chapter→doctrine-skill mapping, control set as tables, risk-register method, parameterisation rule, and the standard forms/registers list.- Finance engine (
C:\wamp64\www\chwezi-accounting-doctrine): skills/10-controls-governance-and-fraud/ (internal-controls-library, sox-style-icfr-documentation, forensic-accounting-and-anti-fraud, whistleblowing-and-finance-ethics, aml-kyc-and-suspicious-transaction-reporting, engagement-quality-and-plain-language-output); skills/06-close-consolidation-and-reporting/audit-pbc-and-evidence-management; doctrine/references/uganda-ngo-financial-management-patterns.md, uganda-public-sector-pfm.md, uganda-compliance-caveats.md.
- Cross-engine risk method:
srs-skills/09-governance-compliance/04-risk-assessment; business-plan-skills/skills/pipeline/12-risk-analysis.
country-context/uganda/SKILL.md for institutions/regulatory bodies; language/east-african-english for style.
Inputs
| Artefact | Source or provider | Required? | If absent |
|---|
| Objectives, processes, systems, incidents, audits, and existing controls | Client records, walkthroughs, and interviews | Required | Return a scoped evidence request, not an invented risk assessment |
| Risk appetite, authority, legal, donor, and sector obligations | Board records and verified authorities | Required | Mark appetite and compliance scoring provisional |
| Finance controls and audit-evidence doctrine | Chwezi Accounting Doctrine | Required for money-touching risks | Stop finance-control conclusions pending doctrine and professional review |
Outputs
| Artefact | Consumer | Acceptance condition |
|---|
| Internal Control and Risk Management Framework | Board, management, process owners, assurance, auditors, and funders | Governance, risk method, control design, reporting, incidents, and review are operational |
| Risk register and control matrix | Risk owners and assurance reviewers | Risks link to causes, impacts, appetite, controls, evidence, owner, action, and residual rating |
Evidence Produced
| Evidence | Format | Acceptance condition |
|---|
| Risk-control-evidence traceability | Matrix with test and exception fields | Every key control has an owner, frequency, evidence, test, failure route, and remediation date |
| Finance quality-gate record | Doctrine and professional-review log | Money-touching controls map to current Chwezi doctrine and unresolved review blocks certification |
Capability Contract
Audit and assessment default to read-only. Edit the framework only when authorised. Do not change production controls, access rights, transactions, risk acceptance, whistleblowing records, or audit conclusions without explicit competent authority; never certify control effectiveness without test evidence.
Degraded Mode
Without walkthroughs, samples, system access, doctrine, or current legal sources, distinguish design review from operating-effectiveness testing and mark inaccessible checks not assessed. Return the narrowest risk register and evidence plan that the available facts support.
Decision Rules
| Choice | Action | Failure or risk avoided |
|---|
| Risk exceeds appetite and no effective control exists | Escalate and define a dated treatment before acceptance | Unowned material exposure |
| Control exists only in policy | Rate design only; test operation separately | False assurance |
| Segregation is impractical | Add documented compensating review and monitoring | Uncontrolled concentration of duties |
| Risk touches finance, tax, assets, payroll, grants, banking, or reporting | Apply Chwezi doctrine and professional review | Misstated control objective or evidence |
Workflow
- Confirm objectives, scope, users, assurance level, risk criteria, and authority.
- Map processes, assets, obligations, incidents, findings, systems, and dependencies.
- Identify risks through causes, events, impacts, existing controls, and evidence; stop where a material process cannot be observed.
- Score inherent risk, assess control design, and separate design from tested operation.
- Define treatments, owners, dates, indicators, escalation, and residual risk decisions.
- Apply Chwezi doctrine and qualified review to all money-touching controls and audit evidence.
- Test representative controls and exception paths; recover by narrowing conclusions or adding evidence work, never by upgrading an untested rating.
- Release with limitations, risk acceptance, action status, and review cadence visible.
Quality Standards
Risk ratings must be reasoned, controls testable, evidence retained, and limitations explicit. A control is effective only when both design and operating evidence support that conclusion; finance assertions require the Chwezi gate.
Anti-Patterns
- Listing generic risks with no cause or impact. Fix: write a specific cause-event-impact statement.
- Calling a policy clause an effective control. Fix: identify execution evidence and test a sample.
- Combining ownership and independent review in one role. Fix: separate or document a compensating control.
- Scoring every risk high to appear cautious. Fix: apply agreed criteria and record rationale.
- Reusing a finance control without doctrine mapping. Fix: verify objective, posting, reconciliation, and evidence under Chwezi doctrine.
- Hiding untested areas in an overall green rating. Fix: mark them
not assessed and qualify the conclusion.
Worked Example
Where one staff member creates and pays suppliers, rate the segregation risk, verify whether an independent bank and supplier-master review actually operates, sample its evidence, and keep operating effectiveness unassessed if records are unavailable.
For NGO cyber-resilience investment and control capacity, load NGO cyber-resilience investment conditions.
