Internal Audit Assistant

Internal Audit Assistant（内部監査支援）

Overview

This skill provides professional internal audit support aligned with IIA (Institute of Internal Auditors) International Standards for the Professional Practice of Internal Auditing. Supports risk-based audit planning, audit program development, workpaper documentation, and corrective action tracking.

Primary language: Japanese (default), English supported Framework: IIA Standards, COSO Internal Control Framework, ISO 19011 (Audit Guidelines) Output format: Audit plans, audit programs, audit workpapers, CAR (Corrective Action Request) tracking

---

When to Use

• Annual audit planning: "Create FY2025 internal audit plan" or "年次監査計画を作成"
• Risk assessment: "Assess risks for the IT department" or "リスク評価マトリクスを作成"
• Audit program development: "Create audit program for accounts payable" or "買掛金監査プログラムを作成"
• Workpaper documentation: "Help document audit findings" or "監査調書を作成"
• CAR management: "Track corrective actions" or "是正措置のフォローアップ"
• External audit prep: "Prepare for SOX audit" or "ISO監査の準備"

---

Prerequisites

• Knowledge: Basic understanding of internal control frameworks (COSO, IIA Standards)
• Access: Organizational data for risk assessment (auditable entity list, prior audit findings)
• Tools: None required for documentation; optional Python for risk scoring automation

---

Workflow

1. Risk Assessment → Calculate risk scores for auditable entities using scripts/risk_scorer.py
2. Audit Planning → Prioritize entities and allocate audit resources
3. Program Development → Create detailed audit procedures and test steps
4. Fieldwork → Execute audit program, document workpapers
5. Reporting → Develop findings with condition/criteria/cause/effect structure
6. Follow-up → Track CARs through lifecycle using scripts/car_tracker.py

---

Output

| Deliverable | Format | Description | |-------------|--------|-------------| | Risk Assessment Matrix | Markdown table | Weighted risk scores for all auditable entities | | Annual Audit Plan | Markdown report | Prioritized audit schedule with resource allocation | | Audit Program | Markdown checklist | Detailed test procedures per audit | | Audit Workpaper | Markdown document | Test results with evidence references | | Audit Finding | Markdown document | Condition/Criteria/Cause/Effect/Recommendation structure | | CAR Status Report | Markdown table | Corrective action tracking dashboard |

---

Resources

• references/iia_standards_summary.md: IIA International Standards quick reference
• references/sampling_guide.md: Statistical and judgmental sampling methods
• scripts/risk_scorer.py: Calculate weighted risk scores for auditable entities
• scripts/car_tracker.py: Track CAR lifecycle and generate status reports
• assets/audit_finding_template.md: Template for documenting audit findings (Condition/Criteria/Cause/Effect)
• assets/sample_entities.csv: Sample data for risk_scorer.py
• assets/sample_cars.csv: Sample data for car_tracker.py

---

Quick Start Examples

# Calculate risk scores for auditable entities (CSV input)
python3 scripts/risk_scorer.py assets/sample_entities.csv --output risk_matrix.md

# Generate CAR status report from tracking data
python3 scripts/car_tracker.py assets/sample_cars.csv --report monthly

# Generate overdue CAR report
python3 scripts/car_tracker.py assets/sample_cars.csv --report overdue

# Export risk matrix as JSON
python3 scripts/risk_scorer.py assets/sample_entities.csv --format json

---

Core Framework: IIA International Standards

Definition of Internal Auditing

> Internal auditing is an independent, objective assurance and consulting activity designed to add value and improve an organization's operations. It helps an organization accomplish its objectives by bringing a systematic, disciplined approach to evaluate and improve the effectiveness of risk management, control, and governance processes.

IIA Standards Structure

Attribute Standards (1000 series):

• 1000: Purpose, Authority, and Responsibility
• 1100: Independence and Objectivity
• 1200: Proficiency and Due Professional Care
• 1300: Quality Assurance and Improvement Program

Performance Standards (2000 series):

• 2000: Managing the Internal Audit Activity
• 2100: Nature of Work
• 2200: Engagement Planning
• 2300: Performing the Engagement
• 2400: Communicating Results
• 2500: Monitoring Progress
• 2600: Communicating the Acceptance of Risks

---

Core Workflows

Workflow 1: Risk-Based Audit Planning

Purpose: Develop annual internal audit plan based on organizational risk assessment.

Step 1: Universe of Auditable Entities

Create comprehensive list of all auditable entities:

Example Universe:

| Entity ID | Entity Name | Department | Type | Last Audit | Risk Score |
|-----------|-------------|------------|------|------------|------------|
| FIN-01 | Accounts Payable | Finance | Process | 2024-03 | High |
| FIN-02 | Treasury Management | Finance | Process | 2023-11 | High |
| IT-01 | Access Management | IT | System | 2024-01 | Critical |
| IT-02 | Backup & Recovery | IT | System | 2023-06 | High |
| HR-01 | Payroll Processing | HR | Process | 2024-05 | Medium |
| OPS-01 | Procurement | Operations | Process | 2023-09 | High |
| OPS-02 | Inventory Management | Operations | Process | Never | Medium |
| COMP-01 | GDPR Compliance | Legal | Compliance | 2024-02 | High |

Entity Types:

• Process: Business processes (procurement, payroll, etc.)
• System: IT systems and applications
• Compliance: Regulatory compliance areas
• Project: Major projects or initiatives
• Strategic: Strategic risks (M&A, market entry, etc.)

Step 2: Risk Assessment Matrix

Assess each entity using quantitative risk scoring:

Risk Factors (each scored 1-5):

1. Inherent Risk: Complexity, volume, sensitivity of activity
2. Control Environment: Strength of existing controls
3. Financial Impact: Potential monetary impact of failure
4. Regulatory Impact: Compliance and legal consequences
5. Last Audit Date: Time since last audit
6. Management Concern: Requests from senior management

Risk Score Calculation:

Risk Score = (Inherent Risk × 0.25) +
             (Control Environment × 0.20) +
             (Financial Impact × 0.20) +
             (Regulatory Impact × 0.20) +
             (Last Audit Date × 0.10) +
             (Management Concern × 0.05)

Risk Level:
- Critical: 4.0 - 5.0
- High: 3.0 - 3.9
- Medium: 2.0 - 2.9
- Low: 1.0 - 1.9

Example Risk Assessment:

Entity: IT-01 Access Management

| Factor | Score | Weight | Weighted Score |
|--------|-------|--------|----------------|
| Inherent Risk | 5 (Critical data access) | 0.25 | 1.25 |
| Control Environment | 3 (Some controls) | 0.20 | 0.60 |
| Financial Impact | 4 (Data breach costs) | 0.20 | 0.80 |
| Regulatory Impact | 5 (GDPR, SOX) | 0.20 | 1.00 |
| Last Audit Date | 2 (1 year ago) | 0.10 | 0.20 |
| Management Concern | 4 (Recent incidents) | 0.05 | 0.20 |

**Total Risk Score: 4.05 (Critical)**

Step 3: Audit Plan Prioritization

Prioritization Rules:

1. Critical risk entities: MUST audit annually
2. High risk entities: Audit every 1-2 years
3. Medium risk entities: Audit every 2-3 years
4. Low risk entities: Audit every 3-5 years or cyclically

Additional Considerations:

• Regulatory requirements (SOX audits, ISO surveillance)
• Management requests
• External audit coordination
• Resource availability (audit hours available)

Step 4: Annual Audit Plan Output

Example Annual Audit Plan:

# FY2025 Internal Audit Plan

## Executive Summary
- Total Auditable Entities: 45
- Planned Audits: 18
- Total Audit Hours: 2,400 hours
- Risk Coverage: 85% of Critical/High risk entities

## Audit Schedule

| Quarter | Audit Name | Type | Risk Level | Hours | Lead Auditor |
|---------|------------|------|------------|-------|--------------|
| Q1 | IT Access Management | System | Critical | 200 | A. Tanaka |
| Q1 | Accounts Payable | Process | High | 150 | B. Sato |
| Q1 | SOX IT Controls | Compliance | High | 120 | A. Tanaka |
| Q2 | Treasury Management | Process | High | 180 | C. Suzuki |
| Q2 | Procurement | Process | High | 160 | B. Sato |
| Q2 | GDPR Compliance | Compliance | High | 140 | D. Yamada |
| Q3 | Backup & Recovery | System | High | 120 | A. Tanaka |
| Q3 | Vendor Management | Process | Medium | 140 | C. Suzuki |
| Q3 | Physical Security | Operational | Medium | 100 | B. Sato |
| Q4 | Payroll Processing | Process | Medium | 130 | D. Yamada |
| Q4 | Contract Management | Process | Medium | 120 | C. Suzuki |
| Q4 | Follow-up Audits | Various | - | 240 | All |

## Risk Coverage Analysis
- Critical Risk Entities: 5 → Audited: 5 (100%)
- High Risk Entities: 12 → Audited: 8 (67%)
- Medium Risk Entities: 18 → Audited: 4 (22%)
- Low Risk Entities: 10 → Audited: 0 (0%)

## Resource Allocation
- Lead Auditor A. Tanaka (IT): 800 hours
- Lead Auditor B. Sato (Ops): 650 hours
- Lead Auditor C. Suzuki (Finance): 600 hours
- Lead Auditor D. Yamada (Compliance): 350 hours
- Total: 2,400 hours

---

Workflow 2: Audit Program Development

Purpose: Create detailed audit program (procedures and test steps) for each audit.

Step 1: Define Audit Objectives

Audit objectives should align with:

• Risk factors identified in planning phase
• IIA Standards (evaluate risk management, control, governance)
• Regulatory requirements (if applicable)

Example (Accounts Payable Audit):

## Audit Objectives

1. **Completeness**: Ensure all valid invoices are recorded and paid
2. **Accuracy**: Verify accuracy of invoice amounts and payment calculations
3. **Authorization**: Confirm proper approval of invoices and payments
4. **Segregation of Duties**: Verify separation of key functions
5. **Compliance**: Ensure compliance with company policies and tax regulations
6. **Fraud Prevention**: Assess controls to prevent duplicate payments and fictitious vendors

Step 2: Identify Key Controls

For each objective, identify key controls to be tested:

Example Control Matrix (Accounts Payable):

| Objective | Control ID | Control Description | Control Type | Frequency |
|-----------|------------|---------------------|--------------|-----------|
| Authorization | AP-C01 | Three-way match (PO/Receipt/Invoice) | Preventive | Per transaction |
| Authorization | AP-C02 | Approval workflow (manager sign-off) | Preventive | Per invoice |
| Accuracy | AP-C03 | Automated GL posting validation | Detective | Daily |
| Segregation | AP-C04 | Different users for AP entry vs. payment approval | Preventive | Continuous |
| Fraud Prevention | AP-C05 | Duplicate invoice check (system control) | Preventive | Per invoice |
| Fraud Prevention | AP-C06 | Vendor master file review | Detective | Quarterly |

Step 3: Design Test Procedures

For each control, design specific test procedures:

Test Procedure Template:

### Test Procedure: AP-C01 (Three-Way Match)

**Control Objective**: Ensure invoices are matched to purchase orders and receiving reports before payment.

**Test Steps**:
1. Obtain AP transaction listing for [audit period]
2. Select sample of [X] invoices using [sampling method]
3. For each sample item:
   a. Verify existence of approved purchase order
   b. Verify existence of receiving report (goods receipt)
   c. Verify invoice matches PO and receipt (quantities, prices)
   d. Verify discrepancies are investigated and resolved
   e. Document any exceptions
4. Calculate exception rate
5. Assess control effectiveness

**Sample Size**: 30 transactions (statistical sampling, 95% confidence)
**Sampling Method**: Random selection from population
**Expected Result**: 0-1 exceptions acceptable (95% compliance)
**Workpaper Reference**: AP-01-T1

Step 4: Complete Audit Program

Audit Program Structure:

# Audit Program: Accounts Payable

## Audit Information
- Audit ID: FIN-AP-2025-Q1
- Audit Period: January 1 - March 31, 2025
- Auditee: Finance Department - Accounts Payable Team
- Lead Auditor: B. Sato
- Planned Hours: 150
- Fieldwork Dates: April 7-18, 2025

## Section 1: Planning and Risk Assessment
- [ ] Review prior audit findings and corrective actions
- [ ] Conduct entrance meeting with AP Manager
- [ ] Obtain and review AP policies and procedures
- [ ] Perform walkthrough of AP process
- [ ] Identify and document key controls
- [ ] Assess inherent and residual risk
- [ ] Finalize audit scope and objectives

## Section 2: Control Testing
- [ ] Test AP-C01: Three-way match (WP: AP-01-T1)
- [ ] Test AP-C02: Approval workflow (WP: AP-02-T2)
- [ ] Test AP-C03: GL posting validation (WP: AP-03-T3)
- [ ] Test AP-C04: Segregation of duties (WP: AP-04-T4)
- [ ] Test AP-C05: Duplicate invoice check (WP: AP-05-T5)
- [ ] Test AP-C06: Vendor master file review (WP: AP-06-T6)

## Section 3: Substantive Testing
- [ ] Analyze vendor concentration risk
- [ ] Review aged payables report
- [ ] Test completeness of accruals
- [ ] Verify tax withholding accuracy
- [ ] Test foreign currency invoice processing (if applicable)

## Section 4: Reporting
- [ ] Summarize test results and exceptions
- [ ] Draft audit findings
- [ ] Conduct exit meeting with auditee
- [ ] Prepare audit report
- [ ] Issue Corrective Action Requests (CARs)
- [ ] Obtain management responses
- [ ] Finalize and distribute audit report

## Audit Team
- Lead Auditor: B. Sato (80 hours)
- Staff Auditor: E. Kobayashi (50 hours)
- QA Reviewer: Chief Audit Executive (20 hours)

---

Workflow 3: Audit Workpaper Documentation

Purpose: Create standardized, professional audit workpapers that document audit procedures, evidence, and conclusions.

Workpaper Best Practices

IIA Standards Requirements (2330):

• Document sufficient, reliable, relevant, and useful information
• Support conclusions and engagement results
• Enable experienced auditor to understand work performed
• Retain in accordance with organizational policies and legal requirements

Workpaper Indexing System:

[Audit Code]-[Section]-[Sequence]

Examples:
AP-01-T1 = Accounts Payable, Section 01 (Three-way match), Test 1
AP-02-T2 = Accounts Payable, Section 02 (Approvals), Test 2
IT-ACC-01 = IT Access Mgmt, Section ACC (Access Controls), Workpaper 01

Workpaper Template

Standard Workpaper Header:

# Audit Workpaper

**Audit Name**: Accounts Payable Process Audit
**Audit ID**: FIN-AP-2025-Q1
**Workpaper Ref**: AP-01-T1
**Prepared By**: E. Kobayashi
**Date**: 2025-04-10
**Reviewed By**: B. Sato
**Review Date**: 2025-04-15

---

## Objective
Test the effectiveness of three-way match control (AP-C01) to ensure invoices are properly validated before payment.

## Scope
Invoice transactions from January 1 - March 31, 2025

## Procedure
1. Obtained AP transaction listing (3,450 invoices totaling $12.5M)
2. Selected random sample of 30 invoices (see sampling workpaper AP-00-SMPL)
3. For each sample, verified:
   - Approved purchase order exists
   - Receiving report exists
   - Invoice matches PO and receipt
   - Discrepancies properly resolved
4. Documented exceptions
5. Calculated exception rate and assessed control effectiveness

## Population
- Total invoices: 3,450
- Total value: $12,500,000
- Sample size: 30 invoices
- Sample value: $145,000

## Test Results

| Sample # | Invoice # | Amount | PO Match | Receipt Match | Discrepancy Resolution | Exception? |
|----------|-----------|--------|----------|---------------|------------------------|------------|
| 1 | INV-00125 | $4,500 | ✓ | ✓ | N/A | No |
| 2 | INV-00230 | $12,300 | ✓ | ✓ | N/A | No |
| 3 | INV-00341 | $2,100 | ✓ | ✓ | N/A | No |
| ... | ... | ... | ... | ... | ... | ... |
| 18 | INV-02187 | $8

…

## Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [takusaotome](https://github.com/takusaotome)
- **Source:** [takusaotome/claude-skills-library](https://github.com/takusaotome/claude-skills-library)
- **License:** MIT
- **Homepage:** https://takusaotome.github.io/claude-skills-library/

Install and usage instructions live in the source repository linked above.