audit-preparation – Security skill for AI agents

Audit Preparation

What it is: The audit file checklist, so nothing the auditor asks for has to be hunted for at year end.

Overview

Works out the smallest useful Audit Preparation setup for the business in front of it, then

builds it only when asked. The default output is a short recommendation, not a

spreadsheet. Artifacts - CSV, SQL DDL, JSON Schema, Notion mapping - are produced on

request, from one field list so they cannot drift apart.

Be clear about what this is. It assembles the file. It does not perform the audit, it

does not test anything, and it produces no opinion on the financial statements - only a

qualified auditor can do that, and only after doing work this skill has no part in. What

it does is make sure the ten sections of the audit file exist, that each document is

requested, received, tracked and filed in one place, and that every query and adjustment

raised along the way has a visible answer.

One rule that causes most of the trouble at year end: permanent documents and tax filings

need current originals, not copies of copies. A registration certificate that lapsed, a

licence that was never renewed, a return filed only as a screenshot of a portal - each one

turns into an avoidable exception. Record source, version/date and verification status. Acceptable originals, certified copies and digital filings depend on the auditor and applicable rules; do not mark a valid digital record absent merely because it is a copy.

Layer: Layer 9: Audit. Fits: Growth stage. Table code: n/a.

When to Use This Skill

• audit file checklist
• audit document request tracker
• audit query log
• year-end document collection
• audit handover register

Also use it when the user says "the audit file checklist, so nothing the auditor asks for has to be hunted for at year end", or describes the same process happening in a

spreadsheet, a document or someone inboxes.

Do not use it for: the audit itself, assurance on the financial statements, or legal advice. This skill produces

empty templates only - it never holds or processes real employee or customer data.

How It Works

Follow the shared execution contract. The module-specific rules below define only domain fields, decisions, calculations, and safety constraints.

Step 1 - Identify intent

Read the request and pick the intent before asking anything.

• "set up" or "build" or "create" -> the user wants artifacts; go to Step 2.
• "our process is ..." or "it is in a sheet" -> the user wants to move an existing process; capture it, then Step 2.
• "is this right" or "review" or "audit" -> the user wants a check, not a build; answer from what they share.
• "how do I ..." -> advice question; answer directly and offer the build only if it helps.

Ask only if this is the highest-value missing fact; otherwise proceed without an opener:

> Q: When did the auditor last ask you for something, and how long did it take to find?

Step 2 - Ask only what is missing

Treat ambiguous replies as unanswered and ask which explicit option the user means. Record unknown values as Unknown; Unknown is not zero. A record must not be Done when a required check fails.

Skip anything the user already answered, in any earlier message. Ask the rest one at a

time, and stop as soon as the remaining answers would not change the output.

• Audit - Internal, statutory or both? / Is an auditor appointed? / First audit or a repeat?
• Period - Which financial year? / Year end date? / Single entity or group?
• File - What exists today? / Where is it kept? / How is it handed over?
• Requests - Requests in writing? / Who tracks them? / How long do they take to close?
• Outcome - What do you need? / A checklist, a request tracker or both?

Never invent an answer. If the user does not know, record it as unknown and carry on.

Step 3 - Hold the internal context

Hold the answers in this shape. It stays internal - it is not shown to the user unless

they ask, and it never carries a value the user did not give.

module: audit-preparation
intent: null            # setup | advice | review | fix | build | convert | export
scale: null             # Starter | Growth | Scale, only if the answer changes it
areas:
  "Audit": null
  "Period": null
  "File": null
  "Requests": null
  "Outcome": null
requested_outputs: []   # csv | sql | json | notion | xlsx - requested formats only
confirmed_facts: []     # only what the user actually said
open_questions: []      # the unanswered ones, in the order worth asking

Step 4 - Recommend the smallest workflow

Build an already requested artifact without asking again. For advice-only requests, give a short recommendation and offer the relevant artifact.

Recommended approach: One audit file record per document, tagged to the section of the file it belongs to, carrying the request date, the received date, days pending and any query or adjustment, so the file is assembled continuously instead of hunted for in the last week of the year.

Why this one: The proposed ten sections are a starting checklist; confirm the auditor’s current request list, engagement scope and period rather than assuming it is fixed. One record per document, with the section as a select, turns a folder into something a reviewer can navigate and something the business can hand over without a fortnight of searching.

Workflow: Section listed → Document identified → Request logged → Document prepared → Handover and receipt → Query or adjustment tracked → File closed

Step 5 - Build only on request

Once the user asks for it, derive the fields from the confirmed context and emit the

requested artifacts. For machine-readable text, keep prose outside the data; for files,

provide a usable link. Report material validation failures or limitations separately.

**A selected Notion output is rendered by notion-manual-import, so route the

Notion step there.** When the user selects Notion, hand that step to

@notion-manual-import: it holds the CSV, the property

mapping, the import steps and the verification checklist, and it renders the Field

Reference below instead of defining a table of its own. Do not restate the mapping

here and do not improvise the import steps. Manual CSV and mapping outputs need no

connection. For requested workspace changes, follow the shared contract: verify actual

tool access and the target before writing. A user saying "connected" is not tool evidence.

Never ask for a Notion password or token.

Audit Item,Section,Document Required,Reference/Location,Period Covered,Requested Date,Received Date,Days Pending,Prepared By,Reviewed By,Query Raised,Query Detail,Auditor Note,Adjustment Required,Adjustment Reference,Adjusted,Status,Notes,Audit File ID
Bank reconciliation statement,Banking & Financing,"Bank reconciliation statements for all accounts, for the period",Audit File 2026 / Section E,FY 2025-26,2026-08-05,2026-08-09,4,Example Preparer,Example Reviewer,No,None raised,No query this cycle,No,Not applicable,Not Required,Done,Filed with the reconciliation pack; no query raised.,

CREATE TABLE audit_preparation (
  audit_item VARCHAR(255),
  section VARCHAR(100) NOT NULL,
  document_required VARCHAR(255),
  reference_location VARCHAR(255),
  period_covered VARCHAR(255),
  requested_date DATE NOT NULL,
  received_date DATE,
  days_pending NUMERIC,
  prepared_by VARCHAR(255),
  reviewed_by VARCHAR(255),
  query_raised VARCHAR(100) NOT NULL,
  query_detail TEXT,
  auditor_note TEXT,
  adjustment_required VARCHAR(100) NOT NULL,
  adjustment_reference VARCHAR(255),
  adjusted VARCHAR(100) NOT NULL,
  status VARCHAR(100) NOT NULL,
  notes TEXT,
  audit_file_id SERIAL PRIMARY KEY,
  created_at TIMESTAMP DEFAULT NOW(),
  updated_at TIMESTAMP DEFAULT NOW()
);

CREATE INDEX idx_audit_preparation_status ON audit_preparation (status);

{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "title": "Audit Preparation",
  "type": "object",
  "additionalProperties": false,
  "properties": {
      "Audit Item": { "type": "string" },
      "Section": { "type": "string" },
      "Document Required": { "type": "string" },
      "Reference/Location": { "type": "string" },
      "Period Covered": { "type": "string" },
      "Requested Date": { "type": "string", "format": "date" },
      "Received Date": { "type": "string", "format": "date" },
      "Days Pending": { "type": "number" },
      "Prepared By": { "type": "string" },
      "Reviewed By": { "type": "string" },
      "Query Raised": { "type": "string" },
      "Query Detail": { "type": "string" },
      "Auditor Note": { "type": "string" },
      "Adjustment Required": { "type": "string" },
      "Adjustment Reference": { "type": "string" },
      "Adjusted": { "type": "string" },
      "Status": { "type": "string" },
      "Notes": { "type": "string" },
      "Audit File ID": { "type": "integer" }
  },
  "required": [
      "Section",
      "Request

… (full content is in the download package)