/audit

name: audit
description: >
  Activate for: audit, audit preparation, audit pack, internal audit,
  external audit, regulatory audit, supervisory visit, audit evidence,
  audit trail, audit readiness, mock audit, audit findings, audit response,
  audit remediation, audit committee, board audit, annual audit, ISO audit,
  surveillance audit, certification audit, regulator visit, FCA visit,
  BSI audit, PCI audit, SOC 2 audit, audit questionnaire, evidence inventory.
  NOT for: compliance obligation mapping (use official compliance-tracking
  auto-skill), vendor evaluation (use official /vendor-review), risk
  register building (use official risk-assessment auto-skill).
license: Apache-2.0
metadata:
  author: Panaversity
  version: "1.0"
  plugin-commands: "/audit"
  mcp-integrations: "Compliance obligation map, document store, calendar"

UNIVERSAL RULES (apply to every audit task)

• NEVER walk into an audit without an evidence inventory -- the audit

that reveals you cannot locate your own evidence is harder to recover from than the audit that reveals a control gap

• NEVER respond to a finding by arguing with it -- acknowledge; explain

root cause; state corrective action; provide timeline

• ALWAYS include specific recommended actions with deadlines in every

output -- observations without actions are not acceptable

• ALWAYS load ops.local.md for organisation-specific regulatory frameworks,

compliance evidence locations, and escalation contacts

MANDATORY OUTPUT HEADER

Every output must begin with:

TASK:          [e.g. Audit Preparation -- ISO 27001 Surveillance]
AUDIT TYPE:    [Internal / External / Regulatory / Customer / Certification]
CONFIGURATION: [Loaded: ops.local.md / Not configured]
DATE:          [Date of output]
OWNER:         [Named person responsible]
REVIEW DATE:   [When to review/update]

COMPLIANCE STATUS STANDARD

Apply to every obligation assessed during audit preparation:

🟢 CURRENT:        Control effective; evidence current; no gaps
🟡 REVIEW NEEDED:  Evidence aging; control not recently tested
🟡 PARTIAL:        Control exists but incomplete; evidence gaps
🔴 GAP:            No effective control; evidence absent; obligation unmet
🔴 URGENT:         Active breach risk; immediate action required

RULE: Never mark an obligation as CURRENT without evidence. An obligation without evidence is, at best, PARTIAL.

AUDIT WORKFLOW

Task Type 1: PRE-AUDIT PREPARATION PLAN

For any audit with >4 weeks' notice, generate a preparation plan:

AUDIT PREPARATION PLAN: [Audit name / body]
================================================================
Audit type:      [Internal / External / Regulatory / Certification]
Auditor:         [Body name]
Date:            [Audit date or window]
Focus areas:     [What the auditor has indicated they will review]
Time to prepare: [Weeks]

WEEK-BY-WEEK PREPARATION TIMELINE:
[Week N]: [Actions -- evidence gathering; gap remediation]
[Week N]: [Actions -- document review; mock interviews]
[Final week]: [Actions -- final checks; logistics; briefings]

EVIDENCE INVENTORY (for each focus area):
| Obligation / Control | Evidence Required | Location | Age | Status |
|---|---|---|---|---|
| [Name] | [Document/record] | [Where stored] | [Date] | [Ready/Gap] |

GAPS TO CLOSE BEFORE AUDIT:
Priority 1 (close by [date -- 2 weeks before]):
  [Gap; action; owner]
Priority 2 (close by [date -- 1 week before]):
  [Gap; action; owner]

BRIEFING REQUIRED FOR:
[Who needs to be briefed; on what; by when]
================================================================

Task Type 2: MOCK AUDIT / REVIEW

Simulate the auditor's approach before the real audit:

MOCK AUDIT: [Focus area]
----------------------------------------------------------------
Simulated auditor questions (by area):

Q: [Question as auditor would phrase it]
A: [Ideal answer]
Evidence: [What you would present]
Gap: [If the answer is weak or evidence incomplete]

[Repeat for each focus area question]
----------------------------------------------------------------

Generate 5-10 questions per focus area. Weight towards areas where evidence is weakest (identified in the preparation plan).

Task Type 3: AUDIT RESPONSE FRAMEWORK

When audit findings are received, generate structured responses:

FINDING CLASSIFICATION:

CRITICAL: Immediate regulatory action possible; fix within 30 days
MAJOR:    Significant control failure; fix within 60-90 days
MINOR:    Process improvement opportunity; fix within 6 months
OBSERVATION: No immediate action required; monitor

RESPONSE STRUCTURE (per finding):

AUDIT FINDING RESPONSE: [Finding reference]
----------------------------------------------------------------
Finding:             [Exact wording from auditor]
Classification:      [CRITICAL / MAJOR / MINOR / OBSERVATION]
Our response:        [Factual; acknowledge the finding]
Root cause:          [Why this gap existed]
Action taken/planned:[Specific; with dates]
Owner:               [Named person]
Target completion:   [Date]
Evidence of completion: [What we will provide when done]
----------------------------------------------------------------

RULE: Audit responses are read by regulators and auditors as evidence of governance maturity. Defensive responses damage the relationship. Specific, accountable, evidenced responses demonstrate maturity.

AUDIT TYPES REFERENCE

INTERNAL AUDIT: Organisation's own audit function reviewing controls EXTERNAL AUDIT: Third-party auditor (financial; certification body) REGULATORY AUDIT: Regulator reviewing compliance (FCA; ICO; HMRC; HSE) CUSTOMER AUDIT: Customer reviewing supplier controls CERTIFICATION AUDIT: Certification body assessing against standard (ISO; PCI)

NEVER DO THESE

• NEVER produce an evidence inventory with "TBD" or "unknown" locations --

if the evidence location is unknown, that is a GAP; flag it as such

• NEVER brief only the team lead for an audit -- anyone who ma