Audit ReportSAFE

An agent skill published by revfactory.

The instruction file, verbatim from the audited commit — this is the text the model reads, and the surface the audit's instruction layer examines. Quoted here so you can judge it without cloning anything.

---
name: audit-report
description: "An internal audit report generation pipeline. An agent team collaborates to produce everything from audit scope design through checklists, findings, improvement recommendations, and tracking ledgers. Use this skill for 'create audit report', 'internal audit preparation', 'create audit checklist', 'organize audit findings', 'corrective action plan', 'audit tracking ledger', 'compliance audit', 'operational audit report', and similar internal audit topics. External financial audits, tax investigations, and litigation-related audits are out of scope."
---

# Audit Report — Internal Audit Report Generation Pipeline

Generates audit scope design, checklists, findings analysis, improvement recommendations, and implementation tracking ledgers through agent team collaboration.

## Execution Mode

**Agent Team** — 5 members communicate directly via SendMessage and cross-validate each other's work.

## Agent Roster

| Agent | File | Role | Type |
|-------|------|------|------|
| scope-designer | `.claude/agents/scope-designer.md` | Audit scope, criteria, plan design | general-purpose |
| checklist-builder | `.claude/agents/checklist-builder.md` | Control items, test procedures, evidence | general-purpose |
| findings-analyst | `.claude/agents/findings-analyst.md` | Finding 4C analysis, root cause | general-purpose |
| recommendation-writer | `.claude/agents/recommendation-writer.md` | Corrective actions, implementation plans, priorities | general-purpose |
| tracking-manager | `.claude/agents/tracking-manager.md` | Tracking ledger, escalation, closure | general-purpose |

## Workflow

### Phase 1: Preparation (performed directly by the orchestrator)

1. Extract from user input:
    - **Audit target**: Department, process, system, project
    - **Audit type**: Regular/Special/Follow-up
    - **Audit context**: Regulation changes, incidents, scheduled review
    - **Applicable criteria** (optional): Related laws, policies, industry standards
    - **Existing materials** (optional): Previous audit results, existing checklists
2. Create the `_workspace/` directory in the project root
3. Organize the input and save to `_workspace/00_input.md`
4. If existing materials are provided, copy to `_workspace/` and determine whether to skip the relevant phase
5. Determine the **execution mode** based on the request scope

### Phase 2: Team Assembly and Execution

| Order | Task | Owner | Dependencies | Deliverable |
|-------|------|-------|-------------|-------------|
| 1 | Audit scope design | scope | None | `_workspace/01_audit_scope.md` |
| 2 | Checklist creation | checklist | Task 1 | `_workspace/02_audit_checklist.md` |
| 3 | Findings analysis | findings | Tasks 1, 2 | `_workspace/03_audit_findings.md` |
| 4 | Recommendations | recommendation | Task 3 | `_workspace/04_recommendations.md` |
| 5 | Tracking ledger | tracking | Tasks 3, 4 | `_workspace/05_tracking_ledger.md` |

This workflow is **sequential by default**. Audit processes have strong step-by-step dependencies, limiting parallelization opportunities.

**Inter-team communication flow:**
- scope completes → sends audit criteria/risk assessment to checklist, criteria/rating framework to findings
- checklist completes → sends checklist result framework to findings
- findings completes → sends findings/root causes to recommendation, finding IDs/ratings to tracking
- recommendation completes → sends recommendations/implementation plans/deadlines to tracking
- tracking integrates all information to generate the tracking ledger

### Phase 3: Comprehensive Report Generation

The orchestrator generates the final comprehensive audit report:

1. Verify all files in `_workspace/`
2. Generate comprehensive report at `_workspace/06_final_report.md`:
    - Executive summary (1 page)
    - Audit scope and methodology
    - Findings summary and detail
    - Recommendation summary
    - Implementation tracking plan
3. Cross-validation:
    - [ ] Every finding has a corresponding recommendation
    - [ ] Every recommendation has an implementation deadline and owner
    - [ ] The tracking ledger includes all findings
    - [ ] Risk ratings are consistently applied
4. Report the final summary to the user

## Execution Modes by Scope

| User Request Pattern | Execution Mode | Agents Involved |
|---------------------|----------------|-----------------|
| "Create a complete internal audit report" | **Full Pipeline** | All 5 |
| "Just create an audit checklist" | **Checklist Mode** | scope + checklist |
| "Write recommendations for these findings" | **Recommendation Mode** | findings + recommendation |
| "Just create an audit tracking ledger" | **Tracking Mode** | tracking solo |
| "Follow-up on previous audit" | **Follow-up Mode** | scope (reduced) + findings + tracking |

**Leveraging existing materials**: When the user provides existing checklists, findings, etc., copy to `_workspace/` and skip the corresponding agent.

## Data Transfer Protocol

| Strategy | Method | Usage |
|----------|--------|-------|
| File-based | `_workspace/` directory | Primary deliverable storage and sharing |
| Message-based | SendMessage | Real-time key information transfer, correction requests |
| Task-based | TaskCreate/TaskUpdate | Progress tracking, dependency management |

## Error Handling

| Error Type | Strategy |
|-----------|----------|
| Unclear audit criteria | Apply COSO framework as default, request criteria confirmation from user |
| Insufficient audit target info | Present interview question list to user, work from answers |
| No findings | Write report with "conforming" conclusion, include preventive improvement suggestions |
| Insufficient evidence | Record as provisional findings, establish additional evidence collection plan |
| Agent failure | 1 retry → proceed without that deliverable if still failing, note in report |

## Test Scenarios

### Normal Flow
**Prompt**: "Create an IT department information security internal audit report

SAFEgrade B · trust 89/100 Nothing in the source contradicts what it says it does. Grade A is reserved for packages that have also passed the behavioural sandbox.

What the source does

Filesystem

none-observed

Network

none-observed

Shell

none-observed

Dependencies

pinned

Secrets in source

none-found

Findings (0)

No findings outside the package's declared scope.

Gates applied: no_behavioural_pass.