audit-program

Plans internal audit engagements by generating audit notifications, RCM matrices, and detailed audit programs.

Updated Jul 2, 2026
One-click install
npx skills add https://github.com/tuanpa-nhg-eng/nhg-ipms --skill audit-program-tuanpa-nhg-eng
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: audit-program
Source: https://github.com/tuanpa-nhg-eng/nhg-ipms/tree/main/.claude/skills/audit-program
Command: npx skills add https://github.com/tuanpa-nhg-eng/nhg-ipms --skill audit-program-tuanpa-nhg-eng

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Starting a new internal audit engagement requires producing multiple structured planning documents—audit notifications, scope assessments, Risk-Control Matrices (RCM), and detailed audit programs—which is time-consuming and error-prone when done manually. ## Core Features & Use Cases - Audit Notification Drafting: Generates the engagement announcement with scope, timeline, team composition, and a numbered PBC (Provided By Client) document request list. - Risk-Control Matrix (RCM): Builds an RCM following the logic of process objectives → risks → existing controls → gaps, scoring risks on a 5×5 likelihood-impact scale and flagging uncontrolled risks. - Audit Program Generation: Produces a procedure table with workpaper references, test types (ToD/ToE/substantive), sample sizes, and an approval block requiring sign-off before fieldwork. - Use Case: An internal auditor starting a procurement process audit uses this Skill to create the engagement folder structure, draft the notification letter, build the RCM, and produce a risk-traceable audit program ready for the audit manager's approval. ## Quick Start Ask the assistant to plan a new internal audit engagement for a specific process, including the audit notification, RCM, and detailed audit program.

Frequently Asked Questions about audit-program

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I create an audit program for a new internal audit engagement?

Start by drafting the audit notification with scope and PBC list, then research the audited process, build a Risk-Control Matrix scoring risks on a 5x5 scale, and finally write the audit program with procedures traceable to identified risks. The program requires approval before fieldwork.

What is a Risk-Control Matrix (RCM) in internal audit?

An RCM maps process objectives to risks (what can go wrong), existing controls, and control gaps. Each risk is scored by likelihood times impact, and risks without controls are flagged as potential 'missing control' findings.

Which risks should be included in audit testing?

Only risks scoring 8 or higher (High/Very High) on the 5x5 scale should be included in testing, unless available man-days allow broader coverage. Every test procedure must trace back to at least one RCM risk.

How far in advance should an audit notification be sent?

The audit notification should be sent at least 5 working days before fieldwork begins. Surprise audits are exempt but require separate documented approval.

What conflict-of-interest rules apply to audit team members?

Team members must be checked against the 3-year rule in Vietnamese Decree 05/2019 Article 6, which restricts auditing areas where a member previously worked. The confirmation must be recorded in the scope and resources document.