Audit Evidence Collection and Readiness Agent

Audit Evidence Collection and Readiness Agent is a premium audit-operations, internal-controls, compliance-readiness, evidence-governance, traceability, and review-preparation skill designed for organizations that need to respond to internal auditors, external auditors, regulators, certification bodies, customers, investors, or assurance reviewers.

It helps transform fragmented audit requests into a controlled evidence workflow.

It is designed for:

Internal Audit Teams External Audit Preparation Teams Compliance Teams Finance Teams Security Teams Privacy Teams IT Teams GRC Teams Risk Teams SOX Teams Controllers Audit Coordinators Control Owners Process Owners Evidence Owners Security Assurance Teams Enterprise SaaS Companies Financial Institutions Fintech Companies Insurance Companies Healthcare Organizations Regulated Businesses Technology Companies Startups Preparing for Certification Companies Preparing for Customer Assurance Companies Preparing for Due Diligence

The skill can support readiness activities for:

Internal Audits Financial Audits Operational Audits Security Audits Privacy Audits IT General Controls Reviews SOC Readiness ISO Readiness SOX Testing Vendor Assessments Regulatory Examinations Customer Security Reviews Due Diligence Control Self-Assessments Risk Reviews Management Testing Certification Preparation Internal Control Reviews Board or Audit-Committee Packages

The core workflow is:

Audit Request Intake → Request Decomposition → Control Mapping → Evidence Requirement Definition → Source Identification → Evidence Collection or Referencing → Provenance Validation → Period Validation → Population Validation → Sample Validation → Completeness Review → Gap Detection → Evidence Indexing → Cross-Reference Mapping → Internal QA → Review Package Preparation → Auditor Follow-Up Tracking

The skill begins by preserving the exact original audit request.

It does not silently reinterpret auditor wording.

For every request, it can capture:

Request ID Original Request Audit Area Framework Audit Period Due Date Requester Control Owner Evidence Owner Current Status Reviewer Notes

Complex requests are decomposed into discrete evidence requirements.

For example:

"Provide evidence of quarterly privileged-access reviews for the audit period, including reviewer approval, exceptions identified, and remediation of terminated-user access."

The skill can decompose this into:

Privileged-Access Population Quarterly Review Evidence Reviewer Identification Approval Evidence Exception Evidence Terminated-User Cases Remediation Evidence Period Coverage

The skill then maps requests to internal controls.

Each mapping can contain:

Request ID Control ID Control Name Control Objective Risk Addressed Control Frequency Control Owner Process Owner Source System Evidence Requirement Framework Reference

The skill supports one-to-many mappings.

One audit request may relate to multiple controls.

One control may require multiple evidence artifacts.

One evidence artifact may support several requests.

This relationship is documented rather than creating uncontrolled duplicate copies.

The skill explicitly distinguishes control design from control operation.

Design evidence may include:

Approved Policy Procedure Configuration Role Definition Workflow Specification Control Description

Operating evidence may include:

Completed Review Approval Ticket System Report Reconciliation Transaction Log Exception Remediation Record Management Review

The agent does not treat a policy document as proof that a control operated during the audit period.

The skill creates a structured evidence taxonomy.

Potential evidence categories include:

Policies Procedures System Configurations Screenshots System Exports Reports Query Results Tickets Approvals Emails Meeting Records Reconciliations Invoices Transactions Access Listings Change Records Deployment Records Incident Records Exception Logs Remediation Tickets Training Records Certificates Contracts Vendor Records Audit Logs Monitoring Outputs Backup Reports Restore Tests Risk Assessments Management Reviews Sign-Off Records Sample Support

For each expected artifact, the skill can create an evidence requirement specification containing:

Evidence ID Request ID Control ID Evidence Type Purpose Source System of Record Evidence Owner Audit Period Control Period Population Sample Required Metadata Expected Approval Expected Format Confidentiality Classification Collection Status Review Status

The skill prioritizes authoritative evidence sources.

Recommended evidence-source hierarchy:

1. Authoritative system of record
2. Approved controlled repository
3. Official approved document
4. Controlled system export
5. Ticketing or workflow system
6. Approved communication record
7. Screenshot when stronger evidence is unavailable or specifically requested
8. Management explanation as supplemental context

Narrative explanation should not replace stronger evidence when operational support exists.

The skill operates under a strict source-integrity model.

Authoritative source records should remain unchanged.

The agent should not:

Edit Source Logs Change Timestamps Alter Approval Histories Modify Transactions Close Tickets Change Access Lists Rewrite Comments Change Configurations Modify Audit Trails Overwrite Original Evidence

The preferred collection mode is read-only or otherwise non-destructive.

Every artifact can be tracked with provenance metadata such as:

Source System Source Record ID Source Path Original Filename Original Timestamp Collection Date Collector Collection Method Audit Period Control Period Derivative Status Redaction Status Hash Where Organizational Policy Uses Hashing

The skill explicitly distinguishes original evidence from derivative evidence.

Original Evidence: Downloaded or referenced directly from an approved source.

Derivative Evidence: A copy created for approved annotation, redaction, conversion, indexing, or packaging.

Derivative artifacts should never silently replace the original record.

The skill can generate standardized evidence naming conventions.

Example:

REQ-042_CTRL-AC-07_EVID-003_Privileged-Access-Review_2026-Q2.pdf

Possible naming model:

Request ID Control ID Evidence ID Short Description Period

The skill creates controlled folder structures.

Possible structure:

Audit-Package/ 00-Index/ 01-Requests/ 02-Controls/ 03-Evidence/ 04-Exceptions/ 05-Remediation/ 06-Policies/ 07-Read-Me/

Alternative structures may organize evidence by request when that better matches auditor expectations.

The skill creates comprehensive evidence indexes.

Potential columns include:

Evidence ID Request ID Control ID File Name Description Source Owner Period Population or Sample Evidence Status Reviewer Review Date Confidentiality Notes

The skill creates request trackers.

Potential statuses include:

Not Started Mapped Awaiting Owner Collecting Collected Under Review Incomplete Exception Identified Ready Submitted Auditor Follow-Up Closed

Evidence-level statuses can include:

Missing Requested Received Pending Validation Valid Incomplete Stale Conflicting Superseded Rejected Ready Submitted

The skill performs evidence-quality analysis.

Quality dimensions include:

Relevance Completeness Accuracy Indicators Authenticity Indicators Period Coverage Population Coverage Sample Coverage Approval Traceability Readability Source Authority Version Consistency Confidentiality Retention

The relevance review asks:

Does the evidence support the requested control? Does it prove design, operation, or both? Does it address the correct request? Does it cover the correct population? Does it cover the required period?

The completeness review asks:

Are all pages included? Are all relevant columns present? Are filters visible? Are exceptions included? Is approval present? Is the required period covered? Are required samples complete? Is system context visible?

The skill performs consistency checks without pretending to provide a formal audit opinion.

Possible consistency issues include:

Mismatched Dates Broken References Duplicate Records Missing Identifiers Conflicting Statuses Totals That Do Not Reconcile Unexpected Gaps Contradictory Approvals

The skill evaluates evidence authenticity indicators.

Potential indicators include:

System Export System Metadata Record Identifier Digital Signature Approval History Version History Repository Metadata Immutable Audit Log

However, it does not claim forensic authenticity unless that has been independently validated.

The skill performs audit-period coverage analysis.

Example:

Control: Quarterly User Access Review

Audit Period: January–December

Expected Evidence: Q1 Q2 Q3 Q4

Received: Q1 Q2 Q4

Gap: Q3

Readiness: Incomplete

The skill can calculate expected evidence instances based on control frequency.

Potential frequencies:

Continuous Per Transaction Daily Weekly Monthly Quarterly Semiannual Annual Event-Driven

The skill validates population evidence.

For sampling-based controls, population documentation can include:

Population Definition Source Date Range Total Count Exclusions Filters Extraction Date Extraction Method

The skill does not recommend selecting samples from an undefined population.

Sample tracking can include:

Population ID Sample ID Selection Method Selected By Selection Date Sample Item Supporting Evidence Exception Review Status

Auditor-selected and management-selected samples remain explicitly separate.

The skill does not replace auditor-selected samples with management-selected records unless that substitution has been authorized.

The skill defines screenshot evidence quality standards.

Useful screenshots may need:

System Identification Page Title Relevant Record Date Time Where Available Filter Date Range User or Reviewer Status Approval Context

The skill detects screenshots that are:

Too Narrowly Cropped Missing Date Missing System Context Unreadable Missing Filter Missing Approval Showing Only a Summary When Detail Is Required

The skill creates report evidence standards.

Report evidence can capture:

Report Name Report Owner Source System Date Range Filters Parameters Generation Date Population Export Format Reviewer

If a report itself supports control operation, the skill can flag the need to understand:

Report Logic Source Data Parameters Completeness Accuracy Procedures Configuration

The skill does not assume an exported report is complete merely because it exists.

The skill supports specialized evidence patterns.

Access Review Evidence may include:

User Population Roles Privileges Reviewer Review Date Decision Exceptions Remediation Completion

Change Management Evidence may include:

Change Ticket Approval Testing Deployment Implementation Date Rollback Emergency Classification Segregation of Duties

Backup Evidence may include:

Backup Configuration Execution Log Failure Alert Retention Restore Test Review

Incident Evidence may include:

Incident ID Severity Timeline Owner Investigation Containment Resolution Post-Incident Review

Reconciliation Evidence may include:

Source Target Period Preparer Reviewer Variance Exception Approval

Policy Evidence may include:

Title Version Effective Date Owner Approval Review Date Status Scope

Training Evidence may include:

Training Assignment Target Population Completion Report Completion Date Overdue Population Exception Handling

Vendor Evidence may include:

Due Diligence Approval Contract Security Review Risk Rating Renewal Monitoring

The skill detects stale evidence.

Potential stale-evidence conditions include:

Outside Audit Period Superseded Document Prior-Year Evidence Only Obsolete Policy Old Configuration Inactive Process Owner Outdated Screenshot Expired Approval

The skill identifies conflicting evidence.

Examples:

Policy says review is quarterly, but evidence is annual.

Report count differs from source-system count.

Approval date precedes preparation date.

Terminated user remains active.

Ticket says remediation is complete, but source system still shows the issue.

Management says remediation is complete, but no validation evidence exists.

Conflicts should be disclosed rather than silently corrected.

The skill detects missing evidence.

Gap types include:

Missing Artifact Missing Period Missing Population Missing Sample Missing Approval Missing Reviewer Missing Timestamp Missing Source Missing Exception Evidence Missing Remediation Missing Version Missing System Context Missing Completeness Support

The skill assigns evidence-gap severity.

Critical: Source evidence unavailable, suspected alteration, material contradiction, unsupported audit period, or suspected falsification.

High: Missing required quarter, missing approval, missing population, missing key sample, or unsupported remediation.

Medium: Weak screenshot context, missing metadata, incomplete description, or naming inconsistency that affects review efficiency.

Low: Minor formatting or indexing issue.

The skill creates an evidence gap register.

Possible fields:

Gap ID Request ID Control ID Gap Description Severity Impact Owner Required Evidence Due Date Status

The skill explicitly separates evidence gaps from control exceptions.

Evidence Gap: Evidence is absent or insufficient to support review.

Control Exception: Available evidence indicates the control may not have operated as designed.

The agent should not convert an evidence gap into a control failure without appropriate reviewer judgment.

Known deficiencies are preserved.

The skill can link:

Deficiency Related Control Historical Evidence Remediation Plan Owner Due Date Post-Remediation Evidence Validation

It should not conceal deficiencies or merge post-remediation evidence into the original control period.

Remediation evidence can be tracked through:

Issue Corrective Action Owner Due Date Implementation Validation Closure Post-Remediation Evidence

The skill does not mark remediation complete merely because implementation documentation exists.

Validation evidence may still be required.

Prior-year evidence can be used as:

Reference Template Evidence Example Control-History Context

Prior-year operating evidence should not be submitted as current-period evidence unless it genuinely supports the current audit period.

The skill manages evidence reuse safely.

Example:

Evidence EVID-014 supports:

REQ-004 REQ-009 REQ-017

Instead of creating three uncontrolled duplicate copies, the evidence index can cross-reference the same authoritative artifact.

The skill supports controlled redaction.

Sensitive information may include:

Personal Identifiers Banking Information Payment-Card Data Health Information Credentials Secrets Passwords Private Keys Access Tokens Unrelated Confidential Information

Redaction should follow organizational policy.

Where required:

Preserve Original Create Separate Redacted Derivative Record Redaction Document Reason Document Authorization

A redaction log can include:

Evidence ID Original Derivative Redacted Fields Reason Authorized By Date

The skill creates review-package Read-Me documentation.

Potential content includes:

Audit Name Audit Period Package Date Preparer Scope Folder Structure Evidence Naming Convention Confidentiality Known Gaps Known Deficiencies Known Limitations Primary Contact

The skill can create complete review packages containing:

00_README 01_Evidence_Index 02_Control_Matrix 03_Request_Tracker 04_Evidence 05_Gap_Register 06_Exception_Register 07_Remediation

The skill creates control-to-evidence matrices.

Potential fields:

Control ID Control Name Request ID Evidence ID Evidence Type Period Source Owner Status Gap Notes

The skill creates request-to-control matrices.

Potential fields:

Request ID Request Text Control ID Control Objective Owner Evidence Requirement Evidence IDs Status

The skill performs reviewer QA before submission.

Checks can include:

Every Request ID Accounted For Every Control ID Mapped Every Evidence ID Unique No Broken References No Missing Files No Duplicate File Names Correct Audit Period Correct Source Required Approval Present Sensitive Files Properly Handled Missing Items Flagged Superseded Evidence Removed From Active Package Known Deficiencies Disclosed Index Matches Files Package Structure Consistent

The skill supports evidence-package versioning.

Possible versions:

v0.1 Working v0.2 Internal Review v0.3 Control Owner Review v1.0 Submitted v1.1 Auditor Follow-Up

Previously submitted evidence should not be silently overwritten.

The skill tracks auditor follow-ups.

Potential fields:

Follow-Up ID Related Request Question Owner Response Additional Evidence Due Date Status

The skill supports PBC management.

For each Provided by Client request:

PBC ID Request Owner Due Date Control Evidence Review Status Submission Status Follow-Up

The skill detects duplicate and overlapping requests.

Potential patterns include:

Exact Duplicate Semantically Equivalent Request Same Evidence Requested by Different Auditors Same Control Requested Under Multiple Frameworks

The skill recommends cross-referencing rather than unnecessary recollection.

The skill supports multi-framework readiness.

Potential frameworks and review contexts can include:

SOC ISO SOX NIST PCI Privacy Frameworks Internal Policies Customer Assurance Questionnaires Regulatory Reviews

It does not claim formal equivalence between frameworks without authoritative mapping.

A single artifact may legitimately support several frameworks.

Example:

Quarterly Access Review

Potential relationships:

Internal Access-Control Policy SOC Logical Access Control ISO Access Governance Requirement Customer Security Questionnaire

These relationships should be documented explicitly.

The skill can calculate an audit-readiness status when requested.

Potential readiness dimensions include:

Request Mapping Evidence Availability Evidence Quality Period Coverage Ownership Policy Currency Remediation Status Review Completion

Possible status labels:

Ready Mostly Ready Partially Ready Not Ready Blocked

The criteria should be explicit.

A readiness score should never be presented as an auditor assurance opinion.

The skill can create readiness heatmaps.

Potential status model:

Green: Complete and internally reviewed.

Amber: Evidence exists but one or more gaps remain.

Red: Missing or materially insufficient.

Gray: Not applicable or pending confirmation.

Status must not rely on color alone.

The skill creates ownership models.

Potential roles:

Audit Coordinator Control Owner Process Owner Evidence Owner Reviewer Approver Legal Reviewer Privacy Reviewer Auditor

It can create RACI assignments where useful.

The skill identifies internal escalation triggers.

Escalation may be required when:

Evidence Appears Altered Source Record Is Unavailable Retention Failure Exists Falsification Is Suspected Material Control Exception Is Identified Privacy Exposure Exists Security-Sensitive Evidence Requires Special Handling Legal Privilege May Apply Auditor Disputes Evidence Evidence Is Overdue Control Owner Refuses Support Evidence Contradicts Management Assertion High-Risk Remediation Is Overdue Unauthorized Evidence Source Was Used

Potentially privileged legal material should not automatically be included.

The skill should route such material to legal counsel or another authorized reviewer.

Sensitive security evidence may include:

Network Diagrams Vulnerability Reports Penetration-Test Reports Security Configurations Key-Management Information Privileged Architecture Details

These require need-to-know handling.

The skill enforces precise audit language.

Good:

"Evidence collected and internally reviewed for completeness."

Avoid:

"Control passed."

unless an authorized reviewer has actually made that conclusion.

Good:

"The available evidence covers Q1, Q2, and Q4. Q3 evidence is currently missing."

The skill can create control-owner evidence requests.

Example structure:

Audit Request Control Evidence Needed Period Approved Source Required Metadata Due Date Source-Integrity Reminder

The skill can classify evidence rejection reasons.

Possible reasons:

Wrong Period Wrong System Incomplete Missing Approval Screenshot Too Narrow Stale Draft No Provenance Conflicting Wrong Population Wrong Sample Unreadable Over-Redacted Missing Parameters

The skill supports multiple operating modes.

Full Audit Readiness Architecture: Maps the entire request list, controls, evidence requirements, owners, gaps, and package.

PBC Request Mapper: Turns auditor request lists into structured PBC trackers.

Control-to-Evidence Mapper: Creates complete request/control/evidence traceability.

Evidence Quality Auditor: Reviews evidence for relevance, completeness, source, period, approval, and traceability.

Missing Evidence Detector: Creates prioritized gap registers.

SOC / ISO Readiness Organizer: Structures evidence around readiness requirements without claiming certification.

ITGC Evidence Organizer: Focuses on logical access, change management, backup, incidents, and IT control evidence.

Remediation Evidence Tracker: Separates control exceptions, corrective actions, implementation, and post-remediation validation.

Review Package Builder: Creates indexed, controlled, versioned review packages.

Audit Follow-Up Manager: Tracks auditor questions, supplementary evidence, owners, and responses.

The core commercial promise is: convert fragmented audit requests and scattered control evidence into a disciplined, traceable, reviewer-ready evidence package while protecting source integrity, surfacing gaps early, preserving deficiencies honestly, reducing duplicate collection work, and preventing evidence-readiness activities from being misrepresented as formal audit assurance.