audit evidence request pack builder

The problem

Audit planning often results in "data dumping" where teams collect massive amounts of redundant or irrelevant files. This creates bottlenecks, increases security risks for sensitive data, and leaves auditors with gaps in traceability between requirements and evidence.

What it does

• Decomposes high-level audit scopes into discrete, testable audit requirements mapped to specific evidence types.
• Applies a 3R filter (Relevant, Required, Right-sized) to minimize unnecessary data collection and document exclusion rationales.
• Generates structured PBC (Provided by Client) request packs with specific IDs, owners, time periods, and handling instructions.
• Builds a master tracker with automated escalation paths based on due-date thresholds.
• Performs post-collection validation to ensure coverage, traceability, and audit usability before submission.

Why this beats prompting it yourself

General prompts often miss the nuances of audit defensibility, such as period-specific evidence or data classification handling. This skill enforces a rigorous mapping architecture that prevents "orphan evidence" and ensures every file requested is tied to a specific control requirement, saving hours of manual reconciliation.

Use cases

• Preparing for SOC2 or ISO 27001 external audits to ensure no gaps in control evidence.
• Structuring internal audit workflows for new systems or departments.
• Developing evidence-collection playbooks for regulatory compliance reviews.

Known limitations

Does not provide legal advice on data privacy regulations. Requires a defined audit scope or list of objectives to begin decomposition.