internal controls rcm builder
Converts raw process notes into audit-ready Risk and Control Matrices (RCM) for SOX and SOC compliance.
$5
Works with the AI Agents you already use
Claude Code
Cursor
Codex CLI
Muse
Dots+21 moreClaude CodeCursorCodex CLIMuseDots
Manus
Grok
Grok Bot+18 agentsinternal controls rcm builder
Example session with this skill installed
Here are my notes for the Accounts Payable process. AP Clerks enter invoices into Oracle. The AP Manager must approve any invoice over $5,000 before payment. We use a weekly batch run.
- Read your context and instructions
- Compiled the internal controls rcm
I have processed your Accounts Payable notes into a structured Risk and Control Matrix package.
Internal Controls RCM: Accounts Payable
1. Process Overview
- Process Name: Accounts Payable Processing
- Process Objective: Ensure all vendor payments are valid, authorized, and accurately recorded.
- In-Scope Period: FY2025
- Process Owner: AP Manager
2. Actor & System Inventory
| Actor Role | Access Level | System(s) Used | Key Activities |
|---|---|---|---|
| AP Clerk | Create/Edit | Oracle | Invoice entry and data maintenance |
| AP Manager | Review/Approve | Oracle | Approval of high-value disbursements |
3. Risk & Control Matrix
| # | Risk Statement | Control ID | Control Activity | Control Type | Frequency | Performed By | Evidence |
|---|---|---|---|---|---|---|---|
| R1 | Unauthorized or fraudulent payments may be issued for amounts over $5,000. | C1 | Invoices >$5,000 require AP Manager approval in Oracle prior to inclusion in the payment run. | Preventive | Weekly | AP Manager | Oracle Approval Report |
| R2 | Inaccurate invoice entry could lead to financial statement misstatement. | C2 | UNKNOWN | Detective | UNKNOWN | UNKNOWN | UNKNOWN |
4. Walkthrough & Testing Prompts
Walkthrough Script: Select one invoice over $5,000 from the last 30 days. Trace from entry in Oracle to the AP Manager's digital signature. Verify the timestamp precedes the payment batch execution.
| Test Goal | Testing Procedure | Sample Size | Evidence Required | Pass Criteria |
|---|---|---|---|---|
| Verify C1 Approval | Inspect 25 invoices >$5,000 for system-generated approval metadata. | 25 | Oracle Audit Trail / Workflow Log | 100% Approval rate |
5. Control Design Gap Flag
- Gap 1: No control identified for invoice entry accuracy (R2).
- Gap 2: Evidence format for manual entry validation is not defined.
- Gap 3: Frequency for R2 monitoring is UNKNOWN.
6. Validation Report
- Traceability: PARTIAL (R2 is currently uncontrolled).
- Consistency: PASS (Actors and systems match inventory).
- Testability: PASS for C1; FAIL for C2 (Missing attributes).
Next steps
- Define the control activity for accurate invoice entry (R2).
- Confirm if the Oracle system performs an automated three-way match.
- Provide the specific role responsible for reconciling the weekly batch run.
Connects securely to your tools. The creator never sees your data.
About this skill
The problem
Process narratives are often messy, incomplete, and lack the structure required for formal audits. Turning raw notes into a Risk and Control Matrix (RCM) manually is error-prone, leading to testing failures and compliance gaps.
What it does
- Transforms raw process notes into a structured RCM with mapped objectives and dependencies.
- Generates a comprehensive Actor & System Inventory to define access levels and key activities.
- Develops detailed Audit Walkthrough Scripts and Testing Procedures with evidence requirements.
- Identifies Control Design Gaps such as missing frequencies, undefined owners, or uncontrolled risks.
- Validates traceability and testability to ensure every risk has a corresponding verifiable control.
Why this beats prompting it yourself
This skill enforces strict internal audit standards for SOX and SOC compliance that generic prompts miss. It ensures structural integrity by cross-referencing actors, systems, and dependencies while automatically flagging design gaps that would cause an audit finding.
Use cases
- Building RCMs for SOX or SOC 2 compliance readiness.
- Translating business process interviews into technical audit documentation.
- Performing gap analysis on existing internal controls before a formal assessment.
- Generating standardized testing plans and evidence requests for internal audit teams.
Known limitations
Requires specific process narratives or bullet points to function. It will mark missing data as UNKNOWN rather than inventing details.
Requires input process narratives or notes. Will not hallucinate missing data, marking gaps as UNKNOWN instead. Logic is based on provided business context, not external real-time regulatory feeds.
How to use
- 1
Connect your agent to the Agensi MCP
Copy the prompt and paste it into Claude, ChatGPT, Cursor or any agent that supports MCP. It sets up the connection for you. Manual setup
- 2
Sign in to Agensi
Your agent shows a sign-in link. Sign in and click Allow.
- 3
Ask for what you need
Your agent loads this skill and uses it on your task. It always asks before any payment.
Reviews
No reviews yet
Be one of the first to try it. Every listed skill goes through the trust checks below.
Security scanned
Checked by our 8-point scan before listing
Fresh listing
Recently published to Agensi
Money-back guarantee
Doesn't do what its page promises? You get your money back.
Trust & safety
Security scan
Security scan passed 2 months ago
Permissions
No special permissions declared or detected