More screenshots

    Works with the AI Agents you already use

    Claude CodeClaude CodeCursorCursorCodex CLICodex CLIDeepSeekDeepSeekMuseMuse+22 more

    SOC2 Control Gap And Evidence Auditor

    1

    Identify SOC 2 control gaps and evaluate evidence strength to ensure audit readiness and Type 2 period coverage.

    $20

    Secure checkout via Stripe

    Money-back guarantee

    Converts to your local currency at checkout

    Security scanned
    SOC2 Control Gap And Evidence Auditor

    SOC2 Control Gap And Evidence Auditor

    Example session with this skill installed

    Audit our logical access controls. We have a policy for quarterly reviews, but the last review was 5 months ago and we only have a PDF list of users with no approval signature. Type 2 audit.

    • Read your context and instructions
    • Compiled the soc2 control gap

    The assessment of the logical access control domain reveals a CRITICAL gap for Type 2 readiness. While a policy exists, the evidence provided is stale and lacks the necessary attributes to prove the control operated effectively during the examination period.

    SOC 2 Readiness Audit: Logical Access

    ControlTSCRiskDesignEvidencePeriodSeverityGapRemediation
    CC6.1CC6.1Unauthorized AccessMEDIUM1 (Weak)STALECRITICALNo proof of review or approval.Perform a fresh review today.
    CC6.3CC6.3Stale AccountsLOW0 (None)N/AHIGHNo evidence of offboarding.Provide 3 months of tickets.

    Evidence Quality Breakdown

    • Artifact: PDF User List
    • Strength Score: 1/5 (Assertion Only)
    • Freshness: STALE (5 months old for a quarterly control)
    • Traceability: NONE (No link between the list and an authorized reviewer's action)

    Auditor Follow-Up Questions

    1. "How do you ensure the user list exported for review is complete and accurate (IPE)?"
    2. "Can you provide the specific ticket or signature that authorized the retention of the administrative accounts on this list?"
    3. "The policy dictates quarterly reviews; why is there a five-month gap in the evidence provided for this period?"

    Next steps

    1. Conduct an immediate access review of all production systems and capture the timestamped approval.
    2. Document the "Completeness and Accuracy" (C&A) procedure for how the user list is exported from your IdP.
    3. Identify the population of departed employees for the last 90 days to test the offboarding control.

    Connects securely to your tools. The creator never sees your data.

    About this skill

    Preparation for a SOC 2 audit often fails because teams confuse policies with evidence or provide out-of-period artifacts. This skill audits your control matrix, evidence inventory, and policies to identify exactly where you will fail an examination before the auditor arrives.

    What it does

    • Gap Analysis identifies missing controls, weak designs, and misalignments with AICPA Trust Services Criteria (TSC).
    • Evidence Scoring rates artifacts from 0 to 5 based on relevance, completeness, and audit-readiness.
    • Freshness Verification flags evidence that is stale, undated, or falls outside the examination period.
    • Readiness Scoring calculates a weighted readiness percentage based on design, strength, and traceability.
    • Remediation Planning generates a prioritized action list for 7, 30, and 60-day windows.
    • Auditor Simulation predicts the specific follow-up questions an external CPA will ask based on your current gaps.

    How it works

    1. Provide your control matrix, system scope, and examination type (Type 1 or Type 2).
    2. Upload or describe policies, evidence screenshots, tickets, and report exports.
    3. The skill maps every artifact to a specific control and evaluates its strength and period coverage.
    4. Review the generated Control Gap Matrix and Evidence Coverage Matrix for specific failures.

    Frameworks & tools

    This skill aligns with the AICPA 2017 Trust Services Criteria and 2022 points of focus. It analyzes artifacts from common stacks including AWS/Azure/GCP, GitHub/GitLab, Jira, and identity providers.

    Why this beats prompting it yourself

    Generic prompts often accept a policy as proof of a control. This skill applies a professional skepticism model, specifically checking for population completeness, IPE (Information Produced by the Entity) accuracy, and Type 2 operating consistency that standard prompts miss.

    Use cases

    • Pre-Audit Readiness to find blockers before hiring a CPA firm.
    • Type 2 Preparation to ensure evidence covers the full six or twelve-month look-back period.
    • Evidence Quality Review to verify that screenshots and exports meet "audit-ready" standards.
    • Acquisition Due Diligence to quickly assess the security posture of a target company.

    Known limitations

    Does not provide a legal opinion or an official SOC 2 Type 1 or Type 2 report. Quality depends on the level of detail provided for evidence artifacts.

    Find more skills like this on the Claude Skills Marketplace, the Codex Skills Marketplace and the Gemini Skills Marketplace, or browse Claude Skills for Legal & Compliance.

    Requires clear scope definition to be effective. Cannot verify the physical authenticity of screenshots or system exports. Not a substitute for a licensed CPA firm.

    How to use

    1. 1

      Connect your agent to the Agensi MCP

      Copy the prompt and paste it into Claude, ChatGPT, Cursor or any agent that supports MCP. It sets up the connection for you. Manual setup

    2. 2

      Sign in to Agensi

      Your agent shows a sign-in link. Sign in and click Allow.

    3. 3

      Ask for what you need

      Your agent loads this skill and uses it on your task. It always asks before buying a skill.

    Reviews

    No reviews yet

    Be one of the first to try it. Every listed skill goes through the trust checks below.

    Security scanned

    Checked by our 8-point scan before listing

    Fresh listing

    Recently published to Agensi

    Money-back guarantee

    Doesn't do what its page promises? You get your money back.

    Trust & safety

    Security scan

    Security scan passed 1 month ago

    Permissions

    No special permissions declared or detected

    Listed1 month ago

    What's inside

    Frequently Asked Questions

    This skill identifies missing controls, evaluates the strength of uploaded evidence on a 0-5 scale, and flags artifacts that fall outside your specific Type 2 examination window. Unlike generic AI, it applies 'professional skepticism' to ensure policies aren't mistaken for actual proof of operation.

    You will receive the core auditor logic, pre-configured templates for evidence scoring, and a prioritized remediation roadmap generator. It also includes an 'Auditor Simulator' that predicts specific follow-up questions a CPA firm is likely to ask based on your documentation.

    The skill is optimized for all major AI agents supporting file uploads and long-context processing. It is pre-mapped to the 2017 AICPA Trust Services Criteria (TSC) and integrates with artifacts exported from AWS, Azure, GCP, Jira, and GitHub.

    No complex setup is required; simply provide your control matrix and examination type (Type 1 or Type 2) to begin. The skill will then prompt you for specific evidence categories or policy documents to start the gap analysis.

    Yes, the skill is updated to reflect the 2022 Points of Focus and current AICPA guidance. Owners receive free access to logic updates if there are significant changes to the Trust Services Criteria or common auditor expectations.

    While the skill predicts audit readiness and identifies gaps with high precision, it does not provide a legal opinion or a signed SOC 2 report. It is a preparation and quality-assurance tool designed to be used before hiring an external CPA firm.

    New in Legal & Compliance