$ ~/registry/skill/anthropics-finance-skills-audit-support

SKILL

audit-support

Name: audit-support
Author: anthropics

Support SOX 404 control testing, audit sampling, and workpaper documentation.

Stars

★ 22,528

Source

GitHub

Updated

2026-07-11

// securityLow risk

Prompt only, no code
Open source
Community-trusted· 22.5k

Running security audit…

Credentials
Network egress
Code execution
Data access
Supply chain

// install

Copy the install command and let the AI configure it · recommended for beginners

Please install the "audit-support" skill from askskill:
1. Download https://raw.githubusercontent.com/anthropics/knowledge-work-plugins/main/finance/skills/audit-support/SKILL.md
2. Save it as ~/.claude/skills/audit-support/SKILL.md
3. Reload skills and tell me it's ready

// download

Download SKILL.mdInstall manifest ↗

// examples

Generate control testing workpapers

Prompt

Based on the following SOX key control information, generate a control testing workpaper template including control objective, risk description, test steps, sample requirements, expected evidence, exception log, and conclusion fields: Control name: month-end accounts receivable reconciliation review; Frequency: monthly; Owner: finance supervisor; Control type: manual review.

Expected

A clearly structured SOX control testing workpaper template ready for audit use.

Design an audit sampling plan

Prompt

I need to perform SOX control testing on 240 procurement approval records for the year. Recommend the sample size and sampling method based on control frequency, population size, and risk level, and explain the sample selection logic and evidence list to retain.

Expected

An audit sampling plan with sample size guidance, rationale, selection method, and evidence requirements.

Assess control deficiency severity

Prompt

Based on the following situation, classify it as a control deficiency, significant deficiency, or material weakness, and explain the rationale and remediation recommendation: In 25 samples, 4 purchase requests lacked secondary approval, but none exceeded authorization thresholds and no actual financial loss was identified.

Expected

An assessment describing deficiency classification, rationale, risk impact, and remediation advice.

// docs

Audit Support

Important: This skill assists with SOX compliance workflows but does not provide audit or legal advice. All testing workpapers and assessments should be reviewed by qualified financial professionals. While "significance" and "materiality" are context-specific concepts that are ultimately assessed by auditors, this skill is intended to assist professionals in the creation and evaluation of effective internal controls and documentation for audits.

SOX 404 control testing methodology, sample selection approaches, testing documentation standards, control deficiency classification, and common control types.

SOX 404 Control Testing Methodology

Overview

SOX Section 404 requires management to assess the effectiveness of internal controls over financial reporting (ICFR). This involves:

Scoping: Identify significant accounts and relevant assertions
Risk assessment: Evaluate the risk of material misstatement for each significant account
Control identification: Document the controls that address each risk
Testing: Test the design and operating effectiveness of key controls
Evaluation: Assess whether any deficiencies exist and their severity
Reporting: Document the assessment and any material weaknesses

Scoping Significant Accounts

An account is significant if there is more than a remote likelihood that it could contain a misstatement that is material (individually or in aggregate).

Quantitative factors:

Account balance exceeds materiality threshold (typically 3-5% of a key benchmark)
Transaction volume is high, increasing the risk of error
Account is subject to significant estimates or judgment

Qualitative factors:

Account involves complex accounting (revenue recognition, derivatives, pensions)
Account is susceptible to fraud (cash, revenue, related-party transactions)
Account has had prior misstatements or audit adjustments
Account involves significant management judgment or estimates
New account or significantly changed process

Relevant Assertions by Account Type

Account Type	Key Assertions
Revenue	Occurrence, Completeness, Accuracy, Cut-off
Accounts Receivable	Existence, Valuation (allowance), Rights
Inventory	Existence, Valuation, Completeness
Fixed Assets	Existence, Valuation, Completeness, Rights
Accounts Payable	Completeness, Accuracy, Existence
Accrued Liabilities	Completeness, Valuation, Accuracy
Equity	Completeness, Accuracy, Presentation
Financial Close/Reporting	Presentation, Accuracy, Completeness

Design Effectiveness vs Operating Effectiveness

Design effectiveness: Is the control properly designed to prevent or detect a material misstatement in the relevant assertion?

Evaluated through walkthroughs (trace a transaction end-to-end through the process)
Confirm the control is placed at the right point in the process
Confirm the control addresses the identified risk
Performed at least annually, or when processes change

Operating effectiveness: Did the control actually operate as designed throughout the testing period?

Evaluated through testing (inspection, observation, re-performance, inquiry)
Requires sufficient sample sizes to support a conclusion
Must cover the full period of reliance

Sample Selection Approaches

Random Selection

When to use: Default method for transaction-level controls with large populations.

Method:

Define the population (all transactions subject to the control during the period)
Number each item in the population sequentially
Use a random number generator to select sample items
Ensure no bias in selection (all items have equal probability)

Advantages: Statistically valid, defensible, no selection bias Disadvantages: May miss high-risk items, requires complete population listing