Compliance and Internal Control Audit Assistant

Problem Context

Compliance audits often stall on unstructured materials: contracts, procurement files, data cooperation notes, and delivery/payment clauses are scattered across documents and emails, making it hard to map each obligation to a rule, grade risk, and produce working papers. The result is missed audit points, vague remediation ownership, weak traceability of citations, and difficulty explaining the rationale during review.

How It Works

The skill turns text into auditable structured output:
- Obligation identification: extracts core duties such as qualifications, payment, breach, data handling, and delivery.
- Regulatory mapping: aligns clauses with the built-in compliance_scope regulatory baseline, citing article numbers and key text.
- Risk assessment: grades clauses as 🔴 prohibitive, 🟡 restrictive, or 🟢 advisory, highlighting high-risk deviations.
- Working papers and report: generates deviation notes, clarification scripts, remediation responsibility matrices, and outputs a Markdown audit report.

Boundaries

Use it for contract review, procurement compliance checks, data cooperation audits, and internal-control working paper preparation, especially when clauses must be repeatedly checked, responsibility matrices built, and evidence chains reviewed. It depends on input quality; laws not covered by the baseline need public legal text supplements, and outputs are audit support, not legal advice or regulatory determination.