Purpose
Evaluate whether the controls attached to a business process risk are adequately designed and operating effectively, then produce a structured assessment that rates control effectiveness and prioritizes remediation. Replaces subjective "we have a control for that" reasoning with a defensible COSO/SOX-based evaluation an audit committee can rely on.
When to Use
Invoke this skill when the user asks to:
- Assess whether controls adequately mitigate a specific process risk
- Evaluate control design adequacy or operating effectiveness
- Prepare a control matrix or RCM entry for a SOX or internal audit
- Identify control gaps, over-reliance on detective or manual controls, or single points of failure
- Rate the residual risk after controls for a given process
- Build a control remediation plan with prioritized actions
Inputs Required
Before starting, collect:
- Process and risk statement: The business process and the specific risk being controlled (e.g., "Procure-to-pay: duplicate or fraudulent vendor payments")
- Risk rating: Inherent likelihood and impact, or an overall inherent risk level (High/Medium/Low)
- Controls in place: Description of each control — what it does, who performs it, and how often
- Control frequency/timing: How often each control operates (transactional, daily, monthly, quarterly, ad hoc)
- Automation status: Whether each control is manual, IT-dependent manual, or fully automated (if known)
- Evidence available: What documentation or testing supports that the control operates (sign-offs, system logs, reconciliations)
- Regulatory context: SOX in-scope, other framework requirements, or none
If automation status or evidence is not provided, evaluate design adequacy and flag operating effectiveness as "unable to conclude — testing required."
Instructions
Step 1: Restate the Risk and Confirm Inherent Risk
State the process, the risk event, and its inherent risk level (likelihood × impact) before controls. This anchors the entire evaluation — a control set is only "effective" relative to the inherent risk it must reduce. If inherent risk is High, the control set must be strong enough to justify a meaningful residual reduction.
Step 2: Classify Each Control
For every control provided, assign four attributes:
- Type: Preventive (stops the error/fraud before it occurs — e.g., segregation of duties, authorization limits, system edit checks) vs. Detective (identifies an issue after it occurs — e.g., reconciliations, exception reports, reviews)
- Nature: Manual, IT-dependent manual (relies on a system-generated report a person reviews), or Automated (system-enforced with no human step)
- Frequency: Transactional / Daily / Weekly / Monthly / Quarterly / Annual / Ad hoc
- Key vs. non-key: Is this a key control the risk mitigation depends on, or a secondary/compensating control?
Present this as a control classification table.
Step 3: Evaluate Design Adequacy
For each key control, assess whether it is designed to prevent or detect the risk on a timely basis. Apply these design tests:
- Coverage: Does the control address the actual risk, or an adjacent one?
- Precision: For detective controls, is the review precise enough to catch the error (right threshold, right population), or is it a rubber-stamp?
- Timeliness: Does the control operate frequently enough that a failure would be caught before material damage?
- Authority/competence: Does the control performer have the authority and information to act?
Flag design deficiencies explicitly (a control that exists but is not designed to catch the risk is a design gap).
Step 4: Evaluate Operating Effectiveness
Where evidence is provided, assess whether the control actually operated as designed:
- Is there evidence the control ran every time it should have (population completeness)?
- Is the evidence sufficient (sign-off with review notes vs. an initial with no work shown)?
- Are there known exceptions or overrides, and how were they resolved? Where no evidence exists, conclude "operating effectiveness cannot be concluded — testing required" rather than assuming effectiveness.
Step 5: Identify Control Gaps and Structural Weaknesses
Scan the full control set for the common failure patterns:
- Over-reliance on detective controls with no preventive control (errors get caught but always after the fact)
- Over-reliance on manual controls where automation is feasible (human error, no completeness assurance)
- Single point of failure (one person, one control, no compensating control if it fails)
- Segregation of duties conflicts (same person initiates and approves, or has both custody and recording)
- Frequency mismatch (quarterly detective control against a high-volume transactional risk)
- No compensating control for a known design gap
Step 6: Rate Overall Control Effectiveness and Residual Risk
Assign an overall rating using this scale:
- Effective: Key controls are well-designed and (where tested) operating; residual risk is acceptably below inherent risk
- Partially Effective: Controls reduce risk but material gaps or weaknesses remain; residual risk still elevated
- Ineffective: Design gaps or operating failures leave the risk substantially unmitigated
- Unable to Conclude: Design appears adequate but operating effectiveness is untested
State the resulting residual risk level (High/Medium/Low) and, for SOX-scoped items, classify any deficiency as Deficiency / Significant Deficiency / Material Weakness with reasoning.
Step 7: Prioritized Remediation
Provide specific remediation actions ranked by risk-reduction impact. Each action must state: the gap it closes, the recommended control (with type and nature — e.g., "add an automated three-way match edit check"), the owner function, and priority (Critical / High / Medium). Favor adding preventive and automated controls where they close a real gap; avoid recommending more detective/manual controls on top of an already manual-heavy set.
Output Format
- Structure: Narrative assessment with an embedded control classification table and a ranked remediation list
- Length: 700–1,000 words
- Format: Structured document — prose sections plus one classification table and one numbered remediation list
- Sections: Risk & Inherent Risk Summary → Control Classification Table → Design Adequacy Findings → Operating Effectiveness Findings → Control Gaps & Structural Weaknesses → Overall Effectiveness Rating & Residual Risk → Prioritized Remediation
- Tone: Internal audit director — objective, evidence-based, and conclusive; states ratings plainly and does not soften deficiencies
Quality Checklist
Before delivering output, verify:
- [ ] Every control provided appears in the classification table with all four attributes assigned (type, nature, frequency, key/non-key)
- [ ] Inherent risk is stated before the effectiveness conclusion, and residual risk is stated after
- [ ] At least the six structural weakness patterns in Step 5 were checked, including segregation of duties
- [ ] Operating effectiveness is marked "unable to conclude — testing required" wherever no evidence was provided (no assumed effectiveness)
- [ ] The overall rating uses the defined four-level scale, and SOX-scoped deficiencies are classified by severity
- [ ] Every remediation action names the gap it closes, the control type/nature recommended, an owner, and a priority
Notes
- The most common finding in practice is a control set that catches errors but never prevents them — a "Partially Effective" set that reads as safe but leaves inherent risk largely intact. Call this out directly.
- Design effectiveness and operating effectiveness are separate conclusions; a well-designed control that isn't performed is still ineffective. Never merge them.
- A control's precision matters more than its existence — "management reviews the report monthly" is not a control unless the review is precise enough to catch the specific error and there is evidence of the work performed.
- For SOX contexts, tie each key control back to the relevant assertion (existence, completeness, accuracy, valuation, presentation) when the process is financial reporting-related.
How to use this skill
This file is a Claude Code skill in Anthropic's standard format — markdown with YAML frontmatter at the top.
Installing in Claude Code:
~/.claude/skills/<folder-name>/SKILL.md— auto-loads in every session anywhere on your machine (recommended for skills you'll use across multiple projects)<your-project>/.claude/skills/<folder-name>/SKILL.md— auto-loads only when working in that project (recommended for project-specific skills)
Restart Claude Code or open a new session to register.
Using in Claude.ai, ChatGPT, Gemini, or other AI tools:
- Drag this file into a new chat, or copy and paste its contents
- Send your task or request as your next message — the AI will apply the skill where it fits
For Claude Code skill details: https://docs.anthropic.com/en/docs/claude-code/skills