New: 98,000+ skills indexed from GitHub repos with 100+ stars · every skill safety-checkedBrowse top skillsTop skills
Esc to closeBrowse all skills
Submit a skillBrowse skills
Submit a skillBrowse skills

Agent skill

Internal Controls And Audit

by cbrock84 in cbrock84/headcount

Designs and tests controls over financial reporting — segregation of duties, approval limits, evidence, and preparing for audit.

MITAuto-check passedLegal & Compliance

Install Internal Controls And Audit

skills CLI
$ npx skills add cbrock84/headcount --skill internal-controls-and-audit -a claude-code

Project install by default; add -g for ~/.claude/skills/.

GitHub CLI
$ gh skill install cbrock84/headcount internal-controls-and-audit --agent claude-code

Project scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).

Manual copy
$ git clone --depth 1 https://github.com/cbrock84/headcount.git skills-src && mkdir -p .claude/skills && cp -r skills-src/plugins/finance/skills/internal-controls-and-audit .claude/skills/internal-controls-and-audit && rm -rf skills-src

Use ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.

Claude Code skills documentation · loads skills from .claude/skills/

Facts

Skill name
internal-controls-and-audit
GitHub stars
2k
Token cost
~1.3k tokens
SKILL.md length
730 words
Files
2 (incl. references)
Skills in repo
178
Repo updated
First seen
Licence
MIT

At a glance

Designs and tests controls over financial reporting — segregation of duties, approval limits, evidence, and preparing for audit.

  • Tasks that involve Access reviews and audit trails
  • SKILL.md covers The five components an auditor…, Segregation of duties, Design controls that leave… and Approval thresholds, plus 3 more sections
  • Instructions only: no scripts, shell commands, URLs or credentials in SKILL.md
  • Tasks that involve Audit readiness

What it does

Internal Controls And Audit is an agent skill from cbrock84/headcount. Designs and tests controls over financial reporting — segregation of duties, approval limits, evidence, and preparing for audit. Use this to design controls for a process, prepare for an external audit, respond to an audit finding, set approval thresholds, or assess where a small team's segregation of duties is genuinely broken.

Its SKILL.md is about 1.3k tokens, which your agent loads only when the skill is triggered. The skill folder holds 2 other files, including reference files (for example `references/sources.md`).

It sits in Legal & Compliance, covering Access reviews and audit trails, Audit readiness and Financial analysis. The repository describes itself as: An agent organization structured as a company — 15+ departments, 125+ skills, each independently installable, citing the standards and regulators that settle the question. Runs… The licence is MIT.

When your agent uses it

  • Tasks that involve Access reviews and audit trails
  • Tasks that involve Audit readiness
  • Tasks that involve Financial analysis

Example prompts

  • “Use the internal-controls-and-audit skill to design and tests controls over financial reporting — segregation of duties, approval limits, evidence…”
  • “/internal-controls-and-audit”

What it can do on your machine

Read from SKILL.md and the folder at commit 98d1c17. It shows what the files ask for, not the result of running them.

  • Tool permissions

    Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.

    From allowed-tools in the SKILL.md frontmatter.

  • Runs code

    No scripts in the folder and no shell commands in SKILL.md.

    From the folder's file list and the shell code blocks in SKILL.md.

  • Network

    No URLs in SKILL.md.

    From URLs in SKILL.md, links to its own repository left out.

  • Credentials

    Names no API keys, tokens, secrets or passwords.

    From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.

Context cost

Internal Controls And Audit loads about 1.3k tokens when it runs, and up to ~1.7k if it reads all its reference files. Until then it costs about 90 tokens; SKILL.md has 730 words of instructions outside code blocks.

Always · name and description, kept in context so the agent knows when to use it
~90
When it runs · the whole SKILL.md, loaded when a task matches
~1.3k
With references · SKILL.md plus every file in references/, read only if the agent opens them
~1.7k

Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.

Safety

Auto-check passed

The automated check found no risky patterns in SKILL.md.

Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.

SKILL.md

The full file from cbrock84/headcount at commit 98d1c17, republished under its MIT licence (© cbrock84). 730 words, ~1,333 tokens.

Download SKILL.mdSave it as .claude/skills/internal-controls-and-audit/SKILL.md (or your agent's skills folder). This skill also uses 1 other file; get the full folder from GitHub.
name
internal-controls-and-audit
description
Designs and tests controls over financial reporting — segregation of duties, approval limits, evidence, and preparing for audit. Use this to design controls for a process, prepare for an external audit, respond to an audit finding, set approval thresholds, or assess where a small team's segregation of duties is genuinely broken.

Internal controls and audit

Controls exist because a single person who can initiate, approve and record a transaction can also conceal one. Everything else is elaboration on that.

This structures control design and audit readiness. Statutory audit requirements, and regimes such as SOX where they apply, are matters for your auditors and qualified advisers.

The five components an auditor will assess

Segregation of duties is one control activity inside a much larger structure, and a team that has only built control activities will still be told its control environment is weak. Auditors assess five components, and a deficiency in any one undermines the others:

  • Control environment — integrity and ethical values, oversight by whoever plays the board role, a structure with defined responsibility and authority, competence for the work assigned, and accountability actually enforced. This is the component small organizations skip and the one that determines whether every other control holds.
  • Risk assessment — objectives defined clearly enough to have risks, risks identified and responded to, fraud risk assessed explicitly rather than assumed away, and change identified as it happens. New systems, new people, and rapid growth all invalidate control designs quietly.
  • Control activities — the controls themselves, including those over the information systems the records depend on, and evidence that they were performed rather than merely designed.
  • Information and communication — quality information available to the people who need it, communicated internally to those who act on it and externally to those who rely on it. A control nobody was told about does not operate.
  • Monitoring — someone checks that controls still work, and identified deficiencies get remediated on a timetable rather than carried forward year after year.

Two of these are consistently the weak ones in organizations under a few hundred people: fraud risk is never assessed on the reasoning that everyone is trusted, and monitoring never happens because the people who would monitor are the people who perform the controls.

Segregation of duties

Four capabilities should not sit with one person: initiating a transaction, approving it, recording it, and holding the asset. Any two combined is a risk; three is an unmonitored opportunity.

Small teams cannot always separate these. That is a normal constraint and pretending otherwise produces a fictional control matrix. Where separation is impossible, compensate visibly:

  • Review by someone outside the process, on a defined cadence rather than when convenient.
  • Exception reporting that goes to someone who is not the preparer.
  • Bank confirmations and reconciliations reviewed independently of whoever performs them.

Document the gap and the compensating control. An acknowledged, mitigated gap is a defensible position; an unacknowledged one is a finding waiting to be written.

Show full SKILL.md (294 more words)Show less

Design controls that leave evidence

A control that happened but left no trace did not happen, as far as an auditor can determine. Each control needs a stated owner, frequency, what is examined, and an artifact produced as a by-product of doing the work — not assembled afterwards for the audit.

Prefer preventive controls, which stop the transaction, over detective ones, which find it afterwards. Prefer automated over manual: system-enforced approval limits do not have busy weeks.

Approval thresholds

Set limits by value and by risk, not value alone. A low-value payment to a new supplier deserves more scrutiny than a large one to an established counterparty on contracted terms.

Watch for splitting — transactions repeatedly landing just under a threshold is the pattern the threshold creates, and it is straightforward to monitor for.

Audit findings

Treat a finding as information. Fix the cause rather than the instance, and be skeptical of remediation that consists of more careful behavior: the same conditions will reproduce the finding with different people.

Related but distinct: legal-risk:corporate-governance owns board and entity governance, legal-risk:enterprise-risk owns the risk framework. This skill owns controls over financial reporting.

Sources

references/sources.md in this skill lists the outside authorities that settle the questions here — what each one is authoritative for, and what you may do with it. Check them before answering on anything they cover, and cite what you used. Most are free to read and not free to reproduce; the use note on each is binding.

Never

  • Sign a control matrix that describes separation the team does not actually have.
  • Accept a control with no evidence produced in the ordinary course of performing it.
  • Remediate a finding with a commitment to be more careful.
  • Set approval limits on value alone and not monitor for splitting.

© cbrock84, MIT. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file

Files

SKILL.md and 1 other file (references) in plugins/finance/skills/internal-controls-and-audit of cbrock84/headcount.

  • SKILL.md
  • references/sources.md

Open the folder on GitHubat commit 98d1c17

Compare with similar skills

Internal Controls And Audit next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.

Internal Controls And Audit compared with similar skills
SkillStarsUsed inTokensAuto-checkLicenceRepo updated
Internal Controls And Audit this skillcbrock84/headcount2k—~1.3kAutomated safety check: PassMIT
Sox ItgcSushegaad/Claude-Skills-Governance-Risk-and-Compliance946—~2.1kAutomated safety check: PassMIT
OmniRoute Audit and Policy CLIdiegosouzapw/OmniRoute75k—~733Automated safety check: PassMIT
PCI DSS Compliancewshobson/agents40k11 repos~1.9kAutomated safety check: PassMIT
Performing Access Recertification With Saviyntmukul975/Anthropic-Cybersecurity-Skills34k—~2.8kAutomated safety check: PassApache-2.0
Implementing Conduit Security For Ot Remote Accessmukul975/Anthropic-Cybersecurity-Skills34k—~3.4kAutomated safety check: PassApache-2.0

Similar skills

  • Sox Itgc

    Sushegaad/Claude-Skills-Governance-Risk-and-Compliance

    Expert SOX IT General Controls (ITGC) advisor for finance, internal audit and IT compliance teams.

    946 GitHub stars~2.1k tokensUpdated today
    Legal & ComplianceAuto-check passed

  • OmniRoute Audit and Policy CLI

    diegosouzapw/OmniRoute

    Command reference for omniroute's audit, logs, policy and telemetry commands: search and export audit trails, manage access policies and review request history for compliance work.

    75k GitHub stars~733 tokensUpdated today
    SecurityAuto-check passed

  • PCI DSS Compliance

    wshobson/agents

    Reference for building payment systems that meet PCI DSS: the 12 requirements, merchant levels, data that must never be stored, tokenization and encryption.

    40k GitHub starsUsed in 11 repos~1.9k tokens
    Legal & ComplianceAuto-check passed

  • Performing Access Recertification With Saviynt

    mukul975/Anthropic-Cybersecurity-Skills

    Configure and execute access recertification campaigns in Saviynt Enterprise Identity Cloud to validate user entitlements, revoke excessive access, and maintain compliance with SOX, SOC 2, and HIPAA.

    34k GitHub stars~2.8k tokensUpdated 1 mo ago
    Legal & ComplianceAuto-check passed

  • Implementing Conduit Security For Ot Remote Access

    mukul975/Anthropic-Cybersecurity-Skills

    Implements secure conduit architecture for OT remote access under the IEC 62443 zones-and-conduits model, deploying jump servers, MFA gateways, session recording, and approval-based workflows for…

    34k GitHub stars~3.4k tokensUpdated 1 mo ago
    Legal & ComplianceAuto-check passed

  • Building Identity Governance Lifecycle Process

    mukul975/Anthropic-Cybersecurity-Skills

    Design identity governance and lifecycle (IGA) programs on platforms like SailPoint, Saviynt, or Entra ID Governance, covering joiner-mover-leaver (JML) automation, role mining, access requests…

    34k GitHub stars~7.3k tokensUpdated 1 mo ago
    Legal & ComplianceAuto-check passed

More from cbrock84/headcount

All 178 skills in this repo

  • Agent Hierarchy

    cbrock84/headcount

    Designs orchestrator-and-subagent hierarchies for a repository — splitting agents by exclusive write surface, pairing every producer with an independent auditor, and enforcing the split with a…

    2k GitHub stars~1.2k tokensUpdated 23 days ago
    Auto-check passed

  • Access And Identity

    cbrock84/headcount

    Designs and audits who can reach what — authentication, authorization models, privileged access, service credentials, and joiner-mover-leaver process.

    2k GitHub stars~1.1k tokensUpdated 23 days ago
    Auto-check passed

  • Account Based Marketing

    cbrock84/headcount

    Concentrates marketing and sales effort on a named set of accounts rather than on volume — qualifying whether the model fits your economics at all, building the account list and the buying group…

    2k GitHub stars~1.2k tokensUpdated 23 days ago
    Auto-check passed

  • Activation

    cbrock84/headcount

    Gets new users from signup to first real value — signup flow, onboarding, time-to-value, and the early experience that determines whether someone becomes a user or a lapsed account.

    2k GitHub stars~865 tokensUpdated 23 days ago
    Auto-check passed

  • AI ML Governance

    cbrock84/headcount

    Governs models and AI systems in production — intended use, evaluation, monitoring, human oversight, documentation, and the decision to deploy or retire.

    2k GitHub stars~1k tokensUpdated 23 days ago
    Auto-check passed

  • AI Research Analyst

    cbrock84/headcount

    Produces executive-level research — market sizing, competitor mapping, trend analysis, and strategic intelligence — grounded in cited sources with the confidence in each claim made explicit.

    2k GitHub stars~916 tokensUpdated 23 days ago
    Auto-check passed

Categories

Questions about Internal Controls And Audit

What does Internal Controls And Audit do?

Designs and tests controls over financial reporting — segregation of duties, approval limits, evidence, and preparing for audit. Internal Controls And Audit is an agent skill from cbrock84/headcount. Designs and tests controls over financial reporting — segregation of duties, approval limits, evidence, and preparing for audit.

When should I use Internal Controls And Audit?

Internal Controls And Audit fits situations like: tasks that involve Access reviews and audit trails; tasks that involve Audit readiness; tasks that involve Financial analysis.

How do I install Internal Controls And Audit in Claude Code?

Run `npx skills add cbrock84/headcount --skill internal-controls-and-audit -a claude-code`. Or copy the skill folder (plugins/finance/skills/internal-controls-and-audit in cbrock84/headcount) into .claude/skills/internal-controls-and-audit in your project. Claude Code loads it when a task matches its description.

How do I install Internal Controls And Audit in Codex?

Run `npx skills add cbrock84/headcount --skill internal-controls-and-audit -a codex`. Or copy the skill folder (plugins/finance/skills/internal-controls-and-audit in cbrock84/headcount) into .agents/skills/internal-controls-and-audit in your project. Codex loads it when a task matches its description.

Can I use Internal Controls And Audit in Cursor, Gemini CLI or GitHub Copilot?

Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add cbrock84/headcount --skill internal-controls-and-audit -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/internal-controls-and-audit, .gemini/skills/internal-controls-and-audit, .github/skills/internal-controls-and-audit and .opencode/skills/internal-controls-and-audit in your project.

What does Internal Controls And Audit need to run?

SKILL.md names no scripts, command-line tools or credentials: Internal Controls And Audit is instructions for the agent only.

Does Internal Controls And Audit access the network?

SKILL.md contains no URLs. Any network use would come from the scripts or tools the agent runs. This is read from the text; nothing was executed.

Is Internal Controls And Audit safe to install?

Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. Review the folder before installing.

What licence does Internal Controls And Audit use?

Internal Controls And Audit is published under the MIT licence (the repository's licence). It allows redistribution, so the full SKILL.md is shown on this page.

How many tokens does Internal Controls And Audit use?

About 1.3k tokens (SKILL.md is roughly 5.3k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full. Its references folder adds about 327 tokens, read only when the agent opens those files.

What are the alternatives to Internal Controls And Audit?

Skills that share tags, products or a category with Internal Controls And Audit: Sox Itgc (Sushegaad/Claude-Skills-Governance-Risk-and-Compliance, 946 stars), OmniRoute Audit and Policy CLI (diegosouzapw/OmniRoute, 75k stars), PCI DSS Compliance (wshobson/agents, 40k stars) and Performing Access Recertification With Saviynt (mukul975/Anthropic-Cybersecurity-Skills, 34k stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.

Who maintains Internal Controls And Audit?

cbrock84 (a GitHub user) maintains it in cbrock84/headcount, which has 2,022 GitHub stars. The repository holds 178 skills in this directory. The repository was last updated on September 17, 2026.

Source: cbrock84/headcount on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.