PBC and request-list tracking
Map a client's evidence folder against the request list to see what is genuinely satisfied before you start testing.
— Risk & Compliance
Audit evidence mapping
Pairs a full evidence set against every audit assertion or PBC item to produce a coverage matrix, naming the assertions nothing supports and the documents supporting nothing.
- Risk & Compliance
- Traceable reasoning
- Runs anywhere
2–3 days → ~10 minutes
For a typical multi-document review workflow
No coding required
- Input
- The full evidence folder
- Output
- A document-by-assertion coverage matrix
- Runs in
- Skillsize · ChatGPT · Claude · Copilot
- Export
- SKILL.md · MCP
- Time saved
- ~2–3 days per run
— USE CASES
What people use Audit evidence mapping for
Controls walkthrough preparation
Establish coverage per assertion so fieldwork time goes to the gaps rather than to re-reading complete files.
Evidence hygiene reviews
Surface stale or orphaned documents that support no assertion and can be dropped from the file.
What it works from
- The full evidence folder
- The audit assertions or request items in scope
- Any naming or referencing conventions you use
What you get back
- A document-by-assertion coverage matrix
- A named list of unsupported assertions
- A list of evidence that maps to nothing
— HOW IT BEHAVES
How Audit evidence mapping produces its result
The mechanics behind this specific template — what it reads, what it calculates, and where a human stays in the loop.
Coverage across the risk universe in scope, both directions
A coverage pass shows which risks are supported by evidence and which are not — including requirements with nothing behind them and material that supports nothing.
Whole sets of risk registers, controls and policy documents at once
All of your risk registers, controls and policy documents is processed as one set, so patterns across documents surface instead of being read one file at a time.
Composed as work product
Findings on the risk universe in scope are written up as a document that reads like professional output, with each claim tied back to a risk.
Why this is expensive by hand
The slow part of fieldwork is proving which document supports which assertion. PBC and request-list tracking is the typical trigger — map a client's evidence folder against the request list to see what is genuinely satisfied before you start testing. Done properly it is defensible; done at pace it becomes a judgement call nobody can retrace. And "properly" usually means 2–3 days of manual work.
How this Skill produces it
As a Skill, the work is already sequenced. You bring the evidence, and the run produces a document-by-assertion coverage matrix plus a named list of unsupported assertions. What sits between input and output is the codified method: thresholds, sequencing and the points where a human confirms a call — all of it visible and editable in the Skill. The practical effect: 2–3 days of manual work becomes a ~10 minutes run, held to an identical standard on the tenth engagement as on the first.
Who it's for
- Internal audit and risk functions
- Compliance and controls teams
- Second-line functions reporting to committees
- Risk consultants running assessments
Run it in Skillsize — or export it anywhere
Audit evidence mapping exports as a structured SKILL.md file and is MCP-ready, so the same method runs in ChatGPT, Claude, Copilot or your own AI products. Adapt it to your methodology, and the intelligence stays yours — not locked to one vendor.
ChatGPTClaudeCopilotAI Products (MCP)
Related Skill Templates
More Risk & Compliance templates →Risk & Compliance
Data Subject Access Request (DSAR) Engine
Assesses a data subject access request end to end and returns a governed decision on whether to fulfil it, fulfil it in part, refuse it with reasons or extend the deadline, having verified identity, mapped the request to the systems that actually hold the data and held the outcome for a data protection sign-off before anything is disclosed.
Risk & Compliance
Findings consolidation
Fans multiple audit or review reports into individual findings, deduplicates repeats, and sorts them by severity into one consolidated register with sources retained.
Risk & Compliance
Claims Coverage Triage Engine
Reads a submitted claim against the policy wording that governs it and returns a coverage assessment showing whether it appears covered, potentially excluded or in need of specialist review, mapped clause by clause and never issued without a handler's sign-off.
Risk & Compliance
Incident Severity & Response
Assesses a reported incident against your response playbook and policies, assigns the severity band the evidence supports, and returns the matching response plan with the notifications, owners and timelines that band requires.
Risk & Compliance
Privacy / Data-Transfer Approval
Assesses personal-data processing and cross-border transfers against privacy policy and jurisdiction rules, producing a documented approval outcome with conditions, policy evidence and grounds for referral.
Risk & Compliance
Regulatory gap assessment
Assesses current policies, controls and supporting evidence against regulatory requirements, producing a gap assessment and prioritised remediation plan for reviewer approval.