Load context
On first use: Read ../../CLAUDE.md to obtain scenario-level configuration (SOX control framework / risk tolerance / evidence standards).
/sox-control-design — SOX Control Design
Examples
→ Example: The user says "After the new revenue standard, we are worried that there are gaps in the internal controls over revenue recognition and need to re-examine them." The system should invoke this skill to identify risk points and design new controls.
→ Example: The user says "IT general controls were not really managed before, and the SOX external audit raised comments. Help me design a set." The system should invoke this skill to design controls according to the ITGC framework.
→ Example: The user says "Before preparing for an IPO, a complete internal control system needs to be established. Where should we start?" The system should invoke this skill to design a complete control framework according to IPO internal control requirements.
Step 1: Process mapping and risk identification
Process description:
□ 业务流程：[名称]
□ 涉及部门：[部门列表]
□ 流程起始：[触发事件]
□ 流程终点：[输出结果]
□ IT 系统支撑：[系统列表]
Risk identification (map the stages that may lead to misstatement of financial reports):
□ 风险类型：
→ 完整性风险：应记录未记录（如收入未开票）
→ 准确性风险：记录金额错误（如价格输入错误）
→ 存在性风险：资产/负债不存在（如虚假采购）
→ 截止风险：记录期间错误（如跨期确认收入）
→ 分类风险：科目分类错误（如费用误归类）
→ 权利义务风险：交易无商业实质
□ 已识别风险：
| # | 风险描述 | 风险类型 | 影响科目 | 风险等级 |
|---|---------|---------|---------|---------|
| 1 | [描述] | [类型] | [科目] | [高/中/低] |
| 2 | [描述] | [类型] | [科目] | [高/中/低] |
□ 重大缺陷风险（如有）：
→ 风险 [描述] — 是否为重大缺陷：[是/否]
Step 2: Control point design
Preventive controls vs. detective controls:
□ 预防性控制（在错报发生前阻止）：
→ 职责分离（SOD）：如审批与执行分离
→ 访问控制：系统权限限制
→ 审批控制：多级审批流程
→ 验证核对：系统自动校验
□ 检查性控制（在错报发生后发现）：
→ 对账：银行对账、账龄分析
→ 复核：管理层复核
→ 调节：科目调节
→ 盘点：实物盘点
Control point design (design controls for each identified risk):
| # | 对应风险 | 控制类型 | 控制描述 | 控制频率 | 责任人 |
|---|---------|---------|---------|---------|--------|
| 1 | [风险1] | [预防/检查] | [描述] | [实时/每日/月] | [岗位] |
| 2 | [风险2] | [预防/检查] | [描述] | [实时/每日/月] | [岗位] |
Step 3: Detailed design of control activities
Control activity specifications:
□ 控制编号：[流程]-[序号]
□ 控制名称：[描述]
□ 控制类型：[预防性/检查性]
□ 控制频率：[实时/每日/每周/每月/每季度/每年]
□ 控制执行步骤：
1. [执行动作]
2. [执行动作]
3. [执行动作]
□ 自动化 vs 人工：
→ [人工控制/系统自动控制/混合]
→ 自动化控制依赖IT一般控制：[是/否]
□ 依赖的前置控制：
→ 控制 [编号] — [控制名称]
Step 4: Definition of evidence requirements
Control evidence checklist:
□ 证据类型：
→ 纸质文档：[描述]
→ 电子记录：[系统名 + 查询路径]
→ 系统截图：[字段/报告名称]
→ 审批记录：[系统名/邮件/纸质]
□ 证据完整性要求：
→ 证据须包含：[日期/金额/执行人/复核人] 等字段
→ 异常情况处理：[描述，如签字/备注]
□ 证据保存要求：
→ 保存期限：[X] 年
→ 保存位置：[系统/档案室]
→ 格式要求：[纸质/电子/两者都要]
Mapping of evidence to controls:
| 控制编号 | 控制名称 | 证据类型 | 保存位置 | 保存期限 |
|---------|---------|---------|---------|---------|
| [C-01] | [名称] | [类型] | [位置] | [X]年 |
Step 5: Generate the control design document
═══════════════════════════════════════
SOX 控制设计文档
流程：[业务流程名称]
设计日期：[YYYY-MM-DD]
设计师：[姓名]
═══════════════════════════════════════
【流程概览】
□ 流程名称：[名称]
□ 涉及系统：[系统列表]
□ 控制数量：[X] 个（预防性 [X] / 检查性 [X]）
【风险-控制映射】
| 风险 | 风险等级 | 控制编号 | 控制名称 | 控制类型 |
|------|---------|---------|---------|---------|
| [风险1] | [高] | [C-01] | [名称] | [预防] |
| [风险2] | [中] | [C-02] | [名称] | [检查] |
【控制明细】
控制编号：[C-01]
控制名称：[名称]
控制类型：[预防性] | 控制频率：[每日]
控制步骤：
1. [步骤1]
2. [步骤2]
证据要求：
□ 类型：[纸质/电子]
□ 包含字段：[列表]
□ 保存期限：[X] 年
IT一般控制依赖：[✅ 是/否]
【职责分离矩阵】
□ 不相容职责：[审批] vs [执行] — 责任人 [A] vs [B]
□ SOD 合规检查：[✅ 通过 / ⚠️ 需关注]
═══════════════════════════════════════
置信度：[✅ 高 / ⚠️ 中 / 🔴 低]
设计状态：[✅ 可执行 / ⏳ 待IT确认 / 🔴 存重大缺陷]
═══════════════════════════════════════
Escalation trigger conditions
- There is a major risk point for which effective controls cannot be designed
- The risk level is "high," but only detective controls rather than preventive controls can be designed
- Segregation of duties (SOD) conflicts cannot be resolved
- Controls depend on IT general controls, but ITGC has not yet passed audit
- The control design involves a new system go-live and is incompatible with the existing process
- Management has substantive objections to the control design
Finance Skills — sox-control-design atomic skill