Results for “internal-audit”

Guides internal and external ISMS audits for ISO 27001 compliance, including audit planning, control assessment, finding management, and certification support.

Pressure-tests medical-device QMS work with six traceability-obsessed questions before internal audits, regulatory reviews, or product launches.

Pressure-tests an ISMS with six sample-driven questions to prepare for ISO 27001 internal, certification, or surveillance audits.

Investigates insider threat incidents involving employees, contractors, or trusted partners who misuse authorized access to steal data, sabotage systems, or violate security policies. Combines digital forensics, user behavior analytics, and HR/legal coordination to build an evidence-based case.

Audit a directory of multilingual blog content for completeness, consistency, hreflang correctness, meta-tag parity, and freshness. Builds a translation coverage matrix, flags stale translations, validates hreflang and schema, and emits a prioritized report with runnable fix commands. Use when user says "locale audit", "blog locale-audit", "check translations", "multilingual audit", "translation check", "hreflang check", "Uebersetzungen pruefen".

Independent DeepSeek-backed adversarial proof-audit step for existing theorem, lemma, proposition, or proof artifacts in Markdown, LaTeX, or proof logs. Use when asked to check, audit, verify, red-team, or adversarially review a proof; when a completed proof task needs a correctness pass; or when a broader proof workflow dispatches an independent reviewer to find gaps, hidden assumptions, counterexamples, or unjustified steps.

Audit existing business processes to identify AI automation opportunities. TRIGGERS - Use when user wants to find AI opportunities, audit processes for automation, or assess AI readiness.

Investigates insider threat indicators including data exfiltration attempts, unauthorized access patterns, policy violations, and pre-departure behaviors using SIEM analytics, DLP alerts, and HR data correlation.

System Audit — entry point

Audit existing business processes to identify AI automation opportunities. TRIGGERS - Use when user wants to find AI opportunities, audit processes for automation, or assess AI readiness.

Per-page UX audit using NN/g heuristics, Intuit microcopy, and Google HEART. Use when evaluating usability, auditing microcopy, checking UX heuristics, or assessing cognitive load. Cross-page flows/IA → audit-ux-journeys. Layout/breakpoints → audit-responsive. Empty/error states → audit-ui-states.

Systematic methodology for auditing the Hermes Skills Hub (and external sources) to identify gaps, overlaps, redundancies, and conflicts when building a skill library for any project. Covers browsing, targeted searching, cross-referencing with web/GitHub, comparing candidates against existing inventory, verifying install safety, and planning installation order. Use when starting a new project and assembling tools, or when evaluating whether to add external skills beyond what's currently installed.

Audit project and global memory for bloat, stale decisions, duplicates, contradictions, unsafe content, missing provenance, broken routing, and over-budget global files. Load when the user asks to audit memory, clean memory, check memory health, or verify memory quality.

Audit and optimize application runtime performance (Core Web Vitals, slow code, load time). Use when "slow page", "LCP/INP/CLS", or "optimize performance". JS payload → audit-bundle-size. Concurrent breaking point → test-load. Timeouts/retries → audit-resilience.

Audit a repository, vet and prioritize evidence-backed findings, write drift-aware implementation plans, delegate bounded work, and independently verify results. Use when asked to improve, audit, modernize, harden, review, plan fixes for, or systematically reduce risk in a codebase. Use native isolated agents for implementation; use OpenRouter/free only for narrow advisory audit slices under its safety limits.

Automated security auditing covering SAST, DAST, dependency scanning, secret detection, container hardening, and compliance checks before deployments or when integrating new dependencies.

Use when for crm audit.

Audits and iteratively fixes chat-based AI user interfaces against production best practices drawn from Claude, ChatGPT, and modern conversational AI, covering layout, rendering, input, responsiveness, scrolling, streaming, and accessibility.

Audit service accounts across enterprise infrastructure to identify orphaned, over-privileged, and non-compliant accounts, covering Active Directory, cloud platforms, databases, and applications.

Internal network assessment. VLAN hopping, ARP spoofing detection, broadcast protocol abuse (LLMNR/NBT-NS/mDNS), network segmentation verification, SNMP enumeration, NFS exposure, router/switch audit, and internal service mapping. Assumes attacker has network access. Uses nmap, arp-scan, nbtscan, snmpwalk, onesixtyone, smbmap, nfs-common, masscan, hping3, and netexec.

Audit Jupyter notebooks for hardcoded values that contradict configuration cells. Trigger when: (1) notebook behavior differs from documented settings, (2) updating notebook version, (3) finding inconsistent values across cells.

Conduct lean audits to identify waste reduction opportunities. TRIGGERS - Use when user needs help with lean-audit related tasks.

Reviews local branch changes for bugs, security vulnerabilities, and code quality issues, using a structured checklist and verification process.

End-to-end performance audit composite — baseline the slow metric, profile to find the real hotspot, implement the smallest targeted fix, re-benchmark to confirm improvement, capture in ADR. Use when users report slowness, CI shows runtime regression, or before a release. Never optimize without profiling first.

Harness Audit

Information Security Management System (ISMS) audit expert for ISO 27001 compliance verification, security control assessment, and certification support. Use when the user mentions ISO 27001, ISMS audit, Annex A controls, Statement of Applicability (SOA), gap analysis, nonconformity management, internal audit, surveillance audit, or security certification preparation. Helps review control implementation evidence, document audit findings, classify nonconformities, generate risk-based audit plans, map controls to Annex A requirements, prepare Stage 1 and Stage 2 audit documentation, and support corrective action workflows.

Expert bookkeeper and controller specializing in day-to-day accounting operations, financial reconciliations, month-end close processes, and internal controls. Ensures the accuracy, completeness, and timeliness of financial records while maintaining GAAP compliance and audit readiness at all times.

Use to test whether a support control actually operates, the way an auditor would test it, rather than confirming it exists on paper. Trigger for "test our controls", "does this control actually work", second-line assurance over support, control effectiveness testing, preparing for an internal audit, or a control that passed review and then failed in practice.

Guides through the complete ISO/IEC 27001:2022 ISMS lifecycle from scoping and risk assessment to certification and continual improvement, including Annex A control selection and Statement of Applicability creation.

Blog and web-content system for agency work — plan topics, interview the author for their real take, brief the angle, draft the article, plan images, verify claims, score drafts for quality and AI tells, revise, publish, and refresh aging posts. Shorthand "wltbo" also triggers it. Commands share a per-client memory of brand voice, the author's positions and stories, verified facts with expiry dates, and every published post. Use for blog posts, articles, long-form content, refreshes, keyword targeting, search intent, titles and H1s, meta descriptions, internal linking, cannibalization checks, E-E-A-T, and information gain. Also use when the complaint is "it doesn't sound like us", "it reads AI-written", "it's generic", "we already wrote this one", "the facts are made up", "there are no images", "it's too thin", or "nobody thought this through". Not for social posts, emails, internal comms, case studies (case-study-builder), site audits (website-audit), or content calendars (content-strategy).