# Prepare QA Audit Handoff

> Prepare an auditor-facing QA handoff by mapping a supplied audit request or control list to approved test deliverables and evidence IDs, custodians, access instructions, retention terms, and open gaps. Use for internal audit, customer assurance, regulatory evidence requests, due diligence, or transfer to an audit liaison. Builds the handoff index and chain-of-custody record without interpreting unstated controls, asserting compliance, transmitting artifacts, or signing on behalf of an owner.

- Skill: `pramoddutta/prepare-qa-audit-handoff` (Agent Skill, multi-file: 2 files)
- Install (CLI): `npx skillmds@latest add pramoddutta/prepare-qa-audit-handoff`
- Raw SKILL.md: https://api.skillmd.com/api/skills/pramoddutta/prepare-qa-audit-handoff/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- License: MIT
- Author: PramodDutta (https://skillmd.com/u/pramoddutta)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/pramoddutta/prepare-qa-audit-handoff

---


# Prepare QA Audit Handoff

Package approved QA records around the auditor's explicit request. Report what is
available and missing while leaving compliance conclusions to authorized reviewers.

## Workflow

1. Freeze the handoff ID and version, audit request reference and revision, review
   period, product and release scope, intended recipient, data boundary, and as-of time
   with timezone.
2. Inventory only approved deliverables and evidence manifests. Record source version,
   custodian, approval state, access classification, and current availability.
3. Map each supplied request or control ID to evidence and deliverable IDs with a
   concise, source-based rationale. Mark unsupported mappings unfulfilled or unverified.
4. Verify supplied access, retention, legal-hold, confidentiality, redaction, and
   recipient-authorization records. Do not invent policy terms or grant access.
5. Prepare the handoff index, chain-of-custody log, access expiry, recipient questions,
   and gaps or exceptions. Keep compliance conclusion not assessed.
6. HUMAN REVIEW GATE: require the audit liaison, evidence custodian, data owner, and any
   required compliance reviewer to approve content, redactions, recipients, and transfer.

## Output Contract

Return these fields:

- Handoff ID and version; audit request ID and revision; review period; product and
  release scope; intended recipient; data boundary; as-of timestamp and timezone.
- Source inventory table: Source ID | Type | URI or path | Version | Approval state |
  Custodian | Access classification | Availability.
- Request mapping table: Request or control ID | Supplied text and source revision |
  Deliverable and evidence IDs | Mapping rationale | Custodian | Fulfillment state.
- Gaps and exceptions table: Request or control ID | Missing item | Evidence of gap |
  Impact | Stated owner | Due date if stated.
- Chain-of-custody log: Artifact or bundle ID | From | To | Transfer method | Timestamp |
  Receipt evidence | State.
- Access and retention table: Artifact or bundle ID | Authorized recipients | Access path |
  Access expiry | Retention source and period | Legal-hold state.
- Recipient questions and pending acknowledgments.
- Redaction register: item | data class | display treatment | authorization |
  original preserved.
- Compliance conclusion: not assessed.
- HUMAN REVIEW GATE: audit liaison | custodian | data owner | compliance reviewer |
  sign-off status | transfer and publication status.

## Scope Boundary

- Map an explicit audit request to already approved deliverables and curated evidence;
  do not create test evidence, assess coverage, write a closure report, or decide release.
- Organize a handoff; do not interpret law, invent controls, certify compliance, grant
  access, or transmit artifacts.

## Guardrails

- Never invent request text, controls, mappings, evidence, custodians, approvals,
  timestamps, retention terms, access rights, receipts, or compliance conclusions.
- Treat no response, inaccessible evidence, or an absent artifact as a gap, never proof
  of compliance.
- Redact secrets and personal data from displayed working copies, record the treatment,
  preserve originals, and honor the supplied data boundary.
- Do not publish, send, upload, grant access, approve the handoff, or sign for another
  person without explicit human authorization after the review gate.