Compliance Advisor

Compliance Advisor

Overview

This skill provides comprehensive support for compliance, internal controls, and audit activities. It covers J-SOX (Japan) and SOX (US) compliance, Risk Control Matrix (RCM) development, and internal audit planning based on the COSO Internal Control Framework (2013).

Key Capabilities

Supported Frameworks

• COSO Internal Control Framework (2013) - 5 components, 17 principles
• J-SOX (金融商品取引法) - Japanese internal control requirements
• SOX Section 404 - US Sarbanes-Oxley compliance
• IIA Standards - Internal audit professional standards

Supported Languages

• Japanese (日本語): Templates for domestic compliance
• English: Templates for global/US compliance

Prerequisites

• Understanding of the organization's business processes and control environment
• Access to relevant process documentation, policies, and prior audit reports
• Knowledge of applicable regulatory requirements (J-SOX, SOX, etc.)

Output

This skill provides conversational guidance and advisory support. It does not generate standalone files automatically. Outputs include:

• Compliance assessment recommendations and gap analyses
• Risk Control Matrix structures and content guidance
• Internal audit planning frameworks and procedures
• Regulatory response strategies and remediation advice

Templates in assets/ can be used as starting points when formal documentation is needed.

When to Use This Skill

Trigger Scenarios

1. J-SOX/SOX Compliance

   • "J-SOX対応の評価範囲を決定したい"
   • "Create SOX Section 404 documentation"

2. RCM Development

   • "リスクコントロールマトリクスを作成してください"
   • "Build an RCM for the procure-to-pay process"

3. Internal Audit Planning

   • "年間監査計画を策定したい"
   • "Develop a risk-based audit plan"

4. Regulatory Response

   • "規制対応のギャップ分析を行いたい"
   • "Assess compliance gaps and create remediation plan"

Core Frameworks

COSO Internal Control Framework (2013)

The skill is built on the COSO framework's 5 components:

┌─────────────────────────────────────────────────────────────┐
│                    CONTROL ENVIRONMENT                       │
│  Integrity, Ethical Values, Oversight, Structure, Authority │
├─────────────────────────────────────────────────────────────┤
│                     RISK ASSESSMENT                          │
│  Objectives, Risk Identification, Fraud Risk, Change Impact │
├─────────────────────────────────────────────────────────────┤
│                   CONTROL ACTIVITIES                         │
│  Selection, Technology Controls, Policies & Procedures       │
├─────────────────────────────────────────────────────────────┤
│               INFORMATION & COMMUNICATION                    │
│  Quality Information, Internal Communication, External       │
├─────────────────────────────────────────────────────────────┤
│                 MONITORING ACTIVITIES                        │
│  Ongoing Evaluation, Deficiency Communication               │
└─────────────────────────────────────────────────────────────┘

Financial Reporting Assertions

Workflow 1: J-SOX/SOX Compliance

Use this workflow when establishing or evaluating internal controls over financial reporting.

Step 1: Determine Evaluation Scope

Identify the scope of internal control evaluation:

Scoping Criteria:

Scope Documentation:

## Evaluation Scope

### Significant Accounts
| Account | Amount | % of Total | In Scope |
|---------|--------|------------|----------|
| Revenue | $XXX | XX% | Yes |
| Inventory | $XXX | XX% | Yes |

### Significant Processes
- Order-to-Cash
- Procure-to-Pay
- Inventory Management
- Financial Close

Step 2: Identify Significant Accounts and Disclosures

Map accounts to processes and assertions:

Step 3: Document Business Processes

Create process documentation:

1. Process Narrative (業務記述書)

   • Process objectives
   • Key activities and transactions
   • Systems and applications used
   • Roles and responsibilities

2. Process Flowchart

   flowchart TD
       A[Customer Order] --> B{Credit Check}
       B -->|Approved| C[Enter Order in System]
       B -->|Rejected| D[Notify Customer]
       C --> E[Pick & Ship]
       E --> F[Invoice Customer]
       F --> G[Record Revenue]
   

3. Risk and Control Matrix (RCM)

   • See Workflow 2 for detailed RCM development

Step 4: Evaluate Design Effectiveness

Assess whether controls are properly designed:

Design Evaluation Criteria:

Step 5: Test Operating Effectiveness

Test whether controls are operating as designed:

Testing Approach:

Testing Methods:

1. Inquiry - Ask control owners about procedures
2. Observation - Watch control being performed
3. Inspection - Review documentation/evidence
4. Re-performance - Execute the control independently

Step 6: Evaluate and Report Deficiencies

Classify identified deficiencies:

Use template: assets/jsox_sox_checklist_ja.md or assets/jsox_sox_checklist_en.md

Workflow 2: Risk Control Matrix (RCM) Development

Use this workflow when building or updating Risk Control Matrices.

Step 1: Identify Process Objectives

Define what the process should achieve:

Example - Order-to-Cash:

Step 2: Identify Risks

For each objective, identify what could go wrong:

Risk Identification Matrix:

Inherent Risk Assessment:

Step 3: Map Controls to Risks

Identify controls that mitigate each risk:

Control Types:

Step 4: Identify Key Controls

Determine which controls are "key" for SOX/J-SOX purposes:

Key Control Criteria:

Step 5: Assess Control Effectiveness

Evaluate whether controls adequately mitigate risks:

Step 6: Calculate Residual Risk

Residual Risk = Inherent Risk - Control Effectiveness

Use template: assets/risk_control_matrix_ja.md or assets/risk_control_matrix_en.md

Workflow 3: Internal Audit Planning

Use this workflow when developing internal audit plans.

Step 1: Define the Audit Universe

Create a comprehensive list of auditable areas:

Audit Universe Categories:

Step 2: Assess Risks for Prioritization

Rate each auditable unit:

Risk Assessment Factors:

Risk Scoring Matrix:

Step 3: Develop Annual Audit Plan

Create a risk-based audit schedule:

## Annual Audit Plan FY20XX

| Audit # | Audit Area | Risk Rating | Q1 | Q2 | Q3 | Q4 | Hours |
|---------|------------|-------------|----|----|----|----|-------|
| IA-001 | Procurement | High | ██ | | | | 200 |
| IA-002 | Revenue Cycle | High | | ██ | | | 240 |
| IA-003 | IT General Controls | Medium | | | ██ | | 160 |
| IA-004 | Inventory Management | Medium | | | | ██ | 180 |

Step 4: Design Audit Programs

Create detailed audit procedures:

Audit Program Structure:

1. Audit Objectives

   • What are we trying to verify?
   • What risks are we addressing?

2. Scope and Approach

   • Time period covered
   • Locations included
   • Sampling methodology

3. Detailed Procedures

   Step	Procedure	Evidence	WP Ref
   1	Interview process owner	Meeting notes	A-1
   2	Walkthrough transaction flow	Flowchart	A-2
   3	Select sample of transactions	Sample log	A-3
   4	Test control operation	Test results	A-4

Step 5: Execute and Document

Working Paper Standards:

Step 6: Report and Follow-Up

Audit Report Structure:

1. Executive Summary

   • Overall assessment
   • Key findings summary
   • Management action required

2. Detailed Findings

   Finding	Risk	Recommendation	Management Response	Due Date

3. Appendices

   • Scope and methodology
   • Testing details

Use template: assets/internal_audit_plan_ja.md or assets/internal_audit_plan_en.md

Workflow 4: Regulatory Response Planning

Use this workflow when responding to new regulations or compliance gaps.

Step 1: Understand Regulatory Requirements

Document the regulation's requirements:

Step 2: Conduct Gap Analysis

Compare current state to requirements:

Gap Analysis Template:

Gap Severity Classification:

Step 3: Develop Remediation Plan

Create action plan to close gaps:

Remediation Plan Structure:

Step 4: Implement Changes

Track implementation progress:

Implementation Tracking:

Step 5: Establish Ongoing Monitoring

Create sustainable compliance:

Monitoring Framework:

Quick Reference

J-SOX/SOX Compliance Checklist

• Scoping completed and documented
• Significant accounts identified
• Significant processes mapped
• RCMs created for in-scope processes
• Entity-level controls evaluated
• IT general controls assessed
• Design effectiveness tested
• Operating effectiveness tested
• Deficiencies evaluated and classified
• Management's report prepared

RCM Development Checklist

• Process objectives defined
• Risks identified for each objective
• Inherent risk assessed
• Controls mapped to risks
• Key controls identified
• Control effectiveness assessed
• Residual risk calculated
• Gaps and improvements documented

Internal Audit Checklist

• Audit universe defined
• Risk assessment completed
• Annual plan approved by Audit Committee
• Audit programs developed
• Fieldwork completed
• Working papers reviewed
• Draft report issued
• Management responses obtained
• Final report distributed
• Follow-up scheduled

Resources

Templates (assets/)

Reference Guides (references/)

Best Practices Summary

Internal Control Design

1. Preventive over Detective - Prefer controls that prevent errors
2. Automated over Manual - Automated controls are more reliable
3. Segregation of Duties - Separate authorization, custody, recording
4. Document Everything - No documentation = no control
5. Regular Review - Controls decay without maintenance

Risk Assessment

1. Top-Down Approach - Start with financial statement level
2. Quantitative + Qualitative - Consider both perspectives
3. Fraud Risk - Explicitly consider fraud scenarios
4. Change Impact - Assess how changes affect controls

Internal Audit

1. Independence - Report to Audit Committee
2. Risk-Based - Focus on highest risk areas
3. Value-Added - Provide actionable recommendations
4. Follow-Through - Verify remediation completion

Troubleshooting

Common Issues and Solutions

Examples

Example 1: J-SOX Initial Implementation

Context: Japanese public company implementing J-SOX for first time

How This Skill Helps:

1. Workflow 1 (J-SOX): Determined evaluation scope using 5% threshold
2. Workflow 2 (RCM): Created RCMs for 8 significant processes
3. Result: Achieved unqualified internal control report

Example 2: SOX Remediation Project

Context: US subsidiary identified material weakness

How This Skill Helps:

1. Workflow 4 (Regulatory): Conducted gap analysis
2. Workflow 2 (RCM): Redesigned controls
3. Workflow 1 (SOX): Re-tested operating effectiveness
4. Result: Remediated material weakness in 6 months

Example 3: Risk-Based Audit Transformation

Context: Internal audit team shifting from cyclical to risk-based approach

How This Skill Helps:

1. Workflow 3 (Audit): Created risk-scored audit universe
2. Workflow 2 (RCM): Leveraged control testing results
3. Result: Increased audit coverage efficiency by 40%