audit-risk-assessment

Q: How do I install audit-risk-assessment?

Run npx skills add https://github.com/mukul975/privacy-data-protection-skills --skill audit-risk-assessment in your project. The skills CLI detects the agents you use and copies the skill into the right folder. For Claude Code you can also place the skill folder at ~/.claude/skills/audit-risk-assessment/ (personal) or .claude/skills/audit-risk-assessment/ (project).

by mukul975Security

Guides privacy audit risk assessment including risk universe development, inherent and residual risk scoring, control effectiveness evaluation, risk-based audit planning, heat map generation, risk appetite alignment, and audit prioritization by risk exposure. Covers the full audit risk assessment cycle from scoping through ongoing monitoring. Keywords: audit risk assessment, risk universe, inherent risk, residual risk, control effectiveness, risk-based audit planning.

Installs: 43
Last 24h: —
Trending rank: —
Security: Not audited

Install

Works with every agent the skills CLI supports.

npx skills add https://github.com/mukul975/privacy-data-protection-skills --skill audit-risk-assessment

01
Install
Run the command in your project. The CLI asks which agents to install for.
02
Describe the task
Ask your agent for something this skill covers. It loads audit-risk-assessment automatically when relevant.
03
Review the result
The agent follows the SKILL.md steps, scripts and references bundled with the skill.

SKILL.md

The instructions your agent reads when the skill is triggered.

Privacy Audit Risk Assessment

Overview

Privacy audit risk assessment is the systematic process of identifying, evaluating, and prioritising privacy risks to determine audit scope, frequency, and resource allocation. A risk-based approach ensures that audit effort is directed at areas of greatest exposure, aligning with the accountability principle under GDPR Article 5(2) and the proportionality requirements of ISO 19011:2018.

The International Internal Audit Standards (IIA Standard 2010) require the chief audit executive to establish a risk-based plan to determine the priorities of the internal audit activity. In the privacy domain, this means evaluating processing activities, data categories, transfer mechanisms, and regulatory exposure to identify where compliance failures would cause the greatest harm.

Risk Universe

The privacy audit risk universe encompasses all auditable entities within the organisation's privacy programme:

Risk Domain	Auditable Entities	Example Risks
Data Subject Rights	DSAR processing, consent management, automated decisions	Late DSAR responses, invalid consent, no human review for automated decisions
Data Processing	Processing registers, lawful basis documentation, purpose limitation	Undocumented processing, incorrect lawful basis, purpose creep
Data Transfers	International transfers, SCCs, BCRs, adequacy reliance	Transfer without safeguards, outdated SCCs, Schrems II non-compliance
Data Security	Technical controls, access management, encryption	Unauthorised access, unencrypted personal data, excessive permissions
Breach Management	Detection, notification, documentation, remediation	Late notification (>72 hours), inadequate forensics, poor remediation
Vendor Management	Processor contracts, sub-processor oversight, due diligence	Missing Article 28 clauses, no sub-processor approval, inadequate DPA
Privacy Governance	DPO independence, training, policies, ROPA	DPO conflict of interest, outdated policies, incomplete ROPA
Special Categories	Biometric data, health data, children's data	Missing DPIA, inadequate safeguards, no explicit consent

Risk Scoring Methodology

Inherent Risk (before controls)

Factor	Weight	Scale (1-5)	Description
Data Volume	20%	1=<1K records, 5=>1M records	Volume of personal data processed
Data Sensitivity	25%	1=basic contact, 5=special category/biometric	Sensitivity of data categories involved
Regulatory Exposure	25%	1=single jurisdiction, 5=global multi-regime	Number and stringency of applicable regulations
Processing Complexity	15%	1=simple storage, 5=AI/automated decisions	Complexity of processing operations
External Sharing	15%	1=internal only, 5=multiple third-party transfers	Extent of data sharing with external parties

Control Effectiveness

Rating	Score	Definition
Effective	1	Controls designed and operating effectively; no significant deficiencies
Partially Effective	2	Controls exist but have gaps in design or operation
Ineffective	3	Controls absent, poorly designed, or not operating as intended

Residual Risk

Residual Risk Score = Inherent Risk Score x Control Effectiveness Score

Residual Score	Rating	Audit Priority
1.0 – 2.0	Low	Audit every 3 years
2.1 – 3.5	Medium	Audit every 2 years
3.6 – 4.5	High	Audit annually
4.6 – 5.0	Critical	Audit semi-annually; continuous monitoring

Risk Appetite Alignment

Risk Category	Risk Appetite	Rationale
Regulatory compliance	Very Low	Zero tolerance for material non-compliance with GDPR, CCPA, or sector-specific regulation
Data subject harm	Very Low	Protecting individuals is the primary objective of the privacy programme
Operational disruption	Low	Privacy controls must not unduly impede business operations
Reputational	Low	Privacy incidents erode customer trust and brand value
Financial (penalties)	Very Low	Maximum GDPR penalty: EUR 20M or 4% global turnover

Audit Planning Integration

The risk assessment directly feeds the annual privacy audit plan:

Input	Output
Residual risk scores by auditable entity	Prioritised list of audit engagements
Risk appetite thresholds	Minimum audit frequency per entity
Resource constraints	Audit resource allocation model
Regulatory developments	Emerging risk adjustments (e.g., AI Act, new state laws)
Prior audit findings	Increased frequency for entities with unresolved high/critical findings
Management requests	Ad-hoc audit engagements for new processing activities or incidents

Heat Map Interpretation

Likelihood ↓ / Impact →	Low Impact	Medium Impact	High Impact	Critical Impact
Very Likely	Medium	High	Critical	Critical
Likely	Low	Medium	High	Critical
Possible	Low	Medium	High	High
Unlikely	Low	Low	Medium	High
Rare	Low	Low	Low	Medium

FAQ

What does the audit-risk-assessment skill do?

How do I install audit-risk-assessment?

Run npx skills add https://github.com/mukul975/privacy-data-protection-skills --skill audit-risk-assessment in your project. The skills CLI detects the agents you use and copies the skill into the right folder. For Claude Code you can also place the skill folder at ~/.claude/skills/audit-risk-assessment/ (personal) or .claude/skills/audit-risk-assessment/ (project).

Which AI agents can use audit-risk-assessment?

Any agent that supports the open Agent Skills format (a folder with a SKILL.md file), including Claude Code, Codex, Cursor, GitHub Copilot, Gemini CLI, Windsurf, Cline, OpenCode and more.

Is audit-risk-assessment safe to install?

No partner security audit is available yet. Skills can run commands and scripts, so read the SKILL.md and any bundled files before installing.

Who maintains audit-risk-assessment?

It is published by mukul975 in mukul975/privacy-data-protection-skills. It has 43 recorded installs.