Run ITGC Testing with COBIT-Framed Agent Skills

Where this fits

You're an external auditor or internal controls analyst. The client just migrated its ERP to a new cloud instance, and the financial reporting team will rely on reports generated by that system. You need to test IT general controls before you can place reliance on automated controls. This skill packages ITGC testing procedures into an agent workflow, so you can go from policy documents and permission exports to an organized COBIT-based test matrix without rebuilding the methodology each time.

Why agents benefit

• Maps each testing area to COBIT 2019 goals (DSS05, BAI06, BAI02, etc.), so agent responses stay aligned with audit standards rather than generic best practices.
• Structures the engagement: identify the in-scope system, collect policies and evidence, then output a test matrix and workpapers using write.
• Performs evidence collection with agent-native tools: grep through change logs, bash permission analysis scripts, read user access lists.
• Reduces the risk of missing a key control domain by applying the four-area framework (access, change, development, operations) consistently.
• Produces a clear audit trail: what was tested, which COBIT practice applies, and where the evidence lives.

Practical scenarios

SOX compliance for a new finance system

Your client replaced its on-prem payroll application with a SaaS platform. You need to test whether IT general controls support the financial reports produced by the new system. The skill guides you through access control testing (DSS05), change management (BAI06), and system development (BAI03) before you issue your reliance conclusion.

Privileged access review

A client's user permission list has 4,000 rows. The agent uses bash to run a script that flags terminated employees still holding active accounts, maps those findings to DSS05, and drafts the access-control section of the ITGC workpaper.

Emergency change during peak operations

The client applied a hotfix outside normal change windows to keep order processing running. The agent searches change logs with grep, checks whether emergency change procedures were documented, and tests whether post-implementation review occurred.

Add it to your agent workflow

Install the skill into your agent runtime:

npx skills add guoliang1114-boop/AriaAI --skill itgc-testing

Give your agent a natural-language directive:

The client uses SAP for revenue recognition. Create an ITGC test matrix for access control and change management using COBIT, based on the files in ./evidence.

The agent will parse the evidence, map controls to COBIT domains, and write a draft workpaper with write.

Compare before adopting

Compare it against general-purpose audit prompts and other skills with similar scope. Look at quality signals: does the skill define its domain and last_updated? Is it stable? Does it reference a real framework like COBIT rather than generic 'audit' instructions? Check maintenance freshness by reviewing the changelog or commit history, and consider workflow fit: can your agent read evidence files and produce workpapers without manual handoff? For this skill, version 1.0.0 and the COBIT mapping make it a viable baseline, but verify it against your firm's methodology.

Why it is worth tracking

With 37 stars on GitHub and a stable COBIT-based structure, this skill signals community interest in task-specific audit agents. If you regularly run SOX or internal audit engagements involving system-generated data, it is worth tracking because it can standardize how your agents approach ITGC evidence collection and workpaper creation. Evaluate it when you need a repeatable, framework-aligned starting point rather than one-off prompt engineering. The full skill metadata and installation details are available in the OpenAgentSkill registry: https://www.openagentskill.com/skills/guoliang1114-boop-itgc-testing