All recipes

Secure & Govern · Prompt

Audit readiness pack

A control-by-control readiness checklist with evidence and owners, ready for an auditor walkthrough.

ControlMap
Requires MCPby Greg Brydon · Solutions Engineer

Needs an LLM client connected to ScalePad MCP — Claude Desktop, Cursor, Windsurf or similar. Without it the assistant cannot call the recipe's tools.

User prompt

3 inputs to fill
Prepare an audit readiness pack for [CLIENT NAME] against [FRAMEWORK] using ControlMap.

For every control show: ID and title, status, mapped policies, mapped evidence with last-updated dates, owner, and a verdict:
- Ready: implemented, current evidence, policy in place
- At risk: evidence older than [DAYS] days, or partial
- Not ready: missing evidence or policy

Build it as an artifact filterable by verdict and domain, with an overall readiness % and the 10 fastest fixes.

How to work with the ControlMap API (ScalePad MCP):
- Find the client with GET /controlmap/v1/clients/health and use its tenant ID (for example "dundmif") in every request. Some clients have no UUID.
- Send the header Content-Type: application/json on every POST, PUT and PATCH, including searches.
- Use page_size of 50 or less and follow next_cursor. The "fields" parameter is ignored, so responses are large.
- Judge controls by "status", not the "compliant" flag. Objective lists include sub-objectives, so take totals from objective_summary.
- Use framework-level scores and labels. The overall score_label on client health can be wrong.
- Older policy sections may be URL-encoded twice: decode them and use the highest version of each section.
- If a call returns 502 or fails to connect, wait a few seconds and retry once. If it still fails, tell me exactly which data is missing.

# Audit readiness pack

Hook: A control-by-control readiness checklist with evidence and owners, ready for an auditor walkthrough.

When to use it

Preparing for an external audit.

What you get

A filterable checklist marking each control ready, at risk or not ready.

Fill in the details

  • [CLIENT NAME]: Client name (e.g. Acme Dental)
  • [FRAMEWORK]: Framework (e.g. CIS Controls v8.1)
  • [DAYS]: Age limit in days (e.g. 90)

Status

Tested against the ControlMap API on October 16, 2026. Only asks for what the API supports.

GBAuthorGreg BrydonSolutions Engineer · ScalePad

Recipes are starting points. Adapt them to your environment and validate the output before putting one into practice.

Request a recipe

More in Secure & Govern