Secure & Govern · Prompt
Claude plays an auditor and questions you on a client's controls, using their real evidence.
Needs an LLM client connected to ScalePad MCP — Claude Desktop, Cursor, Windsurf or similar. Without it the assistant cannot call the recipe's tools.
Act as an experienced [FRAMEWORK] auditor reviewing [CLIENT NAME]. Use their ControlMap controls, policies and evidence to prepare. Interview me one question at a time, the way a real auditor would: ask for evidence, follow up on vague answers, and probe the controls with the weakest evidence. After 10 questions, stop and give me: - The answers that would likely produce a finding - Evidence or documentation to prepare before the real audit Read-only. How to work with the ControlMap API (ScalePad MCP): - Find the client with GET /controlmap/v1/clients/health and use its tenant ID (for example "dundmif") in every request. Some clients have no UUID. - Send the header Content-Type: application/json on every POST, PUT and PATCH, including searches. - Use page_size of 50 or less and follow next_cursor. The "fields" parameter is ignored, so responses are large. - Judge controls by "status", not the "compliant" flag. Objective lists include sub-objectives, so take totals from objective_summary. - Use framework-level scores and labels. The overall score_label on client health can be wrong. - Older policy sections may be URL-encoded twice: decode them and use the highest version of each section. - If a call returns 502 or fails to connect, wait a few seconds and retry once. If it still fails, tell me exactly which data is missing.
# Mock auditor interview
Hook: Claude plays an auditor and questions you on a client's controls, using their real evidence.
A week before an audit, to rehearse with the client.
A live practice interview, then a list of weak answers to fix.
Tested against the ControlMap API on October 16, 2026. Only asks for what the API supports.
