Internal Controls and Risk Framework

A consulting-deliverable skill: it produces a standalone organisational document — an Internal Control & Risk Management Framework — not a business-plan section. It owns the document's structure, the consulting workflow, the control and risk parameterisation, and the East African regulatory framing — and it pulls every control design, fraud test, and risk-treatment substance from the finance engine at chwezi-accounting-doctrine.

Use When

• A client needs an Internal Control & Risk Management Framework, Internal Control Policy, segregation-of-duties / authorisation framework, ICFR documentation pack (process narratives, risk-control matrices, walkthroughs), fraud-risk / anti-fraud policy, whistleblowing policy, or an enterprise risk register and risk-management policy.
• Responding to an RFP/EOI for "development of an internal control and risk management framework / risk register."
• Reviewing, gap-auditing, or maturing an existing control environment against COSO ERM / ISO 31000 and the entity's actual cycles.

Do Not Use When

• Writing the internal-control chapter inside a finance manual — use advisory-deliverables/finance-policy-and-manual (controls are one chapter there; this skill is the full standalone framework).
• Producing a standalone procurement manual — use advisory-deliverables/procurement-policy-and-manual.
• Writing a business-plan risk section — use pipeline/12-risk-analysis.
• Answering a single control-design or fraud-test question — go straight to the relevant finance-engine SKILL.md.

Required Inputs