Skip to content

Lesson 3 of 4

The human gate

Record the auditor's decisions and have the register revised to match.

Nothing goes further until an auditor approves the risks. The risk-assessor has already written outputs/auditor-comments.md, a blank decision row for every risk. You fill it in, and the risk-assessor applies your decisions.

In this guide you record decisions by telling Claude Code what they are. The file remains the record.

By the end of this lesson

outputs/auditor-comments.md holding your decisions, and a revised register that records what changed.

Steps

Step 4.1Open the decision template

The risk-assessor wrote outputs/auditor-comments.md alongside the register in step 3.7: one row per risk with its score and scope, and blank Decision and Comment cells.

A blank Decision means undecided, so the template alone changes nothing. Each time the register is rebuilt the template is rewritten to match it, and any decisions already recorded are kept.

PromptPaste into Claude Code
Show me outputs/auditor-comments.md next to the summary table of outputs/risk-register.md. Confirm there is one row for every risk in the register, and tell me how many decisions are still blank.

What to expect

  • Claude shows the two side by side: ten rows, ten blank decisions, matching the register.

What you should see after step 4.1

Illustration, not a screenshot. Your file names and counts may differ.
Step 4.2Record your decisions

These decisions are only an example. Replace them with your own after reading outputs/risk-register.md.

PromptExample: replace with your own decisions
Record my decisions in outputs/auditor-comments.md. Reviewer: <your name>. Date: today.
- R-01: approve.
- R-09: amend. Raise likelihood to 3: awards above £500,000 are rare but carry the highest stakes.
- R-10: reject. Grants will be covered by a separate review.
Leave every other risk blank for now.

What to expect

  • Claude fills in those rows and leaves the rest blank.

What you should see after step 4.2

Illustration, not a screenshot. Your file names and counts may differ.
Step 4.3Revise the register

Approved risks stay as they are. Amendments are applied and flagged. Rejections move to the excluded list with your reason.

The revision is checked, not just written. build_register.py reads your decisions and refuses to build if one was left unapplied, if a risk changed that you did not ask about, or if an approved risk has gone. The revision header and the closing decisions section come from the builder, never from the model's hand.

PromptPaste into Claude Code
Run the risk-assessor again. Apply the decisions in outputs/auditor-comments.md and mark the register as a revision.

What to expect

  • The register header says it is revision 1, dated from your comments, and lists R-09 (amended) and R-10 (rejected).
  • R-09 keeps the score you set, flagged as an auditor override, and its justification still carries a real citation.
  • R-10 sits in the excluded list with your reason, and the closing section lists all three decisions and how each was applied.

What you should see after step 4.3

Illustration, not a screenshot. Your file names and counts may differ.

What you have built so far

6 of 11 files

Rated risks, your decision on each one, and a revised register that records what changed. The next lesson hands the approved risks to an agent team that turns them into an audit program and checks it before you sign off.

  • ✓ builtThe briefCLAUDE.md
  • ✓ builtTestable rulesoutputs/rules.json
  • ✓ builtSpend indicatorsoutputs/analytics.json
  • ✓ builtAudit historyoutputs/history.json
  • ✓ builtRisk registeroutputs/risk-register.md
  • ✓ builtAuditor decisionsoutputs/auditor-comments.md
  • not yetPlanning memooutputs/planning-memo.md
  • not yetRisk-control matrixoutputs/risk-control-matrix.md
  • not yetAudit programoutputs/audit-program.md
  • not yetChallengesoutputs/challenges.md
  • not yetQA review and sign-offoutputs/review.md

What you have built

A system that turns a council's rulebook into testable rules, analyses the full spend population against them, folds in past audit history, and produces a rated risk register that an auditor approves.

Every quote is verified against its PDF. Every figure comes from a named script. Every rating cites a rule, a metric or an audit item.

Next, an agent team of a planner, a challenger and a QA reviewer turns the approved risks into a planning pack, argues over it, checks it, and brings it back for your sign-off.