compliance-audit

What this skill does

# Compliance Audit

Systematic regulatory compliance auditing with automated evidence collection, control mapping,
gap analysis, and remediation planning across major compliance frameworks.

## When to Use This Skill

- Conducting compliance assessments for GDPR, HIPAA, PCI DSS, SOC 2, or ISO 27001
- Preparing for external audits or certifications
- Building or validating compliance control frameworks
- Automating evidence collection and audit trail maintenance
- Performing gap analysis against regulatory requirements
- Creating remediation plans for compliance deficiencies
- Evaluating third-party vendor compliance posture

## Quick Reference

| Resource | Purpose | Load when |
|----------|---------|-----------|
| `references/frameworks.md` | Key requirements, control mappings, and certification paths for GDPR, HIPAA, PCI DSS, SOC 2, ISO 27001 | Scoping which regulations apply |
| `references/evidence-collection.md` | Automated evidence gathering, artifact organization, retention policies, audit trail patterns | Setting up or running evidence collection |
| `references/gap-analysis.md` | Control mapping methodology, gap identification, risk scoring, remediation planning | Analyzing compliance gaps |

---

## Workflow Overview

```
Phase 1: Scope       → Identify applicable regulations, data types, and geographical scope
Phase 2: Assess      → Map controls, review policies, analyze data flows, test implementations
Phase 3: Evidence    → Collect and organize audit artifacts automatically
Phase 4: Gap Analyze → Identify control gaps, score risks, prioritize findings
Phase 5: Remediate   → Create remediation plans, assign owners, set timelines
Phase 6: Report      → Generate audit-ready documentation and compliance dashboards
Phase 7: Monitor     → Establish continuous compliance monitoring and drift detection
```

---

## Phase 1: Scope the Audit

Determine the regulatory landscape before testing anything.

**Key questions:**
- What data types does the system process (PII, PHI, cardholder data)?
- What jurisdictions apply (EU, US states, industry-specific)?
- What existing controls and certifications are in place?
- What is the audit history and any prior findings?

**Applicability matrix:**

| Framework | Applies when |
|-----------|-------------|
| GDPR | Processing personal data of EU residents |
| HIPAA | Handling protected health information (PHI) |
| PCI DSS | Storing, processing, or transmitting cardholder data |
| SOC 2 | Providing services where trust principles matter |
| ISO 27001 | Organization wants certified ISMS |
| CCPA/CPRA | Collecting California consumer personal information |
| NIST CSF | Federal systems or voluntary cybersecurity framework adoption |

---

## Phase 2: Assess Current State

### Control Inventory

Map existing controls against the applicable framework requirements:

1. Enumerate all technical controls (encryption, access control, logging)
2. Enumerate all administrative controls (policies, training, procedures)
3. Enumerate all physical controls (facility access, media handling)
4. Map each control to specific framework requirements
5. Test control effectiveness through sampling and verification

### Data Flow Analysis

- Map data ingress, processing, storage, and egress points
- Identify data classification for each flow
- Document lawful basis for processing (GDPR)
- Verify data minimization and purpose limitation
- Review cross-border transfer mechanisms

### Policy Review

- Assess policy coverage against framework requirements
- Verify policy distribution and acknowledgment
- Check policy version control and update cadence
- Validate exception management processes

---

## Phase 3: Evidence Collection

Load `references/evidence-collection.md` for detailed patterns.

**Automation priorities:**
1. Configuration exports from cloud providers and infrastructure
2. Access control lists and permission matrices
3. Log retention and monitoring dashboards
4. Vulnerability scan results and patch status
5. Training completion records
6. Incident response test results

**Artifact organization:**

```
evidence/
  {framework}/
    {control-id}/
      artifact-{date}.{ext}
      metadata.yaml           # source, collection method, timestamp
```

---

## Phase 4: Gap Analysis

Load `references/gap-analysis.md` for the full methodology.

For each framework requirement:
1. Map to existing controls (full, partial, or none)
2. Assess implementation effectiveness
3. Score the gap by risk impact and likelihood
4. Categorize as documentation, process, technology, or training gap
5. Prioritize based on risk score and remediation effort

---

## Phase 5: Remediation Planning

For each identified gap:

| Field | Content |
|-------|---------|
| Gap ID | Unique identifier |
| Framework Requirement | Specific clause or control |
| Current State | What exists today |
| Target State | What compliance requires |
| Remediation Action | Specific steps to close the gap |
| Owner | Responsible person/team |
| Priority | P0-P4 based on risk score |
| Timeline | Target completion date |
| Dependencies | Other gaps or actions this depends on |

---

## Phase 6: Reporting

Generate audit-ready documentation:

- **Executive summary**: Compliance posture, key risks, readiness score
- **Technical findings**: Detailed control assessment results
- **Risk matrix**: Heat map of gaps by severity and likelihood
- **Remediation roadmap**: Prioritized timeline with owners
- **Evidence package**: Organized artifacts indexed to controls
- **Compliance attestation**: Framework-specific certification readiness

---

## Phase 7: Continuous Monitoring

Establish ongoing compliance posture management:

- Configure automated scanning for drift detection
- Set alert thresholds for control degradation
- Schedule periodic re-assessment cadence
- Track remediation progress against timelines
- Maintain metric dashboards (control coverage, evidence freshness, audit readiness)

---

## Core Principles

1. **Evidence over assertion** — every compliance claim must be backed by verifiable artifacts
2. **Automate first** — manual evidence collection does not scale and introduces errors
3. **Risk-based prioritization** — address the highest-risk gaps first
4. **Continuous posture** — compliance is a state, not a one-time event
5. **Defense in depth** — layer controls so single-point failures do not cause non-compliance

## Anti-Patterns

- Treating compliance as a checkbox exercise without testing control effectiveness
- Collecting evidence manually when automation is available
- Ignoring gaps because "we've always done it this way"
- Waiting until audit season to gather evidence
- Conflating compliance with security (compliance is a subset)
- Skipping third-party/vendor compliance assessments