Compliance Audit

When to Use This Skill

• Conducting compliance assessments for GDPR, HIPAA, PCI DSS, SOC 2, or ISO 27001
• Preparing for external audits or certifications
• Building or validating compliance control frameworks
• Automating evidence collection and audit trail maintenance
• Performing gap analysis against regulatory requirements
• Creating remediation plans for compliance deficiencies
• Evaluating third-party vendor compliance posture

Quick Reference

references/frameworks.md

references/evidence-collection.md

references/gap-analysis.md

Workflow Overview

Phase 1: Scope       → Identify applicable regulations, data types, and geographical scope
Phase 2: Assess      → Map controls, review policies, analyze data flows, test implementations
Phase 3: Evidence    → Collect and organize audit artifacts automatically
Phase 4: Gap Analyze → Identify control gaps, score risks, prioritize findings
Phase 5: Remediate   → Create remediation plans, assign owners, set timelines
Phase 6: Report      → Generate audit-ready documentation and compliance dashboards
Phase 7: Monitor     → Establish continuous compliance monitoring and drift detection

Phase 1: Scope the Audit

• What data types does the system process (PII, PHI, cardholder data)?
• What jurisdictions apply (EU, US states, industry-specific)?
• What existing controls and certifications are in place?
• What is the audit history and any prior findings?

Phase 2: Assess Current State

Control Inventory

1. Enumerate all technical controls (encryption, access control, logging)
2. Enumerate all administrative controls (policies, training, procedures)
3. Enumerate all physical controls (facility access, media handling)
4. Map each control to specific framework requirements
5. Test control effectiveness through sampling and verification

Data Flow Analysis

• Map data ingress, processing, storage, and egress points
• Identify data classification for each flow
• Document lawful basis for processing (GDPR)
• Verify data minimization and purpose limitation
• Review cross-border transfer mechanisms

Policy Review

• Assess policy coverage against framework requirements
• Verify policy distribution and acknowledgment
• Check policy version control and update cadence
• Validate exception management processes

Phase 3: Evidence Collection

references/evidence-collection.md

1. Configuration exports from cloud providers and infrastructure
2. Access control lists and permission matrices
3. Log retention and monitoring dashboards
4. Vulnerability scan results and patch status
5. Training completion records
6. Incident response test results

evidence/
  {framework}/
    {control-id}/
      artifact-{date}.{ext}
      metadata.yaml           # source, collection method, timestamp

Phase 4: Gap Analysis

references/gap-analysis.md

1. Map to existing controls (full, partial, or none)
2. Assess implementation effectiveness
3. Score the gap by risk impact and likelihood
4. Categorize as documentation, process, technology, or training gap
5. Prioritize based on risk score and remediation effort

Phase 5: Remediation Planning

Phase 6: Reporting

• Executive summary: Compliance posture, key risks, readiness score
• Technical findings: Detailed control assessment results
• Risk matrix: Heat map of gaps by severity and likelihood
• Remediation roadmap: Prioritized timeline with owners
• Evidence package: Organized artifacts indexed to controls
• Compliance attestation: Framework-specific certification readiness

Phase 7: Continuous Monitoring

• Configure automated scanning for drift detection
• Set alert thresholds for control degradation
• Schedule periodic re-assessment cadence
• Track remediation progress against timelines
• Maintain metric dashboards (control coverage, evidence freshness, audit readiness)

Core Principles

1. Evidence over assertion — every compliance claim must be backed by verifiable artifacts
2. Automate first — manual evidence collection does not scale and introduces errors
3. Risk-based prioritization — address the highest-risk gaps first
4. Continuous posture — compliance is a state, not a one-time event
5. Defense in depth — layer controls so single-point failures do not cause non-compliance

Anti-Patterns

• Treating compliance as a checkbox exercise without testing control effectiveness
• Collecting evidence manually when automation is available
• Ignoring gaps because "we've always done it this way"
• Waiting until audit season to gather evidence
• Conflating compliance with security (compliance is a subset)
• Skipping third-party/vendor compliance assessments