/compliance-audit

Purpose

/compliance-audit produces a control-level compliance-readiness gap assessment of an organization, business unit, product, or specific initiative against a named regulatory framework. For each control in the framework's catalog, it maps the control to the org's processes and systems, assesses what is in place versus what the control requires, identifies evidence available versus missing, and produces a prioritized remediation roadmap plus an evidence inventory. It is a drafting and triage aid, not a certification opinion, not an attestation, not a formal audit report, and not legal advice.

What it IS: an analytical ground-truth pass that names which controls a framework requires, maps them to the org's actual processes, and surfaces the gaps between "what the framework expects" and "what the org has in place today" — framed as gaps to verify and remediate, never as conclusions about compliance status.

What it is NOT: a certification audit, an attestation report, a replacement for a licensed auditor (CPA firm for SOC 2, accredited registrar for ISO 27001, QSA for PCI DSS), a legal opinion on regulatory exposure, or a pass/fail grade. Every finding is a hypothesis grounded in specific source documents and a specific control requirement, for a human (Compliance Officer + domain counsel + external auditor when relevant) to verify.

The skill is parameterized by --framework. The core method — scope → control mapping → gap analysis → remediation roadmap → evidence inventory — is identical across frameworks. Only the control catalog changes. This is a design choice, not a limitation: adding a framework should be a data update (a new adapter in the compliance-frameworks knowledge pack), not a skill rewrite.

When to Use

Invoke /compliance-audit when you need to: