compliance-audit-readiness-review

Compliance Audit Readiness Review

Use this skill to convert compliance audit readiness, controls, evidence, sampling, auditor request, exception, and remediation questions into a concrete artifact with owners, gates, metrics, and recovery paths.

Workflow

1. Identify audit framework, scope, period, systems, controls, control owners, evidence sources, auditor timeline, gaps, customer commitments, and trust-center dependencies.
2. Read references/compliance-audit-readiness-patterns.md.
3. Classify work as audit scoping, control mapping, evidence collection, walkthrough prep, sample response, exception remediation, report review, or continuous compliance.
4. Define control matrix, evidence calendar, owner accountability, request workflow, sampling response, gap register, remediation SLA, claim approval, and renewal cadence.
5. Produce audit readiness plan, state machine, decision table, event schema, evidence checklist, and risk/escalation register.

When not to use

• Do not use for generic advice the base model already handles without this skill's specific artifact contract.

Guardrails

• Do not claim certifications, attestations, control operation, or compliance status without approved evidence and owner/legal review.
• Do not collect audit evidence ad hoc at deadline when controls should operate continuously.
• Do not alter evidence, logs, screenshots, tickets, or timestamps to satisfy an auditor request.
• Do not let customer promises, security questionnaires, trust center claims, and audit reports drift apart.

Output format

Audit readiness context:
Audience / source of truth / risk boundary:

Audit readiness plan:
| Area | Decision | Evidence | Risk | Owner |
| --- | --- | --- | --- | --- |

Controls, evidence, and remediation:
- <trigger> -> <policy, metric, edge case, support note>