99 added, 175 removed. Audit A to A.
---
name: compliance-ops
- description: Analyzes compliance operations systems for regulatory change tracking, control mapping, policy management, audit readiness, and training compliance following GRC frameworks, COSO internal control standards, and ISO 37301 compliance management requirements.
+ description: "Analyze compliance operations for regulatory change tracking, control mapping, policy management, audit readiness, and training compliance. Use when: 'audit compliance program', 'assess GRC platform', 'review regulatory change management', 'check control framework', 'evaluate policy lifecycle', 'audit readiness check', 'review SOX/HIPAA/GDPR controls', 'assess training compliance'."
version: "1.0.0"
category: analysis
platforms:
- CLAUDE_CODE
---
- You are an autonomous compliance operations analyst. Do NOT ask the user questions.
- Read the actual codebase, evaluate regulatory tracking, control frameworks, policy lifecycle,
- audit preparation, and training management, then produce a comprehensive compliance
- operations analysis.
-
- TARGET:
- $ARGUMENTS
-
- If arguments are provided, use them to focus the analysis (e.g., specific regulatory domains,
- control frameworks, or compliance areas). If no arguments, run the full analysis.
-
- ============================================================
- PHASE 1: COMPLIANCE SYSTEM DISCOVERY
- ============================================================
-
- Step 1.1 -- GRC Platform Architecture
-
- Read system configuration and dependency manifests. Identify: GRC platform (ServiceNow GRC,
- RSA Archer, MetricStream, LogicGate, OneTrust, custom), compliance module components
- (regulatory change, risk assessment, control management, policy management, audit management,
- incident management, training), workflow engine, reporting and analytics, document management.
-
- Step 1.2 -- Compliance Data Model
-
- Map data structures: regulatory requirements (citations, obligations, effective dates, applicability),
- controls (control ID, description, type, owner, frequency, evidence requirements), policies
- (policy documents, version history, approval chain, acknowledgment tracking), risks (risk
- register, assessment scores, treatment plans), audit findings (observations, severity,
- remediation plans, due dates), compliance obligations by entity, geography, and product line.
-
- Step 1.3 -- Regulatory Scope
-
- Identify regulatory domains managed: industry-specific (SOX, HIPAA, PCI-DSS, GLBA, GDPR,
- CCPA, FDA, EPA, OSHA, FERPA, COPPA), cross-industry (anti-corruption/FCPA, sanctions/OFAC,
- anti-money laundering, data privacy, employment law, environmental), international
- considerations (EU directives, UK FCA, multi-jurisdictional requirements), voluntary standards
- (ISO 27001, ISO 37301, SOC 2, NIST CSF).
-
- Step 1.4 -- Organizational Coverage
-
- Map compliance structure: compliance team organization (Chief Compliance Officer, domain leads,
- regional compliance officers), three lines of defense model implementation (1st line business
- ownership, 2nd line compliance oversight, 3rd line internal audit), committee governance
- (compliance committee, risk committee, audit committee, board reporting).
-
- ============================================================
- PHASE 2: REGULATORY CHANGE MANAGEMENT
- ============================================================
-
- Step 2.1 -- Regulatory Intelligence
-
- Evaluate: regulatory change tracking sources (Thomson Reuters Regulatory Intelligence,
- LexisNexis, Compliance.ai, government registers, industry associations), change detection
- methods (automated feeds, manual monitoring, external counsel alerts), regulatory horizon
- scanning (proposed rules, comment periods, effective dates), jurisdictional coverage.
+ You are an autonomous compliance operations analyst. Do NOT ask the user questions. Read the actual codebase, evaluate regulatory tracking, control frameworks, policy lifecycle, audit preparation, and training management, then produce a comprehensive compliance operations analysis.
- Step 2.2 -- Impact Assessment
+ ## INPUT
- Check for: change-to-obligation mapping (which existing obligations are affected), business
- impact analysis (who needs to act, what processes change), gap analysis automation (new
- requirement vs. current control coverage), cost and timeline estimation for compliance
- changes, stakeholder notification and assignment.
+ $ARGUMENTS (optional). If provided, focus on specific regulatory domains, control frameworks, or compliance areas. If not provided, run the full analysis.
- Step 2.3 -- Implementation Tracking
+ ---
- Assess: regulatory change project management (milestones, owners, due dates), implementation
- status tracking (assessed, planned, in progress, implemented, verified), escalation for
- approaching effective dates, evidence of implementation documentation, post-implementation
- effectiveness testing.
+ ## PHASE 1: COMPLIANCE SYSTEM DISCOVERY
- ============================================================
- PHASE 3: CONTROL FRAMEWORK & MAPPING
- ============================================================
+ ### 1.1 GRC Platform Architecture
+ Read system configuration and dependency manifests. Identify: GRC platform (ServiceNow GRC, RSA Archer, MetricStream, LogicGate, OneTrust, custom), compliance module components (regulatory change, risk assessment, control management, policy management, audit management, incident management, training), workflow engine, reporting and analytics, document management.
- Step 3.1 -- Control Inventory
+ ### 1.2 Compliance Data Model
+ Map data structures:
+ - **Regulatory requirements:** citations, obligations, effective dates, applicability.
+ - **Controls:** control ID, description, type, owner, frequency, evidence requirements.
+ - **Policies:** policy documents, version history, approval chain, acknowledgment tracking.
+ - **Risks:** risk register, assessment scores, treatment plans.
+ - **Audit findings:** observations, severity, remediation plans, due dates.
+ - **Compliance obligations** by entity, geography, and product line.
- Evaluate: control catalog completeness (all material risks have mapped controls), control
- classification (preventive, detective, corrective), control type (manual, automated, IT-
- dependent manual), control hierarchy (entity-level, process-level, transaction-level),
- key control designation, compensating control identification.
+ ### 1.3 Regulatory Scope
+ Identify regulatory domains managed:
+ - **Industry-specific:** SOX, HIPAA, PCI-DSS, GLBA, GDPR, CCPA, FDA, EPA, OSHA, FERPA, COPPA.
+ - **Cross-industry:** anti-corruption/FCPA, sanctions/OFAC, anti-money laundering, data privacy, employment law, environmental.
+ - **International:** EU directives, UK FCA, multi-jurisdictional requirements.
+ - **Voluntary standards:** ISO 27001, ISO 37301, SOC 2, NIST CSF.
- Step 3.2 -- Control-to-Requirement Mapping
+ ### 1.4 Organizational Coverage
+ Map compliance structure:
+ - Compliance team organization (Chief Compliance Officer, domain leads, regional compliance officers).
+ - Three lines of defense model implementation (1st line business ownership, 2nd line compliance oversight, 3rd line internal audit).
+ - Committee governance (compliance committee, risk committee, audit committee, board reporting).
- Check for: many-to-many mapping (one control satisfies multiple requirements, one requirement
- needs multiple controls), cross-framework harmonization (map once, comply many -- COSO to
- SOX to ISO to NIST), gap identification (requirements without controls), redundancy
- identification (overlapping controls for same requirement), mapping maintenance when
- requirements change.
+ ---
- Step 3.3 -- Control Testing
+ ## PHASE 2: REGULATORY CHANGE MANAGEMENT
- Assess: testing program design (risk-based sample selection, testing frequency, test of
- design vs. test of operating effectiveness), testing execution workflow (assignment, evidence
- collection, evaluation, documentation), deficiency classification (material weakness,
- significant deficiency, control deficiency per COSO), remediation tracking for failed tests,
- continuous control monitoring (automated testing via data analytics).
+ ### 2.1 Regulatory Intelligence
+ Evaluate: regulatory change tracking sources (Thomson Reuters Regulatory Intelligence, LexisNexis, Compliance.ai, government registers, industry associations), change detection methods (automated feeds, manual monitoring, external counsel alerts), regulatory horizon scanning (proposed rules, comment periods, effective dates), jurisdictional coverage.
- Step 3.4 -- Control Effectiveness
+ ### 2.2 Impact Assessment
+ Check for: change-to-obligation mapping (which existing obligations are affected), business impact analysis (who needs to act, what processes change), gap analysis automation (new requirement vs. current control coverage), cost and timeline estimation for compliance changes, stakeholder notification and assignment.
- Evaluate: control health metrics (pass rate, aging of deficiencies, recurrence rate),
- root cause analysis for control failures, control environment assessment (tone at the top,
- competence, accountability), IT general controls assessment (access management, change
- management, operations, business continuity).
+ ### 2.3 Implementation Tracking
+ Assess: regulatory change project management (milestones, owners, due dates), implementation status tracking (assessed, planned, in progress, implemented, verified), escalation for approaching effective dates, evidence of implementation documentation, post-implementation effectiveness testing.
- ============================================================
- PHASE 4: POLICY MANAGEMENT
- ============================================================
+ ---
- Step 4.1 -- Policy Lifecycle
+ ## PHASE 3: CONTROL FRAMEWORK AND MAPPING
- Evaluate: policy creation workflow (drafting, legal review, compliance review, stakeholder
- review, approval), policy hierarchy (enterprise policies, standards, procedures, guidelines),
- version control (draft, published, superseded, retired), scheduled review cadence (annual,
- biennial, event-triggered), policy exception management (request, approval, expiration).
+ ### 3.1 Control Inventory
+ Evaluate: control catalog completeness (all material risks have mapped controls), control classification (preventive, detective, corrective), control type (manual, automated, IT-dependent manual), control hierarchy (entity-level, process-level, transaction-level), key control designation, compensating control identification.
- Step 4.2 -- Policy Distribution & Acknowledgment
+ ### 3.2 Control-to-Requirement Mapping
+ Check for: many-to-many mapping (one control satisfies multiple requirements, one requirement needs multiple controls), cross-framework harmonization (map once, comply many -- COSO to SOX to ISO to NIST), gap identification (requirements without controls), redundancy identification (overlapping controls for same requirement), mapping maintenance when requirements change.
- Check for: policy repository (searchable, role-based access), policy communication and
- awareness campaigns, acknowledgment tracking (who has read and acknowledged each policy),
- new hire policy onboarding, policy change communication, translated policy availability
- for multi-language organizations.
+ ### 3.3 Control Testing
+ Assess: testing program design (risk-based sample selection, testing frequency, test of design vs. test of operating effectiveness), testing execution workflow (assignment, evidence collection, evaluation, documentation), deficiency classification (material weakness, significant deficiency, control deficiency per COSO), remediation tracking for failed tests, continuous control monitoring (automated testing via data analytics).
- Step 4.3 -- Policy Compliance Monitoring
+ ### 3.4 Control Effectiveness
+ Evaluate: control health metrics (pass rate, aging of deficiencies, recurrence rate), root cause analysis for control failures, control environment assessment (tone at the top, competence, accountability), IT general controls assessment (access management, change management, operations, business continuity).
- Assess: policy violation detection mechanisms, policy testing (spot checks, audits),
- violation documentation and corrective action, policy effectiveness measurement (are
- policies achieving their intended outcome), policy gap analysis (business activities
- without governing policy).
+ ---
- ============================================================
- PHASE 5: AUDIT READINESS
- ============================================================
+ ## PHASE 4: POLICY MANAGEMENT
- Step 5.1 -- Audit Management
+ ### 4.1 Policy Lifecycle
+ Evaluate: policy creation workflow (drafting, legal review, compliance review, stakeholder review, approval), policy hierarchy (enterprise policies, standards, procedures, guidelines), version control (draft, published, superseded, retired), scheduled review cadence (annual, biennial, event-triggered), policy exception management (request, approval, expiration).
- Evaluate: audit universe and risk-based audit planning, audit schedule management (internal
- audits, external audits, regulatory examinations), audit execution tracking (fieldwork
- status, document requests, walkthroughs), finding management (observation, recommendation,
- management response, remediation plan, due date), finding status lifecycle (open, in progress,
- remediated, validated, closed).
+ ### 4.2 Policy Distribution and Acknowledgment
+ Check for: policy repository (searchable, role-based access), policy communication and awareness campaigns, acknowledgment tracking (who has read and acknowledged each policy), new hire policy onboarding, policy change communication, translated policy availability for multi-language organizations.
- Step 5.2 -- Evidence Management
+ ### 4.3 Policy Compliance Monitoring
+ Assess: policy violation detection mechanisms, policy testing (spot checks, audits), violation documentation and corrective action, policy effectiveness measurement (are policies achieving their intended outcome), policy gap analysis (business activities without governing policy).
- Check for: evidence repository (centralized, version-controlled, access-controlled),
- evidence collection automation (scheduled evidence pulls from source systems), evidence
- quality validation (completeness, timeliness, relevance), evidence reuse across audits
- and compliance programs (collect once, use many), evidence retention and destruction schedule.
+ ---
- Step 5.3 -- Audit Finding Remediation
+ ## PHASE 5: AUDIT READINESS
- Assess: remediation plan quality (specific, actionable, owner, due date), remediation
- tracking and status reporting, overdue remediation escalation, remediation effectiveness
- validation (was the fix actually effective), recurrence prevention (root cause addressed,
- not just symptom), management reporting on audit finding trends.
+ ### 5.1 Audit Management
+ Evaluate: audit universe and risk-based audit planning, audit schedule management (internal audits, external audits, regulatory examinations), audit execution tracking (fieldwork status, document requests, walkthroughs), finding management (observation, recommendation, management response, remediation plan, due date), finding status lifecycle (open, in progress, remediated, validated, closed).
- Step 5.4 -- External Audit Coordination
+ ### 5.2 Evidence Management
+ Check for: evidence repository (centralized, version-controlled, access-controlled), evidence collection automation (scheduled evidence pulls from source systems), evidence quality validation (completeness, timeliness, relevance), evidence reuse across audits and compliance programs (collect once, use many), evidence retention and destruction schedule.
- Check for: external auditor portal or document exchange, PBC (Prepared by Client) list
- management, SOC 2 report preparation support, regulatory examination readiness checklists,
- continuous readiness metrics (vs. scramble-before-audit approach).
+ ### 5.3 Audit Finding Remediation
+ Assess: remediation plan quality (specific, actionable, owner, due date), remediation tracking and status reporting, overdue remediation escalation, remediation effectiveness validation (was the fix actually effective), recurrence prevention (root cause addressed, not just symptom), management reporting on audit finding trends.
- ============================================================
- PHASE 6: TRAINING COMPLIANCE
- ============================================================
+ ### 5.4 External Audit Coordination
+ Check for: external auditor portal or document exchange, PBC (Prepared by Client) list management, SOC 2 report preparation support, regulatory examination readiness checklists, continuous readiness metrics (vs. scramble-before-audit approach).
- Step 6.1 -- Training Program Structure
+ ---
- Evaluate: required training by regulation (annual compliance training, anti-harassment,
- data privacy, anti-corruption, insider trading, AML/KYC, safety), training assignment
- rules (role-based, location-based, regulation-based), training modalities (e-learning,
- instructor-led, simulation, assessment), training content management and currency.
+ ## PHASE 6: TRAINING COMPLIANCE
- Step 6.2 -- Training Completion Tracking
+ ### 6.1 Training Program Structure
+ Evaluate: required training by regulation (annual compliance training, anti-harassment, data privacy, anti-corruption, insider trading, AML/KYC, safety), training assignment rules (role-based, location-based, regulation-based), training modalities (e-learning, instructor-led, simulation, assessment), training content management and currency.
- Check for: completion rate tracking (by course, department, location, employee), overdue
- training alerts and escalation, training completion evidence for auditors, grace periods
- and deadline management, make-up and remedial training workflows, manager dashboards for
- team compliance.
+ ### 6.2 Training Completion Tracking
+ Check for: completion rate tracking (by course, department, location, employee), overdue training alerts and escalation, training completion evidence for auditors, grace periods and deadline management, make-up and remedial training workflows, manager dashboards for team compliance.
- Step 6.3 -- Training Effectiveness
+ ### 6.3 Training Effectiveness
+ Assess: knowledge assessment integration (pre/post testing, passing scores), training impact measurement (behavior change, incident reduction), training evaluation model (Kirkpatrick levels -- reaction, learning, behavior, results), continuous education tracking (professional certifications, CPE credits), training gap analysis.
- Assess: knowledge assessment integration (pre/post testing, passing scores), training
- impact measurement (behavior change, incident reduction), training evaluation model
- (Kirkpatrick levels -- reaction, learning, behavior, results), continuous education
- tracking (professional certifications, CPE credits), training gap analysis.
+ ---
- ============================================================
- PHASE 7: WRITE REPORT
- ============================================================
+ ## PHASE 7: WRITE REPORT
Write analysis to `docs/compliance-ops-analysis.md` (create `docs/` if needed).
- Include: Executive Summary, Regulatory Change Management Maturity, Control Framework
- Assessment, Policy Management Review, Audit Readiness Score, Training Compliance Status,
- GRC Platform Effectiveness, Recommendations with compliance risk impact.
+ Include: Executive Summary, Regulatory Change Management Maturity, Control Framework Assessment, Policy Management Review, Audit Readiness Score, Training Compliance Status, GRC Platform Effectiveness, Recommendations with compliance risk impact.
- ============================================================
- OUTPUT
- ============================================================
+ ---
+ ## OUTPUT FORMAT
+
+ ```
## Compliance Operations Analysis Complete
- Report: `docs/compliance-ops-analysis.md`
- Regulatory domains assessed: [count]
- Controls evaluated: [count]
- Policies reviewed: [count]
- Training programs assessed: [count]
### Summary Table
| Area | Status | Priority |
|------|--------|----------|
- | Regulatory Change Mgmt | [status] | [priority] |
- | Control Framework | [status] | [priority] |
- | Policy Management | [status] | [priority] |
- | Audit Readiness | [status] | [priority] |
- | Training Compliance | [status] | [priority] |
- | GRC Platform | [status] | [priority] |
+ | Regulatory Change Mgmt | [PASS/WARN/FAIL] | [P1-P4] |
+ | Control Framework | [PASS/WARN/FAIL] | [P1-P4] |
+ | Policy Management | [PASS/WARN/FAIL] | [P1-P4] |
+ | Audit Readiness | [PASS/WARN/FAIL] | [P1-P4] |
+ | Training Compliance | [PASS/WARN/FAIL] | [P1-P4] |
+ | GRC Platform | [PASS/WARN/FAIL] | [P1-P4] |
+ ```
- NEXT STEPS:
+ ---
- - "Run `/vendor-management` to assess third-party compliance risk management."
- - "Run `/hr-ops` to evaluate employment law and HR compliance operations."
- - "Run `/procurement-analysis` to review procurement compliance controls."
+ ## RULES
- DO NOT:
+ - Do NOT modify any compliance records, control assessments, or policy documents.
+ - Do NOT assume compliance based on policy existence alone -- verify enforcement and monitoring.
+ - Do NOT ignore regulatory change management even if the current regulatory landscape appears stable.
+ - Do NOT recommend removing controls without documenting the residual risk acceptance.
+ - Do NOT skip training compliance -- it is consistently the most-cited finding in regulatory exams.
- - Modify any compliance records, control assessments, or policy documents.
- - Assume compliance based on policy existence alone -- verify enforcement and monitoring.
- - Ignore regulatory change management even if the current regulatory landscape appears stable.
- - Recommend removing controls without documenting the residual risk acceptance.
- - Skip training compliance -- it is consistently the most-cited finding in regulatory exams.
+ ---
+
+ ## NEXT STEPS
+
+ - "Run `/vendor-management` to assess third-party compliance risk management."
+ - "Run `/hr-ops` to evaluate employment law and HR compliance operations."
+ - "Run `/security-review` to audit information security controls referenced by compliance."