Compliance Risk Assessment Framework
Identify and prioritize compliance risks with structured assessment frameworks
What You Can Do
You systematically identify, assess, and prioritize industry-specific compliance risks using proven frameworks and methodologies. Claude generates risk matrices, regulatory mappings, compliance gap analyses, and audit-ready documentation that aligns with regulatory requirements and stakeholder expectations. Each assessment is tailored to your industry, regulatory environment, and organizational risk appetite.
Features
Leverage pre-configured frameworks for financial services, healthcare, manufacturing, energy, and other regulated industries. Each framework includes jurisdiction-specific requirements and standard compliance obligations.
Generate probability-impact matrices, risk heatmaps, and scoring models that prioritize risks by severity. Customize likelihood scales, impact categories, and acceptance thresholds for your organization.
Map internal processes and controls to specific regulatory requirements (SOX, GDPR, HIPAA, ISO 27001, etc.). Identify gaps and coverage gaps automatically.
Document current-state vs. desired-state compliance posture. Identify specific control deficiencies, design gaps, and operating inefficiencies with remediation guidance.
Generate formal risk assessment reports, audit workpapers, and compliance certifications formatted for internal audit, external audit, and regulatory review.
Create prioritized remediation roadmaps with ownership assignments, timelines, resource requirements, and success metrics aligned to risk severity.
Design testing procedures, sample sizes, and evidence gathering strategies for key controls. Includes documentation of control objectives and testing outcomes.
Track compliance risk movement over time with metrics dashboards. Monitor remediation progress and identify emerging compliance exposures across your organization.
Example Output
Risk Assessment Matrix
| Risk Category | Identified Risk | Likelihood | Impact | Risk Score | Trend |
|---|---|---|---|---|---|
| Data Privacy | Unauthorized access to customer PII | Medium | High | 8/10 | ↑ |
| Financial Controls | Revenue recognition timing errors | Low | High | 6/10 | → |
| Regulatory Compliance | Incomplete audit documentation | Medium | Medium | 5/10 | ↓ |
Compliance Gap Summary
GDPR Data Processing
- Required: Documented Data Processing Agreements (DPAs) with all vendors
- Current State: 65% of vendors have signed DPAs
- Gap: 12 vendors missing DPA documentation
- Remediation: Legal review + vendor outreach by Q4 2026
Audit-Ready Documentation
Risk ID: FIN-2401 | Inadequate Expense Approval Controls
- Regulatory Requirement: SOX 404(b) — Effective internal controls over financial reporting
- Risk Description: Expense reports exceeding $5K lack documented management approval
- Testing Procedure: Select 30 expense reports >$5K; verify approval signature or email authorization
- Remediation Plan: Implement automated workflow requiring dual approval for high-value expenses
What's Included
- Risk Assessment Templates: Pre-built worksheets and checklists for identifying compliance risks across key business processes and regulatory domains.
- Industry-Specific Frameworks: Pre-configured risk frameworks for banking, insurance, healthcare, pharma, energy, telecom, and manufacturing sectors, including jurisdiction-specific requirements.
- Regulatory Requirement Catalogs: Comprehensive mappings of compliance obligations by regulation (SOX, HIPAA, GDPR, ISO 27001, PCI-DSS, etc.) to organizational processes.
- Documentation and Reporting Templates: Audit-ready reports, risk matrices, gap analyses, and remediation roadmaps formatted for internal audit, external audit, and board presentation.
- Control Testing Guidance: Design and execution guidance for control testing, including sampling methodologies, evidence collection standards, and documentation formats.
- Risk Scoring and Prioritization Models: Customizable probability-impact assessment frameworks, risk appetite matrices, and aggregation models for portfolio-level risk reporting.
Who It's For
- Compliance Officers & Compliance Managers
- Chief Risk Officers & Enterprise Risk Managers
- Internal Auditors & Audit Directors
- Quality Assurance & Process Compliance Specialists
- Regulatory Affairs & Legal/Regulatory Counsel
Best For
- Annual compliance risk assessments and refreshes
- Regulatory readiness reviews and audit preparation
- Control design and testing documentation
- Compliance gap analysis and remediation planning
- Risk prioritization and board-level reporting
You might also like
You get a systematic HIPAA compliance audit that evaluates your healthcare operations against the Privacy and Security Rules, identifies gaps by severity level, and generates prioritized remediation roadmaps. The skill scores your overall compliance risk and delivers actionable findings with specific remediation steps, timelines, and ownership assignments so you can strategically close compliance gaps and reduce breach risk.
by joabgonzalez
Analyze your board's practices, policies, and documentation to identify governance compliance gaps and fiduciary duty risks. You receive expert-level legal review findings with prioritized recommendations for liability mitigation. The skill evaluates your governance framework against industry best practices and regulatory requirements.
by joabgonzalez
You can take raw input from coalition members—surveys, one-on-ones, working group notes—and synthesize it into unified strategy documents, position statements, and action plans that reflect genuine consensus rather than tokenistic agreement. The skill surfaces alignment gaps and disagreements early so you can facilitate resolution before publishing, building authentic buy-in and accountability across all partners.
by joabgonzalez
You can design complete campaign architectures that escalate strategically from education through direct action, with tailored messaging for different audiences (allies, decision-makers, public). Map power dynamics to identify leverage points, build coalition strategies across organizations, and diagnose why campaigns stall so you can adjust tactics without abandoning strategy.
by joabgonzalez
You can rapidly analyze dozens or hundreds of qualitative responses—interviews, focus groups, open-ended survey answers, and participant feedback—to extract themes, patterns, and evidence of program impact. Claude codes responses against your logic model or emergent themes, flags anomalies where outcomes diverge from expectations, and generates frequency tables and quote libraries that substantiate your evaluation reports with real participant data.
by joabgonzalez
Build persuasive, evidence-based advocacy briefs customized for each decision-maker—whether legislators, foundation officers, or agency directors. The skill helps you synthesize research, client data, and outcome metrics into strategic narratives that match each stakeholder's values and priorities. You'll produce structured briefs ready to adapt into formal letters, presentations, or policy memos.
by joabgonzalez
You can rapidly develop evidence-based campaign strategies that move policy and systems change with limited resources. This skill helps you map power structures to identify decision-makers and gatekeepers, analyze opposition interests and vulnerabilities, pinpoint leverage points where organized pressure creates accountability, develop audience-specific messaging, and sequence tactics across campaign phases. You'll move beyond generic action lists to build campaigns with a clear theory of change grounded in who holds power and how to create measurable impact.
by joabgonzalez
You can synthesize heterogeneous monitoring data—quantitative metrics, qualitative interviews, financial records, and beneficiary case studies—into coherent impact narratives with established evidence hierarchies and causal chains. This skill helps you translate raw data into funder-ready reports, dashboards, and grant narratives that demonstrate program effectiveness with methodological rigor. You'll identify which program activities drove the strongest outcomes and address funder skepticism with credible, data-backed storytelling.
by joabgonzalez