Regulatory Compliance Audit Assistant
Audit Regulatory Compliance, Identify Gaps, Document Controls
What You Can Do
Systematically audit your organization against industry-specific regulatory frameworks, automatically identify compliance gaps and control deficiencies, and generate audit-ready documentation. The skill tailors assessments to your industry (healthcare, finance, manufacturing, etc.) and produces detailed remediation roadmaps with evidence collection guidance. You'll receive prioritized control recommendations tied to your regulatory obligations and existing audit findings.
Features
Pre-built compliance templates for HIPAA, SOX, GDPR, ISO 27001, PCI-DSS, NIST CSF, FDA 21 CFR Part 11, and 30+ other regulatory standards tailored to your sector
Analyzes your current control environment against regulatory requirements and flags missing, ineffective, or poorly designed controls with severity ratings
Evaluates each gap by likelihood and impact, prioritizes remediation efforts by business risk, and maps gaps to regulatory penalties and audit findings
Generates formatted assessment reports, control matrices, evidence checklists, and cross-references to regulatory clauses ready for internal or external auditor review
Creates step-by-step remediation plans with implementation timelines, resource requirements, and success metrics for each identified gap
Specifies what evidence each control requires (logs, policies, testing results, certifications) and provides templates for documenting control effectiveness
Outlines design and operating effectiveness testing procedures specific to each control, including sampling approaches and test scripts
Tracks compliance status over multiple audit cycles, identifies recurring gaps, and highlights improvements to demonstrate continuous compliance efforts
Example Output
Example 1: Healthcare Compliance Assessment (HIPAA)
Audit Summary: Medical Records Management
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
Total Controls Assessed: 24
Compliant: 18 (75%)
Partially Compliant: 4 (17%)
Non-Compliant: 2 (8%)
- 🔴 CRITICAL GAPS:
• Electronic access logs incomplete — 45 CFR §164.312(b) requires audit controls
Risk: $1.5M+ penalty, patient data exposure
Timeline: 30 days
Steps: (1) Enable logging on EHR system, (2) Export 6-month audit trail, (3) Create log review procedure
Evidence Needed: Log configuration screenshots, monthly review sign-offs
Example 2: Control Gap Summary with Remediation
Control: Data Backup & Recovery
Status: Partially Compliant
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
What's Missing:
✗ Recovery Time Objective (RTO) not documented
✗ Last successful restore test: 18 months ago
✗ Off-site backup verification missing
Remediation Steps:
1. Document RTO/RPO for all systems
2. Perform quarterly restore tests
3. Verify backups at remote location monthly
Resourced By: IT Operations Lead | Timeline: 45 days | Estimated Cost: $8,500
Example 3: Evidence Checklist for Financial Audit
SOX 404 Control: Segregation of Duties in Payments
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
☑ Policy document defining authorization limits
☑ System role configuration (preparer ≠ approver)
☑ Exception log for overrides (Q1-Q4)
☑ Monthly supervisor review sign-offs
☑ Training completion records for payment staff
What's Included
- Regulatory Framework Templates: Pre-populated compliance checklists for 30+ standards including HIPAA, SOX, GDPR, ISO 27001, PCI-DSS, NIST, FDA, and industry-specific requirements
- Control Assessment Matrices: Structured frameworks linking regulatory clauses to control objectives, design tests, and operating effectiveness procedures with severity classifications
- Gap Analysis Reports: Formatted audit reports with executive summaries, detailed findings, risk ratings, regulatory citations, and visual heat maps of compliance status
- Remediation Roadmaps: Implementation plans for each control gap including steps, timelines, resource needs, success criteria, and tracking templates
- Evidence Collection Checklists: Detailed lists of required documentation for each control (policies, logs, test results, certifications) with guidance on retention and accessibility
- Audit Interview Guides: Question templates and discussion prompts to gather information from process owners about control design, operation, and effectiveness
Who It's For
- Compliance Officers
- Internal Audit Teams
- Risk Managers & Risk Professionals
- Quality Assurance & Regulatory Affairs Directors
- Operations Leaders Preparing for External Audits
Best For
- Annual or multi-year compliance audits
- Control gap identification and risk assessment
- Audit preparation and evidence organization
- Regulatory readiness assessments pre-inspection
- Control design and remediation planning
You might also like
You get a systematic HIPAA compliance audit that evaluates your healthcare operations against the Privacy and Security Rules, identifies gaps by severity level, and generates prioritized remediation roadmaps. The skill scores your overall compliance risk and delivers actionable findings with specific remediation steps, timelines, and ownership assignments so you can strategically close compliance gaps and reduce breach risk.
by joabgonzalez
Analyze your board's practices, policies, and documentation to identify governance compliance gaps and fiduciary duty risks. You receive expert-level legal review findings with prioritized recommendations for liability mitigation. The skill evaluates your governance framework against industry best practices and regulatory requirements.
by joabgonzalez
You can design complete campaign architectures that escalate strategically from education through direct action, with tailored messaging for different audiences (allies, decision-makers, public). Map power dynamics to identify leverage points, build coalition strategies across organizations, and diagnose why campaigns stall so you can adjust tactics without abandoning strategy.
by joabgonzalez
You can rapidly analyze dozens or hundreds of qualitative responses—interviews, focus groups, open-ended survey answers, and participant feedback—to extract themes, patterns, and evidence of program impact. Claude codes responses against your logic model or emergent themes, flags anomalies where outcomes diverge from expectations, and generates frequency tables and quote libraries that substantiate your evaluation reports with real participant data.
by joabgonzalez
You can develop complete campaign blueprints that integrate strategy, stakeholder analysis, and tactical execution. This skill guides you through defining your campaign's theory of change, mapping constituencies and opposition, crafting unified messaging frameworks, sequencing campaign phases, and generating specific advocacy materials. The result is a reusable strategic document that aligns your entire team and ensures consistent messaging across all constituencies.
by joabgonzalez
This skill performs a comprehensive compliance gap analysis tailored to your industry's specific regulations. You provide your current control environment, and Claude maps applicable regulations, identifies control deficiencies, and creates a prioritized remediation roadmap with timelines, resource requirements, and success metrics. The result is an audit-ready compliance strategy that addresses your highest-risk gaps first.
by joabgonzalez
Build persuasive, evidence-based advocacy briefs customized for each decision-maker—whether legislators, foundation officers, or agency directors. The skill helps you synthesize research, client data, and outcome metrics into strategic narratives that match each stakeholder's values and priorities. You'll produce structured briefs ready to adapt into formal letters, presentations, or policy memos.
by joabgonzalez
You can synthesize heterogeneous monitoring data—quantitative metrics, qualitative interviews, financial records, and beneficiary case studies—into coherent impact narratives with established evidence hierarchies and causal chains. This skill helps you translate raw data into funder-ready reports, dashboards, and grant narratives that demonstrate program effectiveness with methodological rigor. You'll identify which program activities drove the strongest outcomes and address funder skepticism with credible, data-backed storytelling.
by joabgonzalez