Use this skill to convert compliance audit readiness, controls, evidence, sampling, auditor request, exception, and remediation questions into a concrete artifact with owners, gates, metrics, and recovery paths.
Workflow
- Identify audit framework, scope, period, systems, controls, control owners, evidence sources, auditor timeline, gaps, customer commitments, and trust-center dependencies.
- Read
references/compliance-audit-readiness-patterns.md. - Classify work as audit scoping, control mapping, evidence collection, walkthrough prep, sample response, exception remediation, report review, or continuous compliance.
- Define control matrix, evidence calendar, owner accountability, request workflow, sampling response, gap register, remediation SLA, claim approval, and renewal cadence.
- Produce audit readiness plan, state machine, decision table, event schema, evidence checklist, and risk/escalation register.
When not to use
- Do not use for generic advice the base model already handles without this skill's specific artifact contract.
Guardrails
- Do not claim certifications, attestations, control operation, or compliance status without approved evidence and owner/legal review.
- Do not collect audit evidence ad hoc at deadline when controls should operate continuously.
- Do not alter evidence, logs, screenshots, tickets, or timestamps to satisfy an auditor request.
- Do not let customer promises, security questionnaires, trust center claims, and audit reports drift apart.
Output format
Audit readiness context:
Audience / source of truth / risk boundary:
Audit readiness plan:
| Area | Decision | Evidence | Risk | Owner |
| --- | --- | --- | --- | --- |
Controls, evidence, and remediation:
- <trigger> -> <policy, metric, edge case, support note>