Build Compliance Reports and Audit Documentation

This skill is an expert in compliance reporting and regulatory frameworks - comprehensive audit documentation, risk assessments, and compliance reports for SOX, GDPR, HIPAA, SOC 2, ISO 27001, PCI DSS, and other regulatory requirements. Core principles: evidence-based documentation (link controls to specific evidence, maintain audit trails with timestamps and responsible parties, document both preventive and detective controls, quantify with metrics like coverage percentages); a risk-based approach (prioritize high-risk and mission-critical processes, map controls to threat scenarios, assess residual risk, document risk appetite); and regulatory mapping (tie requirements to specific references, document compensating controls where direct compliance isn't feasible, version-control evolving requirements).

Use it when a compliance report needs to trace from framework requirement to specific control to test evidence, for an audit or internal assessment across a named regulatory framework.

### Control [ID]: [Control Name]

**Regulatory Reference**: [Standard] Section [X.X]
**Risk Level**: [Critical/High/Medium/Low]
**Control Type**: [Preventive/Detective/Corrective]

### Assessment Results
- **Status**: [Effective/Ineffective/Not Implemented]
- **Test Results**: [Passed/Failed with details]
- **Exceptions**: [Any deviations or compensating controls]

Framework-specific guidance covers SOX (financial-reporting ITGC and application controls, segregation-of-duties matrices, change management), GDPR (an Article 30 processing-records checklist, a 30-day subject-access-request SLA, data portability and right-to-deletion procedures), and SOC 2's five Trust Services criteria (Security, Availability, Processing Integrity, Confidentiality, Privacy). Risk scoring uses a likelihood-times-impact calculation (1-5 scale each) mapped to Critical/High/Medium/Low/Very Low bands, and sample-size calculations use a standard statistical formula (95%/99% confidence, configurable margin of error, finite-population correction). Findings are classified by urgency - Critical (24-48 hour business impact), High (30-day remediation), Medium (90-day), Low (180-day best-practice) - each driving a Corrective Action Plan template with root-cause analysis and immediate/short-term/long-term action phases. Continuous monitoring covers automated GRC-platform dashboards, alerting on control failures, and a fixed reporting cadence from daily security events through annual full compliance certifications.

Compliance, audit, and security teams producing regulator- or auditor-facing reports across SOX, GDPR, HIPAA, SOC 2, ISO 27001, or PCI DSS who need evidence-linked controls, quantified risk scoring, and a structured corrective-action process rather than a narrative summary. Control testing itself follows four defined stages - design effectiveness (are controls properly designed to meet their objective), implementation testing (do they operate as intended), operating effectiveness (do they hold up tested over a period of time), and evaluation of compensating controls when a primary control fails - so a report can state not just whether a control exists, but how rigorously it was actually verified.