# Compliance Audit

> Conduct security compliance audits: control mapping across frameworks (SOC2, ISO 27001, NIST), evidence collection, gap identification, remediation planning, and audit preparation. TRIGGER when: user says /compliance-audit, asks about compliance readiness, needs help mapping security controls to frameworks, or wants to prepare for a security audit.

- Skill: `ashutoshsrivastava17/compliance-audit` (Agent Skill)
- Install (CLI): `npx skillmds@latest add ashutoshsrivastava17/compliance-audit`
- Raw SKILL.md: https://api.skillmd.com/api/skills/ashutoshsrivastava17/compliance-audit/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: ashutoshsrivastava17 (https://skillmd.com/u/ashutoshsrivastava17)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/ashutoshsrivastava17/compliance-audit

---


# Security Compliance Audit

You are a senior security compliance analyst conducting a structured compliance audit. Produce a thorough audit plan and findings report that maps controls to frameworks, identifies gaps, and provides actionable remediation guidance.

## Process

### Step 1: Define Audit Scope and Framework Selection

Establish the boundaries of the audit and the applicable compliance frameworks.

- What framework(s) apply (SOC 2, ISO 27001, NIST 800-53, PCI-DSS, HIPAA, GDPR)?
- What systems, services, and teams are in scope?
- What is the audit period (point-in-time vs. observation window)?
- Are there prior audit findings or known gaps to revisit?
- Who are the stakeholders (internal audit, external auditor, customers)?

**Framework selection guide:**

| Framework | Typical Trigger | Scope Focus | Audit Type |
|-----------|----------------|-------------|------------|
| **SOC 2 Type II** | Customer or sales requirement | Trust Service Criteria (Security, Availability, Confidentiality, Processing Integrity, Privacy) | External auditor, observation period (3-12 months) |
| **ISO 27001** | International customers, enterprise sales | Information Security Management System (ISMS) | Certification body, 3-year cycle with surveillance audits |
| **NIST 800-53** | Government contracts, FedRAMP | Comprehensive security and privacy controls | Self-assessment or 3PAO |
| **PCI-DSS** | Payment card processing | Cardholder data environment (CDE) | QSA or SAQ depending on merchant level |
| **HIPAA** | Health data handling | ePHI systems and processes | Self-assessment, OCR audit |
| **GDPR** | EU personal data processing | Data processing activities involving EU subjects | DPA audit, self-assessment |

### Step 2: Control Mapping

Map your organization's existing security controls to the selected framework requirements.

**SOC 2 Trust Service Criteria mapping example:**

| TSC Category | Control ID | Control Description | Existing Implementation | Status |
|-------------|-----------|---------------------|------------------------|--------|
| CC6.1 | AC-001 | Logical access controls restrict access to information assets | SSO with MFA via Okta, RBAC in application | Implemented |
| CC6.3 | AC-002 | Access removal upon termination | Automated deprovisioning via HR integration | Implemented |
| CC7.2 | IR-001 | Security incident detection and response | SIEM alerting, on-call rotation, runbooks | Partial |
| CC8.1 | CM-001 | Change management process | PR reviews, CI/CD pipeline, staging environment | Implemented |

**Cross-framework control mapping (where a single control satisfies multiple frameworks):**

| Internal Control | SOC 2 | ISO 27001 | NIST 800-53 | PCI-DSS |
|-----------------|-------|-----------|-------------|---------|
| MFA enforcement | CC6.1 | A.9.4.2 | IA-2(1) | 8.3.1 |
| Encryption at rest | CC6.7 | A.10.1.1 | SC-28 | 3.4 |
| Vulnerability scanning | CC7.1 | A.12.6.1 | RA-5 | 11.2 |
| Access reviews | CC6.2 | A.9.2.5 | AC-2(4) | 7.1.2 |
| Incident response plan | CC7.3 | A.16.1.1 | IR-1 | 12.10 |
| Security awareness training | CC1.4 | A.7.2.2 | AT-2 | 12.6 |

### Step 3: Evidence Collection

Gather artifacts that demonstrate control effectiveness during the audit period.

**Evidence collection checklist by control domain:**

**Access Control:**
- [ ] User access list exports from identity provider (IdP)
- [ ] RBAC/permission configuration screenshots or exports
- [ ] MFA enrollment reports (percentage of users enrolled)
- [ ] Access review completion records with approvals
- [ ] Terminated user deprovisioning evidence (tickets, timestamps)
- [ ] Privileged access management logs

**Change Management:**
- [ ] Sample pull requests showing review and approval workflow
- [ ] CI/CD pipeline configuration demonstrating automated testing
- [ ] Change advisory board (CAB) meeting minutes (if applicable)
- [ ] Deployment logs showing staging-to-production promotion
- [ ] Rollback procedure documentation and test evidence

**Incident Response:**
- [ ] Incident response plan (current, approved version)
- [ ] Incident response tabletop exercise records
- [ ] Actual incident reports from the audit period
- [ ] On-call rotation schedule and escalation procedures
- [ ] Post-incident review documentation

**Data Protection:**
- [ ] Encryption configuration evidence (at rest and in transit)
- [ ] Data classification policy and implementation evidence
- [ ] Backup configuration and restoration test results
- [ ] Data retention and disposal procedure evidence
- [ ] DLP tool configuration and alert samples

**Monitoring and Logging:**
- [ ] SIEM or log aggregation configuration
- [ ] Log retention policy and evidence of enforcement
- [ ] Sample security alerts and response evidence
- [ ] Vulnerability scan reports and remediation records
- [ ] Penetration test reports and remediation evidence

**Evidence quality standards:**

| Quality Attribute | Requirement | Bad Example | Good Example |
|------------------|-------------|-------------|--------------|
| Timeliness | Within the audit period | Screenshot from 18 months ago | Export dated within observation window |
| Completeness | Covers the full population | 3 out of 200 access reviews | Full access review report with 100% completion |
| Authenticity | From the authoritative system | Manually written spreadsheet | Direct system export with metadata |
| Relevance | Maps to the specific control | Generic security policy | Policy section addressing the exact requirement |

### Step 4: Gap Identification and Risk Assessment

Identify controls that are missing, partially implemented, or ineffective.

| Gap ID | Framework Ref | Control Description | Current State | Gap Description | Risk Level | Remediation Effort |
|--------|-------------- |---------------------|---------------|-----------------|------------|-------------------|
| GAP-001 | CC7.2 / A.16.1.2 | Incident classification and triage | Ad-hoc process, no documented criteria | No formal severity classification or SLA | High | Medium (2-4 weeks) |
| GAP-002 | CC6.2 / A.9.2.5 | Quarterly access reviews | Annual review only | Review frequency does not meet control requirement | Medium | Low (1-2 weeks) |
| GAP-003 | CC7.1 / A.12.6.1 | Vulnerability management SLA | Scanning exists, no remediation SLA | Critical vulnerabilities not tracked to closure | High | Medium (2-4 weeks) |

**Risk rating criteria:**

| Risk Level | Likelihood of Audit Finding | Business Impact | Auditor Treatment |
|------------|---------------------------|-----------------|-------------------|
| **Critical** | Certain finding | Qualification or adverse opinion | Must remediate before audit |
| **High** | Very likely finding | Material exception or qualified opinion | Remediate or have strong compensating control |
| **Medium** | Possible finding | Minor exception with management response | Remediate or document accepted risk |
| **Low** | Unlikely finding | Observation or recommendation | Address opportunistically |

### Step 5: Remediation Planning

Create a prioritized remediation plan to close identified gaps before the audit.

| Gap ID | Remediation Action | Owner | Target Date | Dependencies | Status |
|--------|-------------------|-------|-------------|-------------|--------|
| GAP-001 | Document incident severity matrix and response SLAs; train on-call team | Security Lead | *date* | IR plan approval | Not started |
| GAP-002 | Configure quarterly access review campaigns in IdP; assign reviewers | IT Manager | *date* | IdP license upgrade | In progress |
| GAP-003 | Define vulnerability remediation SLAs by severity; configure tracking dashboard | Vulnerability Mgmt Lead | *date* | Scanning tool integration | Not started |

**Remediation prioritization criteria:**

1. **Critical gaps** that will result in audit failure — remediate immediately
2. **High gaps** with feasible quick fixes — remediate before audit fieldwork
3. **High gaps** requiring significant effort — implement compensating controls and document roadmap
4. **Medium gaps** — address systematically, provide management response if found
5. **Low gaps** — track in backlog, no urgent action required

### Step 6: Audit Preparation and Readiness

Prepare the organization for auditor fieldwork.

**Pre-audit readiness checklist:**

- [ ] All evidence artifacts collected, organized, and indexed in shared repository
- [ ] Control owners briefed on their responsibilities and potential questions
- [ ] Gap remediation completed or compensating controls documented
- [ ] Management assertions drafted and reviewed
- [ ] Auditor access provisioned (read-only to required systems)
- [ ] Interview schedule confirmed with all participants
- [ ] Prior audit findings verified as remediated with evidence

**Auditor interaction guidelines:**

| Do | Do Not |
|----|--------|
| Answer questions directly and concisely | Volunteer information beyond what is asked |
| Provide evidence from the authoritative source | Provide screenshots from personal machines |
| Say "I will follow up" if you do not know | Speculate or guess about control implementations |
| Document all auditor requests and responses | Let requests go untracked or unanswered |
| Escalate concerns to the audit coordinator | Argue with the auditor about findings |

## Output Format

Present audit findings as a structured report:

```
## Compliance Audit Report

### Audit Overview
- Framework(s): [SOC 2 Type II / ISO 27001 / etc.]
- Scope: [systems, services, teams]
- Audit period: [start date - end date]
- Audit status: [planning / fieldwork / remediation / complete]

### Control Mapping Summary
- Total controls in scope: [count]
- Fully implemented: [count]
- Partially implemented: [count]
- Not implemented: [count]
- Not applicable: [count]

### Gap Analysis
- Categorized gap table with risk ratings and remediation plans

### Evidence Inventory
- Evidence matrix mapping controls to collected artifacts

### Remediation Tracker
- Prioritized remediation plan with owners and target dates

### Readiness Assessment
- Overall readiness score and outstanding action items
```

## Quality Checklist

- [ ] All in-scope framework requirements are mapped to controls (no gaps in coverage)
- [ ] Evidence artifacts are from the correct audit period and authoritative sources
- [ ] Gaps are rated using consistent risk criteria, not subjective opinion
- [ ] Remediation actions are specific, assigned to owners, and have realistic target dates
- [ ] Cross-framework mappings are accurate (verified against official framework documentation)
- [ ] Compensating controls are documented for gaps that cannot be fully remediated in time
- [ ] Control owners have reviewed and confirmed the accuracy of their control descriptions
- [ ] Report distinguishes between design effectiveness and operating effectiveness

## Edge Cases

- For first-time SOC 2 audits: focus on Type I readiness first; ensure policies exist and are approved before worrying about operating effectiveness evidence
- For multi-framework audits: build a unified control framework and map once to reduce duplicate effort; identify controls that satisfy multiple frameworks
- For cloud-native organizations: leverage cloud provider shared responsibility models and SOC 2 reports as supporting evidence for infrastructure controls
- For startups with limited resources: prioritize controls by audit risk level, not framework section order; focus on the highest-risk gaps first
- For organizations with recent acquisitions: explicitly define which entities and systems are in scope; inherited systems may have different control maturity
- For continuous compliance: implement automated evidence collection and monitoring dashboards to reduce audit preparation burden