# Compliance Audit

> Audit technical controls against compliance framework requirements

- Skill: `diegosouzapw/compliance-audit` (Agent Skill, multi-file: 2 files)
- Install (CLI): `npx skillmds@latest add diegosouzapw/compliance-audit`
- Raw SKILL.md: https://api.skillmd.com/api/skills/diegosouzapw/compliance-audit/raw
- Safety review: pending (external: skill-scanner PASS, skillspector PASS)
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: diegosouzapw (https://skillmd.com/u/diegosouzapw)
- Updated: 2026-09-08
- Page: https://skillmd.com/skills/diegosouzapw/compliance-audit

---


# Compliance Audit Skill

Audit technical controls against compliance framework requirements.

## Trigger Conditions
- Control mapping changes or evidence staleness >30 days
- Quarterly compliance review cycle
- User invokes with "compliance audit" or "control assessment"

## Input Contract
- **Required:** Framework(s) to audit against (SOC 2, GDPR, FedRAMP, etc.)
- **Required:** Control mapping matrix
- **Optional:** Prior audit results, remediation status

## Output Contract
- Control status report (compliant, gap, partial)
- Evidence inventory with freshness scores
- POA&M for open findings
- Compliance posture score

## Tool Permissions
- **Read:** All configs, logs, access policies, encryption settings
- **Write:** Audit reports, evidence documentation
- **Search:** Control implementation evidence

## Execution Steps
1. Load control mapping matrix for target framework
2. For each control, search for implementation evidence
3. Verify evidence is current (not stale)
4. Classify each control: compliant, partial, gap
5. For gaps, create POA&M entries with owners and deadlines
6. Calculate overall compliance posture score
7. Generate audit report

## Success Criteria
- Every control classified with evidence reference
- No evidence older than 30 days for continuous controls
- POA&M entries have assigned owners and deadlines
- Compliance score calculated

## Escalation Rules
- Escalate if critical control gaps are found
- Escalate if evidence cannot be generated automatically
- Escalate if compliance score drops below threshold

## Example Invocations

**Input:** "Audit SOC 2 Type II controls for the payment service"

**Output:** 47 controls assessed. 39 compliant, 5 partial (access reviews overdue, MFA not enforced for service accounts, log retention below 1yr for 2 services, encryption key rotation not automated, backup restore not tested). 3 gaps (no formal change management for DB, missing vendor risk assessment, incident response not tested). POA&M created with 30/60/90 day deadlines.