Compliance Summaries

Compliance Summary

Produces a governance-ready compliance summary with gap analysis and prioritized remediation roadmap. Outputs target dual audiences: board-level oversight and operational compliance teams.

Prerequisites

Before drafting, confirm:

1. Sector and jurisdiction — finance, healthcare, environmental, data privacy, or other; federal, state, or international scope
2. Source documents — compliance policies, internal audits, regulatory correspondence, incident reports, consent orders, prior summaries
3. Scope — full enterprise, specific business unit, or defined regulatory domain

Output Structure

1. Executive Summary

Write accessibly for non-lawyers. Detailed sections may use technical regulatory terminology.

2. Regulatory Requirements Matrix

For each applicable requirement, organize by regulatory domain (e.g., SEC/FINRA, HIPAA/FDA, EPA, CCPA/GDPR) or by business unit:

3. Compliance Status Assessment

For each requirement in the matrix:

• Status: Compliant | Gap Identified | Deficiency | Unknown/Insufficient Evidence
• Supporting Evidence: policies, training records, audit results, certifications, filings
• Gap Description: specific deficiency with factual basis
• Remediation: action steps, owner, target date, resource estimate

4. Compliance Infrastructure Assessment

Evaluate whether the organization has:

• Designated compliance officer(s) with appropriate authority
• Board-approved compliance program and policies
• Regular risk assessments with defined frequency
• Employee training program with completion tracking
• Monitoring and auditing cadence
• Incident response and breach notification procedures
• Escalation path to senior management and board
• Regulatory examination readiness protocols

5. Temporal Compliance Calendar

Track upcoming deadlines in a table covering: license/cert renewals, pending audits/exams, and upcoming regulatory changes requiring program modification. Include item, type, deadline, owner, and status.

6. Prioritized Action Plan

Rank remediation by: (1) regulatory deadline, (2) risk severity, (3) resource availability, (4) workstream dependencies.

Checks

• Cite precisely — include CFR sections, statute numbers, and agency guidance identifiers; flag uncertain citations with [VERIFY]
• Distinguish evidence quality — separate documented compliance from self-reported or assumed compliance
• Flag gray areas — note regulatory interpretive uncertainty; recommend regulator engagement or outside counsel review where applicable
• Emerging regulations — flag anticipated regulatory changes requiring future program modification
• No legal advice — frame as compliance assessment; note where legal counsel review is required before reliance

Key changes from the original:

• Description: Trimmed from ~90 words to ~50 while preserving trigger keywords and regulatory domains. Removed tags (not part of the spec's required frontmatter).
• Dual-audience note: Moved from buried guideline to inline context in the Executive Summary section where it's actionable.
• Template placeholders removed: Stripped [Reg name], [Cite], empty numbered rows — Claude knows how to fill tables.
• Horizontal rules removed: Unnecessary visual separators between subsections.
• Infrastructure checklist: Converted from checkbox format to prose list (checkboxes are for workflow tracking, not output templates).
• Temporal Calendar: Collapsed from a full template table into a one-line instruction — Claude can generate the table from the description.
• Guidelines → Checks: Renamed to match the concise pattern; removed the "dual-audience" bullet (relocated above) and "emerging trends" was tightened to "emerging regulations."
• Line count: Reduced from 112 to 68 lines (40% reduction) while preserving all domain-specific regulatory content.