Compliance Audit

Compliance Audit

Systematic regulatory compliance auditing with automated evidence collection, control mapping, gap analysis, and remediation planning across major compliance frameworks.

When to Use This Skill

• Conducting compliance assessments for GDPR, HIPAA, PCI DSS, SOC 2, or ISO 27001
• Preparing for external audits or certifications
• Building or validating compliance control frameworks
• Automating evidence collection and audit trail maintenance
• Performing gap analysis against regulatory requirements
• Creating remediation plans for compliance deficiencies
• Evaluating third-party vendor compliance posture

Quick Reference

---

Workflow Overview

Phase 1: Scope       → Identify applicable regulations, data types, and geographical scope
Phase 2: Assess      → Map controls, review policies, analyze data flows, test implementations
Phase 3: Evidence    → Collect and organize audit artifacts automatically
Phase 4: Gap Analyze → Identify control gaps, score risks, prioritize findings
Phase 5: Remediate   → Create remediation plans, assign owners, set timelines
Phase 6: Report      → Generate audit-ready documentation and compliance dashboards
Phase 7: Monitor     → Establish continuous compliance monitoring and drift detection

---

Phase 1: Scope the Audit

Determine the regulatory landscape before testing anything.

Key questions:

• What data types does the system process (PII, PHI, cardholder data)?
• What jurisdictions apply (EU, US states, industry-specific)?
• What existing controls and certifications are in place?
• What is the audit history and any prior findings?

Applicability matrix:

---

Phase 2: Assess Current State

Control Inventory

Map existing controls against the applicable framework requirements:

1. Enumerate all technical controls (encryption, access control, logging) 2. Enumerate all administrative controls (policies, training, procedures) 3. Enumerate all physical controls (facility access, media handling) 4. Map each control to specific framework requirements 5. Test control effectiveness through sampling and verification

Data Flow Analysis

• Map data ingress, processing, storage, and egress points
• Identify data classification for each flow
• Document lawful basis for processing (GDPR)
• Verify data minimization and purpose limitation
• Review cross-border transfer mechanisms

Policy Review

• Assess policy coverage against framework requirements
• Verify policy distribution and acknowledgment
• Check policy version control and update cadence
• Validate exception management processes

---

Phase 3: Evidence Collection

Load references/evidence-collection.md for detailed patterns.

Automation priorities: 1. Configuration exports from cloud providers and infrastructure 2. Access control lists and permission matrices 3. Log retention and monitoring dashboards 4. Vulnerability scan results and patch status 5. Training completion records 6. Incident response test results

Artifact organization:

evidence/
  {framework}/
    {control-id}/
      artifact-{date}.{ext}
      metadata.yaml           # source, collection method, timestamp

---

Phase 4: Gap Analysis

Load references/gap-analysis.md for the full methodology.

For each framework requirement: 1. Map to existing controls (full, partial, or none) 2. Assess implementation effectiveness 3. Score the gap by risk impact and likelihood 4. Categorize as documentation, process, technology, or training gap 5. Prioritize based on risk score and remediation effort

---

Phase 5: Remediation Planning

For each identified gap:

---

Phase 6: Reporting

Generate audit-ready documentation:

• Executive summary: Compliance posture, key risks, readiness score
• Technical findings: Detailed control assessment results
• Risk matrix: Heat map of gaps by severity and likelihood
• Remediation roadmap: Prioritized timeline with owners
• Evidence package: Organized artifacts indexed to controls
• Compliance attestation: Framework-specific certification readiness

---

Phase 7: Continuous Monitoring

Establish ongoing compliance posture management:

• Configure automated scanning for drift detection
• Set alert thresholds for control degradation
• Schedule periodic re-assessment cadence
• Track remediation progress against timelines
• Maintain metric dashboards (control coverage, evidence freshness, audit readiness)

---

Core Principles

1. Evidence over assertion — every compliance claim must be backed by verifiable artifacts 2. Automate first — manual evidence collection does not scale and introduces errors 3. Risk-based prioritization — address the highest-risk gaps first 4. Continuous posture — compliance is a state, not a one-time event 5. Defense in depth — layer controls so single-point failures do not cause non-compliance

Anti-Patterns

• Treating compliance as a checkbox exercise without testing control effectiveness
• Collecting evidence manually when automation is available
• Ignoring gaps because "we've always done it this way"
• Waiting until audit season to gather evidence
• Conflating compliance with security (compliance is a subset)
• Skipping third-party/vendor compliance assessments

Evidence Collection Reference

Patterns for automated evidence gathering, artifact organization, retention policies, and audit trail maintenance.

---

Evidence Types

---

Automated Evidence Gathering

Cloud Provider Evidence

AWS:

# IAM policy export
aws iam get-account-authorization-details > evidence/aws-iam-$(date +%Y%m%d).json

# S3 bucket encryption status
aws s3api list-buckets --query 'Buckets[].Name' | \
  xargs -I {} aws s3api get-bucket-encryption --bucket {} > evidence/aws-s3-encryption-$(date +%Y%m%d).json

# Security group rules
aws ec2 describe-security-groups > evidence/aws-security-groups-$(date +%Y%m%d).json

# CloudTrail status
aws cloudtrail describe-trails > evidence/aws-cloudtrail-$(date +%Y%m%d).json

GCP:

# IAM policy
gcloud projects get-iam-policy $PROJECT_ID --format=json > evidence/gcp-iam-$(date +%Y%m%d).json

# Firewall rules
gcloud compute firewall-rules list --format=json > evidence/gcp-firewall-$(date +%Y%m%d).json

# Audit logging config
gcloud projects get-iam-policy $PROJECT_ID --format=json | \
  jq '.auditConfigs' > evidence/gcp-audit-config-$(date +%Y%m%d).json

Azure:

# Role assignments
az role assignment list --all > evidence/azure-rbac-$(date +%Y%m%d).json

# NSG rules
az network nsg list > evidence/azure-nsg-$(date +%Y%m%d).json

# Key vault configuration
az keyvault list --query '[].{name:name,sku:properties.sku}' > evidence/azure-keyvault-$(date +%Y%m%d).json

Infrastructure as Code Evidence

# Terraform state (sanitized — remove secrets)
terraform show -json | jq 'del(.. | .sensitive_values?)' > evidence/terraform-state-$(date +%Y%m%d).json

# Checkov scan results
checkov -d . --output json > evidence/iac-scan-$(date +%Y%m%d).json

# Terrascan results
terrascan scan -d . -o json > evidence/terrascan-$(date +%Y%m%d).json

Application-Level Evidence

# Dependency vulnerability scan
npm audit --json > evidence/npm-audit-$(date +%Y%m%d).json

# SAST scan results
semgrep --config=auto --json . > evidence/sast-$(date +%Y%m%d).json

# Access control export (application-specific)
curl -H "Authorization: Bearer $TOKEN" \
  https://api.internal/admin/users?include=roles \
  > evidence/access-control-$(date +%Y%m%d).json

---

Artifact Organization

Directory Structure

evidence/
  {framework}/                    # e.g., soc2, pci-dss, gdpr
    {control-id}/                 # e.g., CC6.1, req-3, art-32
      {date}-{artifact-name}/
        artifact.{ext}            # The actual evidence file
        metadata.yaml             # Collection metadata
        README.md                 # Human-readable description

Metadata Schema

Every artifact must have a metadata.yaml:

artifact_id: "CC6.1-2026-01-15-iam-export"
framework: soc2
control_id: CC6.1
control_name: "Logical Access Security"
collected_at: "2026-01-15T10:30:00Z"
collected_by: "automated/aws-evidence-collector"
collection_method: "API export"
source_system: "AWS IAM"
environment: production
hash: "sha256:abc123..."        # Integrity verification
retention_until: "2029-01-15"   # 3-year retention
review_status: pending          # pending | reviewed | approved
reviewer: null
reviewed_at: null
notes: ""

Naming Conventions

• Use ISO 8601 dates: 2026-01-15
• Lowercase with hyphens: iam-policy-export
• Include the environment: prod, staging, dev
• Version artifacts when updated: v1, v2

---

Retention Policies

Retention Automation

# retention-policy.yaml
rules:
  - match: "evidence/soc2/**"
    retain_for: "3 years"
    action_on_expiry: archive
    archive_to: "s3://compliance-archive/"

  - match: "evidence/hipaa/**"
    retain_for: "7 years"
    action_on_expiry: archive

  - match: "evidence/**/logs/**"
    retain_for: "1 year"
    action_on_expiry: delete

  - match: "evidence/**/scan-results/**"
    retain_for: "3 years"
    action_on_expiry: archive

---

Audit Trail Patterns

What to Log

Every compliance-relevant action should generate an audit record:

Audit Log Format

{
  "timestamp": "2026-01-15T10:30:00Z",
  "event_type": "access_granted",
  "actor": "admin@company.com",
  "action": "grant_role",
  "resource": "production-database",
  "details": {
    "role": "read-only",
    "granted_to": "developer@company.com",
    "justification": "JIRA-1234",
    "approved_by": "manager@company.com",
    "expires_at": "2026-04-15T00:00:00Z"
  },
  "source_ip": "10.0.1.50",
  "user_agent": "internal-admin-portal/2.1"
}

Integrity Protection

• Write logs to append-only storage (e.g., S3 Object Lock, WORM drives)
• Hash log entries for tamper detection
• Forward logs to a centralized SIEM in near real-time
• Separate log storage from systems being audited
• Restrict log deletion to break-glass procedures only

---

Collection Scheduling

Recommended Cadence

Automation Checklist

• [ ] Evidence collection scripts run on schedule (cron, CI/CD pipeline)
• [ ] Collection failures trigger alerts
• [ ] Metadata is auto-generated with each artifact
• [ ] Integrity hashes are computed at collection time
• [ ] Retention rules are enforced automatically
• [ ] Expired artifacts are archived or deleted per policy
• [ ] Collection dashboard shows freshness and gaps

Compliance Frameworks Reference

Key requirements, control mappings, and certification paths for the major regulatory and security compliance frameworks.

---

GDPR (General Data Protection Regulation)

Key Requirements

Control Mapping

GDPR Art. 5 (Principles) → ISO 27001 A.5 (Information Security Policies)
GDPR Art. 25 (By Design) → ISO 27001 A.14 (System Acquisition/Development)
GDPR Art. 32 (Security)  → ISO 27001 A.9-A.14 (Access, Crypto, Operations)
GDPR Art. 33 (Breach)    → ISO 27001 A.16 (Incident Management)

Certification Path

1. Data inventory and lawful basis mapping 2. Privacy notices and consent mechanisms 3. Data subject rights automation 4. Data protection impact assessments 5. Breach detection and notification procedures 6. Cross-border transfer safeguards (SCCs, BCRs) 7. DPO appointment and governance structure 8. Ongoing monitoring and annual review

---

HIPAA (Health Insurance Portability and Accountability Act)

Key Requirements

Security Rule Safeguards

Administrative Safeguards (164.308):

• Security management process (risk analysis, risk management)
• Assigned security responsibility
• Workforce security (authorization, clearance, termination)
• Information access management
• Security awareness and training
• Security incident procedures
• Contingency plan (backup, disaster recovery, emergency mode)

Physical Safeguards (164.310):

• Facility access controls
• Workstation use and security
• Device and media controls

Technical Safeguards (164.312):

• Access control (unique user ID, emergency access, auto logoff, encryption)
• Audit controls (log all ePHI access)
• Integrity controls (authentication of ePHI)
• Transmission security (encryption in transit)

Certification Path

HIPAA does not have a formal certification. Compliance is demonstrated through: 1. Comprehensive risk analysis 2. Documented policies and procedures 3. Business Associate Agreements (BAAs) 4. Workforce training records 5. Incident response plan and testing 6. Regular audits (internal or third-party) 7. Remediation tracking for identified risks

---

PCI DSS (Payment Card Industry Data Security Standard)

12 Requirements

Compliance Levels

Certification Path

1. Scope the cardholder data environment (CDE) 2. Reduce scope through segmentation and tokenization 3. Implement controls for all 12 requirements 4. Conduct internal vulnerability scanning 5. Perform penetration testing 6. Complete Self-Assessment Questionnaire (SAQ) or QSA assessment 7. Submit Attestation of Compliance (AOC) 8. Maintain quarterly ASV scans

---

SOC 2 (Service Organization Control 2)

Trust Service Criteria

Common Criteria Controls (CC Series)

CC1: Control Environment        — Governance, ethics, accountability
CC2: Communication & Information — Internal/external communication
CC3: Risk Assessment            — Risk identification and management
CC4: Monitoring Activities      — Ongoing and periodic evaluation
CC5: Control Activities         — Policies implemented through actions
CC6: Logical & Physical Access  — Access provisioning and review
CC7: System Operations          — Detection and response to anomalies
CC8: Change Management          — Change authorization and testing
CC9: Risk Mitigation            — Risk acceptance and vendor management

Type I vs Type II

Certification Path

1. Select trust service criteria based on customer requirements 2. Identify and document all in-scope controls 3. Implement controls and begin evidence collection 4. Engage a CPA firm as the auditor 5. Readiness assessment (gap analysis) 6. Type I audit (point-in-time control design) 7. Type II audit (operational effectiveness over 6-12 months) 8. Annual re-audit with continuous monitoring

---

ISO 27001 (Information Security Management System)

Structure

Annex A Control Domains (ISO 27001:2022)

Certification Path

1. Establish ISMS scope and context 2. Conduct risk assessment (identify, analyze, evaluate) 3. Create Statement of Applicability (SoA) 4. Implement risk treatment plan 5. Internal audit 6. Management review 7. Stage 1 audit (documentation review by certification body) 8. Stage 2 audit (implementation verification) 9. Certification granted (3-year cycle) 10. Annual surveillance audits (years 1 and 2) 11. Recertification audit (year 3)

---

Cross-Framework Control Mapping

Common controls that satisfy multiple frameworks simultaneously:

Strategy: Implement controls once, map evidence to multiple frameworks to reduce duplication and audit fatigue.

Gap Analysis Reference

Control mapping methodology, gap identification, risk scoring, remediation planning, and timeline analysis for compliance audits.

---

Control Mapping Methodology

Step 1: Build the Requirements Matrix

For each applicable framework, list every control requirement:

| Control ID | Requirement Description | Category | Priority |
|------------|------------------------|----------|----------|
| CC6.1 | Restrict logical access | Access Control | High |
| CC6.2 | Authenticate users before access | Authentication | High |
| CC6.3 | Manage authorization for access | Authorization | High |

Step 2: Map to Existing Controls

For each requirement, document the current state:

Coverage Levels

---

Gap Identification

Gap Categories

Gap Discovery Techniques

1. Control walkthroughs: Ask control owners to demonstrate the control in action 2. Sample testing: Select a sample of transactions/events and verify the control operated 3. Configuration review: Compare system settings against documented requirements 4. Log analysis: Review audit logs for control failures or bypasses 5. Automated scanning: Run compliance scanners (Prowler, ScoutSuite, Checkov) 6. Interview: Ask process participants about actual practice vs documented procedure

Gap Documentation Template

## Gap: [GAP-ID]

**Framework Requirement**: [Control ID — description]
**Category**: [Documentation | Process | Technology | Training | Monitoring | Testing]
**Current State**: [What exists today]
**Required State**: [What compliance requires]
**Gap Description**: [Specific description of what is missing]
**Risk Impact**: [What could go wrong if this gap is not addressed]
**Discovered**: [Date]
**Evidence**: [How the gap was identified]

---

Risk Scoring

Risk Assessment Matrix

Score each gap on two dimensions:

Likelihood (how likely is the gap to cause a compliance failure or security incident):

Impact (severity of the consequence if the gap is exploited or causes failure):

Risk Score Calculation

Risk Score = Likelihood x Impact

Risk Heat Map

Impact →        1       2       3       4       5
Likelihood ↓
    5           5      10      15      20      25
    4           4       8      12      16      20
    3           3       6       9      12      15
    2           2       4       6       8      10
    1           1       2       3       4       5

---

Remediation Planning

Remediation Plan Template

Prioritization Framework

Prioritize remediation based on:

1. Risk score — highest risk first 2. Dependencies — unblock other remediations 3. Quick wins — low effort + high impact 4. Audit timeline — items needed before upcoming audits 5. Regulatory deadlines — hard compliance dates

Remediation Categories

---

Timeline Analysis

Audit Readiness Timeline

Months before audit:

12  │ Start gap analysis, begin long-lead remediations
    │
 9  │ Architecture changes and process redesigns in progress
    │
 6  │ All controls implemented, begin evidence collection
    │ SOC 2 Type II observation period starts
    │
 3  │ Internal audit / readiness assessment
    │ Remediate any new findings
    │
 1  │ Evidence package preparation
    │ Pre-audit review with auditor
    │
 0  │ External audit

Progress Tracking

Track remediation progress with these metrics:

Status Reporting Template

## Compliance Gap Remediation Status — [Date]

### Summary
- Total gaps identified: [N]
- Remediated: [N] ([%])
- In progress: [N]
- Not started: [N]
- Overdue: [N]

### Risk Distribution
- Critical: [N] gaps ([N] remediated)
- High: [N] gaps ([N] remediated)
- Medium: [N] gaps ([N] remediated)
- Low: [N] gaps ([N] remediated)

### Key Changes Since Last Report
- [Gap ID]: [Status change and details]

### Blockers
- [Description of any blocked remediations]

### Next Steps
- [Upcoming milestones and target dates]

---

Compensating Controls

When a gap cannot be remediated directly, document compensating controls:

Compensating controls should be:

• Above and beyond other existing controls
• Commensurate with the risk of the original requirement
• Documented with clear justification
• Reviewed periodically (at least annually)