codexkit-compliance-gap-review

Compliance Gap Review

Purpose

Transform a vague compliance concern into a concrete gap assessment and remediation view.

When to use

• A team needs to assess readiness against AML, KYC, privacy, audit, or control expectations.
• Policies and evidence exist but no one has mapped gaps clearly.
• Leadership needs remediation priorities, not just a checklist dump.

When not to use

• No target framework, policy baseline, or standard is named.
• The request requires a formal legal opinion or regulator submission.

Inputs

• named framework, regulation, or internal control standard
• current policies, procedures, forms, or evidence
• scope: business unit, process, customer segment, or geography
• known incidents, findings, or deadlines

Procedure

1. Define the exact framework and scope before evaluating anything.
2. Break the framework into control requirements or evidence expectations.
3. Compare current evidence against each requirement.
4. Rate each gap by severity, exposure, and remediation effort.
5. Separate high-risk gaps from documentation-only gaps.
6. Build a practical 30/60/90-day remediation sequence and evidence request list.
7. Escalate areas that need specialist legal or regulatory review.

Output

• control or requirement matrix
• current-state evidence summary
• gap list with severity and rationale
• remediation plan with owners and priorities
• evidence request list for unresolved areas

Definition of done

• The target framework is explicit.
• Gaps are mapped to concrete requirements, not vague opinions.
• The output shows what to fix first and what evidence is still missing.

Examples

• "Compare our onboarding process to AML and KYC expectations and tell me the top gaps."
• "Assess our privacy operating procedures against our internal control checklist."

Quality Criteria

• Every finding is tied to a specific evidence source (log, test, metric)
• Pass/fail criteria are binary and measurable — no subjective judgments
• Severity levels are assigned with clear thresholds
• Remediation steps are provided for all critical and high findings