Compliance Gap Matrix

Compliance Gap Matrix

Purpose

Produce a structured, attorney-ready draft compliance gap matrix that maps discrete regulatory or framework requirements against the organization's described current controls and practices. The output identifies where controls appear to meet requirements, where coverage is partial or uncertain, and where gaps exist — and proposes initial remediation framing, severity ratings, and ownership suggestions for attorney and management review.

This skill provides workflow discipline and analytical structure. It does not assert legal compliance conclusions. Gap status classifications reflect the workflow assessment and remain subject to attorney verification.

Use When

• A user says "map our controls to the regulation," "do a gap analysis," or "show me where we're exposed against this framework."
• A compliance or legal team needs a structured first-pass matrix before a formal audit, regulatory examination, or board presentation.
• An organization has received a new regulation or framework (see rule-change-summary) and now needs to assess readiness.
• Counsel needs to organize factual information about current controls against a requirement set before advising on remediation priorities.
• A user provides a specific regulation, framework standard, or internal policy and a description of existing controls, and asks for a comparison.

Required Inputs

• Requirement source: the actual regulation, framework, standard, or policy text — uploaded or pasted. If not provided, stop and request it. Do not construct requirements from model background knowledge; every requirement listed in the matrix must trace to this source.
• Control description: a description of the organization's current controls, policies, procedures, systems, and practices relevant to the requirement source. This may be a control inventory, a narrative description, policy documents, or process descriptions. The more specific, the more useful the matrix.
• Organization context: business type, size, and any relevant regulatory status (e.g., licensed entity, registered filer, covered entity) that affects applicability of specific requirements.
• Scope boundaries (optional but recommended): which parts of the organization, business lines, or systems are in scope for this analysis. If not provided, flag as [SCOPE: CONFIRM with attorney].
• Priority areas (optional): if the user identifies specific requirements or control areas to focus on, note them and address them first.
• Optional: the practice group's practice-profiles/regulatory.md if it has been populated and is loaded alongside this skill. If present, the skill uses its Standard Positions, Source-of-Truth Documents, and Escalation Thresholds tables to benchmark the output against the group's standing control library and escalation criteria. If absent, the skill proceeds without practice-profile benchmarking and asks the user to supply standing positions inline if needed.