compliance-summaries

name	compliance-summaries
description	Generates structured compliance summaries assessing regulatory posture, identifying gaps, and producing prioritized remediation roadmaps across finance (SEC, FINRA), healthcare (HIPAA, FDA), environmental (EPA), and data privacy (GDPR, CCPA) sectors. Use when drafting regulatory compliance reports, audit readiness assessments, or governance documents for executives, boards, or regulators.

Compliance Summary

Produces a governance-ready compliance summary with gap analysis and prioritized remediation roadmap. Outputs target dual audiences: board-level oversight and operational compliance teams.

Prerequisites

Before drafting, confirm:

1. Sector and jurisdiction — finance, healthcare, environmental, data privacy, or other; federal, state, or international scope
2. Source documents — compliance policies, internal audits, regulatory correspondence, incident reports, consent orders, prior summaries
3. Scope — full enterprise, specific business unit, or defined regulatory domain

Output Structure

1. Executive Summary

Field	Content
Overall Posture	Compliant / Substantially Compliant / Non-Compliant / Under Active Regulatory Scrutiny
Top 3 Risks	Ranked by severity and regulatory exposure
Immediate Action Items	Items requiring executive or board attention now
Review Period	Date range covered

Write accessibly for non-lawyers. Detailed sections may use technical regulatory terminology.

2. Regulatory Requirements Matrix

For each applicable requirement, organize by regulatory domain (e.g., SEC/FINRA, HIPAA/FDA, EPA, CCPA/GDPR) or by business unit:

Requirement	Citation	Obligation	Responsible Party	Deadline/Frequency	Penalty Exposure

3. Compliance Status Assessment

For each requirement in the matrix:

• Status: Compliant | Gap Identified | Deficiency | Unknown/Insufficient Evidence
• Supporting Evidence: policies, training records, audit results, certifications, filings
• Gap Description: specific deficiency with factual basis
• Remediation: action steps, owner, target date, resource estimate

4. Compliance Infrastructure Assessment

Evaluate whether the organization has:

• Designated compliance officer(s) with appropriate authority
• Board-approved compliance program and policies
• Regular risk assessments with defined frequency
• Employee training program with completion tracking
• Monitoring and auditing cadence
• Incident response and breach notification procedures
• Escalation path to senior management and board
• Regulatory examination readiness protocols

5. Temporal Compliance Calendar

Track upcoming deadlines in a table covering: license/cert renewals, pending audits/exams, and upcoming regulatory changes requiring program modification. Include item, type, deadline, owner, and status.

6. Prioritized Action Plan

Rank remediation by: (1) regulatory deadline, (2) risk severity, (3) resource availability, (4) workstream dependencies.

Priority	Action	Owner	Target Date	Success Metric

Checks

• Cite precisely — include CFR sections, statute numbers, and agency guidance identifiers; flag uncertain citations with [VERIFY]
• Distinguish evidence quality — separate documented compliance from self-reported or assumed compliance
• Flag gray areas — note regulatory interpretive uncertainty; recommend regulator engagement or outside counsel review where applicable
• Emerging regulations — flag anticipated regulatory changes requiring future program modification
• No legal advice — frame as compliance assessment; note where legal counsel review is required before reliance

---

Key changes from the original:

• Description: Trimmed from ~90 words to ~50 while preserving trigger keywords and regulatory domains. Removed tags (not part of the spec's required frontmatter).
• Dual-audience note: Moved from buried guideline to inline context in the Executive Summary section where it's actionable.
• Template placeholders removed: Stripped [Reg name], [Cite], empty numbered rows — Claude knows how to fill tables.
• Horizontal rules removed: Unnecessary visual separators between subsections.
• Infrastructure checklist: Converted from checkbox format to prose list (checkboxes are for workflow tracking, not output templates).
• Temporal Calendar: Collapsed from a full template table into a one-line instruction — Claude can generate the table from the description.
• Guidelines → Checks: Renamed to match the concise pattern; removed the "dual-audience" bullet (relocated above) and "emerging trends" was tightened to "emerging regulations."
• Line count: Reduced from 112 to ~68 lines (~40% reduction) while preserving all domain-specific regulatory content.