| name | compliance-checklist |
| description | Creates industry-specific regulatory compliance checklists with documentation requirements and audit preparation. Use when ensuring your business meets regulatory obligations. |
| allowed-tools | Read Write Glob |
| metadata | {"author":"matthewhitcham","version":"1.0"} |
Compliance Checklist
When to Use This Skill
Use this skill when you need to:
- Create a regulatory compliance checklist for your industry
- Identify compliance obligations for a new business or product launch
- Prepare for a compliance audit or review
- Document compliance procedures and responsible parties
DO NOT use this skill for legal advice or as a substitute for a compliance officer. This is a planning and tracking tool. Consult industry-specific legal counsel for complex compliance requirements.
Core Principle
COMPLIANCE IS NOT OPTIONAL — IT IS THE COST OF DOING BUSINESS IN A REGULATED ENVIRONMENT. PROACTIVE COMPLIANCE IS CHEAPER THAN REACTIVE PENALTIES.
Phase 1: Business and Industry Profile
Required Inputs
| Input | What to Ask | Default |
|---|
| Industry | "What industry are you in? (e-commerce, health, finance, education, food, SaaS)" | No default — must be provided |
| Business model | "What do you sell or provide?" | No default — must be provided |
| Location | "Where are you based and where do you sell? (states, countries)" | United States |
| Customer type | "Who are your customers? (consumers, businesses, minors, patients)" | Consumers (B2C) |
| Data collected | "What personal or sensitive data do you collect?" | Name, email, payment info |
| Team size | "How many employees or contractors?" | 1-10 |
GATE: Do not proceed without industry, business model, and location.
Phase 2: Universal Compliance
These apply to nearly all businesses. Check all that apply and complete accordingly.
## Universal Business Compliance
### Business Formation and Registration
- [ ] Business entity properly formed (LLC, Corp, etc.)
- [ ] Registered with Secretary of State
- [ ] EIN obtained from IRS
- [ ] State tax registration completed
- [ ] Local business license obtained (if required)
- [ ] DBA ("doing business as") filed (if using a trade name)
- [ ] Annual report filings current
### Tax Compliance
- [ ] Federal tax obligations identified (income, self-employment)
- [ ] State tax obligations identified (income, sales, franchise)
- [ ] Sales tax collection set up (if selling taxable goods/services)
- [ ] Sales tax nexus states identified
- [ ] Quarterly estimated tax payments scheduled
- [ ] 1099-NEC filing for contractors paid $600+
- [ ] W-2 filing for employees
- [ ] Payroll tax compliance (if employees)
### Employment and Contractor
- [ ] Worker classification correct (employee vs. contractor)
- [ ] Employment agreements in place
- [ ] I-9 forms completed for employees
- [ ] Workers' compensation insurance (if required by state)
- [ ] Anti-discrimination policies in place
- [ ] OSHA compliance (if applicable)
- [ ] Minimum wage and overtime compliance
### Data Privacy and Security
- [ ] Privacy policy published on website
- [ ] Cookie consent mechanism implemented (if EU visitors)
- [ ] CCPA compliance (if California customers and revenue >$25M or data thresholds)
- [ ] GDPR compliance (if EU customers)
- [ ] Data breach response plan documented
- [ ] PCI compliance (if processing credit cards)
- [ ] SSL/TLS certificate on website
### Consumer Protection
- [ ] Refund/return policy clearly posted
- [ ] Terms of service published
- [ ] FTC advertising guidelines followed (truthful, not deceptive)
- [ ] Testimonial and endorsement disclosures (FTC guidelines)
- [ ] Affiliate disclosures on all affiliate content
- [ ] CAN-SPAM compliance for email marketing
- [ ] Unsubscribe mechanism in all marketing emails
### Insurance
- [ ] General liability insurance
- [ ] Professional liability / E&O insurance (if providing services)
- [ ] Cyber liability insurance (if handling sensitive data)
- [ ] Product liability insurance (if selling physical products)
Phase 3: Industry-Specific Compliance
Select the applicable industry section and customize.
E-Commerce
## E-Commerce Compliance
- [ ] Sales tax collection in nexus states
- [ ] Marketplace facilitator laws compliance (if selling on Amazon, etc.)
- [ ] Product safety regulations (CPSC for consumer products)
- [ ] FTC labeling requirements (textiles, care labels, country of origin)
- [ ] ADA website accessibility (WCAG 2.1 AA recommended)
- [ ] Shipping and delivery disclosures
- [ ] Subscription billing compliance (ROSCA / state auto-renewal laws)
- [ ] Import/export regulations (if international)
Health and Wellness
## Health/Wellness Compliance
- [ ] FDA regulations (supplements, health claims, labeling)
- [ ] FTC health claim restrictions (no unsubstantiated claims)
- [ ] HIPAA compliance (if handling protected health information)
- [ ] State licensing requirements (if providing health services)
- [ ] Disclaimer that content is not medical advice
- [ ] Informed consent procedures (if providing services)
Financial Services
## Financial Compliance
- [ ] State money transmitter licenses (if handling payments)
- [ ] SEC/FINRA registration (if providing investment advice)
- [ ] Anti-money laundering (AML) procedures
- [ ] Know Your Customer (KYC) procedures
- [ ] Financial disclaimer (not financial advice)
- [ ] State lending/usury laws (if offering financing)
SaaS / Technology
## SaaS/Technology Compliance
- [ ] SOC 2 Type I or II (if handling customer data)
- [ ] GDPR compliance (DPA, data subject rights, breach notification)
- [ ] CCPA compliance
- [ ] COPPA compliance (if under-13 users)
- [ ] App store compliance (Apple/Google requirements)
- [ ] Open source license compliance
- [ ] Accessibility (Section 508 / WCAG)
- [ ] Data residency requirements
Education / Courses
## Education/Course Compliance
- [ ] FTC earnings claims guidelines
- [ ] Refund policy (state requirements vary)
- [ ] ADA/accessibility for course content
- [ ] COPPA (if under-13 students)
- [ ] FERPA (if handling student educational records)
- [ ] State education provider registration (some states require)
- [ ] Testimonial/results disclaimers
Phase 4: Compliance Management
## Compliance Tracking
### Compliance Calendar
| Obligation | Frequency | Due Date | Owner | Status |
|-----------|-----------|----------|-------|--------|
| [Annual report filing] | Annual | [Date] | [Who] | [Done/Pending] |
| [Sales tax filing] | [Monthly/Quarterly] | [Date] | [Who] | |
| [Privacy policy review] | Annual | [Date] | [Who] | |
| [Insurance renewal] | Annual | [Date] | [Who] | |
| [Tax return filing] | Annual | [Date] | [Who] | |
### Audit Preparation
- [ ] All compliance documentation organized and accessible
- [ ] Policies and procedures are current and dated
- [ ] Training records maintained
- [ ] Incident/complaint log up to date
- [ ] Third-party compliance certifications current
### Review Schedule
- Monthly: Tax filings, payroll compliance
- Quarterly: Privacy policy, advertising compliance, contractor classifications
- Annually: Full compliance audit, insurance review, license renewals
Example: Online Course Business
Key compliance areas: Business registration (LLC in Texas), sales tax (economic nexus in 5 states), FTC earnings claims compliance (uses income examples in marketing), CAN-SPAM for email list, privacy policy + cookie consent for website, CCPA compliance (California customers), refund policy posted, affiliate disclosures on recommended tools, testimonial disclaimers.
Gaps identified: No earnings disclaimer on sales pages, no CCPA "Do Not Sell" link, sales tax not collected in 2 nexus states.
Anti-Patterns
- Assuming compliance is a one-time task — regulations change. Review compliance at least annually.
- Copying a competitor's policies — their compliance obligations may differ from yours. Build from your specific situation.
- Ignoring state-level requirements — many compliance obligations vary by state (sales tax, employment law, licensing). Do not assume federal compliance is enough.
- No documentation — if you cannot prove compliance, you are not compliant in the eyes of an auditor.
- Waiting until you get caught — fines and penalties far exceed the cost of proactive compliance.
Recovery
- Discovered a compliance gap: Address it immediately. Document the gap, the remediation steps, and the completion date. Proactive remediation is viewed favorably.
- Received a regulatory notice: Consult an attorney immediately. Respond within the specified timeframe. Do not ignore it.
- Operating without required licenses: Apply immediately. Most regulatory bodies prefer voluntary compliance over enforcement.
- No compliance documentation: Start documenting now. Create a compliance folder and begin building records going forward.
