Run any Skill in Manus with one click

contract-gap-review

Stars0

Forks0

UpdatedMay 9, 2026 at 06:00

Reviews a third-party contract or master services agreement against named regulatory clause-coverage expectations and produces a clause-by-clause gap matrix with severity, remediation posture, and the legal-review triggers a control owner needs before signature, renewal, or assignment. Output is the second-line clause-coverage view that sits next to (not in place of) legal redlines. Best for: - A new vendor contract is in negotiation and the firm needs the second-line clause-coverage view before legal redlines land. - Renewal, assignment, or material amendment of an existing contract triggers a refresh against current regulatory expectations. - A digital-operational-resilience preparation cycle requires evidence that critical-or-important-function ICT contracts meet the mandatory-clause set. - A vendor-diligence pack needs the contract-coverage section closed out (chains via `contract_gap_summary`). Not the right tool when: - The criticality tier has not been set (run `criticality-assessment` first; clause

Installation

Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.

Run Skill in Manus

Source

anotb

anotb/second-line-financial-services

View GitHub Repository View Creator Repositories

Download

Run Skill in Manus

Related occupationsSOC

Based on SOC occupation classification

Compliance OfficersBusiness and Financial Operations Occupations·SOC 13-1041

File Explorer

13 files

SKILL.md

readonly

More from this repository

same repository

fintech-partner-controls

anotb/second-line-financial-services

Drafts the fintech-side controls evidence pack a sponsor bank's third-party risk function expects in its file: control inventory mapped to Reg E error-resolution timing, NACHA Operating Rules obligations the program operator owes upstream, FBO subledger reconciliation, sponsor-bank reporting cadence, customer-facing disclosure adherence (Reg E §1005.7-§1005.11, Reg DD), money-transmitter / MSB BSA posture where applicable, contract-clause adherence evidence under the program agreement, and a 12-month incident-history summary. Output is a Word memo plus an Excel control inventory, review-ready for the fintech's own second line and for production to the sponsor bank's TPRM team or to a state-MTL examiner. Best for: - A fintech, neobank, BaaS program, or wallet operator preparing or refreshing its self-evidence pack for a sponsor-bank annual review, sponsor-bank-led audit, or state-MTL exam. - Compliance has been asked to self-evidence Reg E §1005.11 error-resolution timing (10 / 45 / 90-day clocks), NACHA retu

2026-05-090

agentic-ai-controls

anotb/second-line-financial-services

Reviews and proposes controls for an agentic AI use case (an AI system that selects actions, calls tools, reads or writes systems of record, or operates with autonomy beyond single-turn generation) in a regulated financial-services firm. Output names the agent's scope and authority statement, the architecture and tool inventory with permissions and blast radius, the identity and authorisation posture, the human oversight points with effective oversight evidence, the prompt-injection-via-tool-output and tool-misuse threat assessment, the kill-switch and rollback procedures with drill evidence, the logging and audit posture, the incident response with regulator-notification triggers, the residual risk with accepted owners, and the recommended owner actions. Designed for second-line review of agents that book actions in real systems, not chat-only assistants. Best for: - A first-line owner has built or is building an agentic system that calls tools, reads from systems of record, or executes actions, and second-

2026-05-090

ai-risk-tiering

anotb/second-line-financial-services

Assigns a defensible risk tier (tier-1 through tier-4) to an AI or model use case using a multi-factor rubric, and books the tier alongside the named gates and validation depth it triggers. The tier is the routing decision that drives validation depth, monitoring frequency, committee path, and vendor-diligence depth for the rest of model risk and AI governance. Best for: - An intake record exists and second-line needs to set the tier before sequencing validation, monitoring, or committee work. - A periodic re-tiering exercise on the AI inventory after a change in scope, autonomy, customer exposure, vendor, or supervisory posture. - A sponsor has proposed a tier and second-line needs to challenge or concur with reasoning that an examiner can read. Not the right tool when: - The use case has not been intaked yet. Route to `ai-use-case-intake` first; the tier decision is decided against an intake record version. - The question is whether the use case is high-risk under the EU AI Act specifically. Route to `ai-

2026-05-090

ai-use-case-intake

anotb/second-line-financial-services

Turns a first-line AI or model use case description into a structured intake record at the front of the AI governance pipeline. Captures purpose, intended users, data sources, vendor and foundation-model dependencies, autonomy level, decision impact, regulatory exposure flags, proposed review gates, and the open questions a tier reviewer needs answered. The intake is the routing artifact downstream skills consume: ai-risk-tiering reads it to score the rubric, ai-act-triage reads it to scope Annex III overlap, model-card-builder reads it for system and data sections, validation-plan reads it to scope work, and the AI inventory of record consumes the structured object. Best for: - A first-line owner has proposed an AI use case and second-line needs the intake on file before tier, AI Act triage, or any downstream artifact is scoped. - An AI inventory refresh requires consistent intake metadata across in-flight, in-production, and decommissioned use cases. - A vendor-supplied AI tool is moving from POC to limite

2026-05-090

board-ai-risk-pack

anotb/second-line-financial-services

Drafts the AI risk committee pack the AI Governance Lead carries into the meeting: AI inventory state with heat map by tier, top AI risks with trajectory, recent AI incidents and near-misses, foundation-model vendor concentration, model performance trends, GenAI program status, AI governance maturity posture, and the decisions the committee owes this cycle. The pack is the firm's standing instrument for AI-specific board oversight, alongside (not inside) the enterprise risk committee pack. Best for: - Standing AI risk committee meeting (often quarterly) where the AI Governance Lead, CRO, and head of model risk need a curated view of AI posture rather than the full inventory dump. - The AI section of a board risk committee at firms without a standalone AI committee, when the board wants AI-specific framing rather than a heat-map row inside the enterprise pack. - Board education session on AI governance: tier mix, top risks, foundation-model exposure, GenAI program status, and the decisions in flight. - Regula

2026-05-090

genai-pre-prod-review

anotb/second-line-financial-services

Pre-production gate review for a GenAI use case before initial release or material expansion. Pulls together the upstream artifacts (intake, tier, model card, validation-plan results, prompt-injection review where applicable, RAG evaluation review where applicable, vendor evidence review where applicable) and produces a recommended decision (go, go-with-conditions, hold, no-go) with reasoning, named blocking and tracking conditions, owners, and source trace. The artifact a senior risk officer or AI risk committee secretary signs into the gate meeting. Best for: - A GenAI use case is at the pre-prod gate and the second-line function needs the gate-review memo with a clear recommendation. - A material expansion of an existing GenAI deployment (new user population, new tool, new corpus, new geography) needs a re-gate. - A regulator pre-meet, examiner request, or supervisory motion is asking for the gate package on a named GenAI use case. - A recurring revalidation cycle has triggered a gate moment and the commi

2026-05-090

name	contract-gap-review
description	Reviews a third-party contract or master services agreement against named regulatory clause-coverage expectations and produces a clause-by-clause gap matrix with severity, remediation posture, and the legal-review triggers a control owner needs before signature, renewal, or assignment. Output is the second-line clause-coverage view that sits next to (not in place of) legal redlines. Best for: - A new vendor contract is in negotiation and the firm needs the second-line clause-coverage view before legal redlines land. - Renewal, assignment, or material amendment of an existing contract triggers a refresh against current regulatory expectations. - A digital-operational-resilience preparation cycle requires evidence that critical-or-important-function ICT contracts meet the mandatory-clause set. - A vendor-diligence pack needs the contract-coverage section closed out (chains via `contract_gap_summary`). Not the right tool when: - The criticality tier has not been set (run `criticality-assessment` first; clause depth and the mandatory-clause overlay depend on tier). - The work is the full diligence pack rather than the contract layer (use `vendor-diligence`). - The work is exit and termination logistics rather than clause coverage (use `exit-plan`). - The work is portfolio-level concentration across many contracts (use `concentration-risk-review`).
argument-hint	[contract or MSA: vendor name, criticality tier, sector, AI-vendor flag]

Contract gap review

A contract gap review is what second-line produces so the named approver, head of TPRM, head of procurement, general counsel, business-owner SVP, can decide whether the contract is fit to sign, renew, or amend. The work is reading the contract against the firm's regulatory and operational frame, naming each clause that is present, partial, absent, or not-applicable, and writing the remediation posture the legal team will redline against. The skill stops at the gap matrix and the legal-review triggers. Counsel drafts language. The approver decides.

This skill produces the gap matrix as a markdown artifact (templates/default-output.md shape) and a structured record (schemas/contract-gap-review.schema.json) that downstream skills consume. Both pre-signature negotiation and the renewal or amendment cycle use the same workflow. The mandatory-clause overlay flips on for any contract that supports a critical-or-important function under the EU digital-operational-resilience act.

Ask first

Before drafting, get plain answers to four things. Most engagements answer them in the first conversation; if not, default and flag.

What tier is the arrangement. Sourced from criticality-assessment. Do not re-set it here. Tier drives clause depth and which mandatory-clause overlay loads. A non-critical arrangement gets a lighter pass on operational-resilience and exit clauses; a critical arrangement gets the full set with reviewer questions clustered for the forum that decides.
Is the arrangement in scope of the EU digital-operational-resilience act as a critical-or-important-function ICT service. Treat as a boolean. The mandatory-clause overlay is a real branch, not a side-note: when on, the gap matrix surfaces the enhanced clause set (termination triggers tied to supervisory recommendation, full description of services, locations of data processing, sub-outsourcing notification timing, exit-strategy and transitional support, audit-and-access for the firm and the competent authority).
What is the firm's regulatory profile. Institution type and primary regulators determine which sector overlay loads. Banking is not insurance is not capital markets is not payments-fintech. A dual-registrant or a sponsor-bank-program contract may need two sector overlays; flag the choice.
What is the review type. Pre-signature, renewal, assignment or change-of-control, material amendment, exit-triggered re-review, post-incident re-review, regulatory-change-driven re-review. Each carries a different evidence-ask and a different decision-forum context.

When scope is supplied, the skill consumes it (institution type, sector overlay set, cross-cutting overlay set, persona, source posture). When it is not supplied, ask the four questions and default to public posture if the practitioner declines. Note in the artifact that scope was not formalised; do not silently apply a default sector overlay.

How the gap matrix gets built

The matrix has the same spine across contract types. A senior reviewer fills it row by row, working off the contract document and the loaded overlays. Order follows the conversation, not a lockstep sequence.

The frame opens with the arrangement: vendor, contract identifier (MSA, SOW, order form, addenda), the criticality tier read from criticality-assessment, the supported business process and (where the firm has an IBS map) the important business service, the data scope (NPI, PHI, PCI, customer prompts, model outputs, training data, logs), the data locations and any cross-border flows, the AI-vendor flag, and the digital-operational-resilience-act in-scope flag. Both flags are set at the top; if either is true, the corresponding overlay is default-on for the rest of the matrix regardless of how the scope cross_cutting_overlay_set reads.

The clause-coverage matrix is the body. Every clause topic the regulatory frame names gets a row. The standard clause set spans scope and performance, responsibilities for compliance with applicable laws, audit and reporting rights including regulator examination access, ownership and licences, business-resumption and contingency, sub-contracting, confidentiality and information security, indemnification, limits on liability, insurance, dispute resolution, default and termination, and regulator-access continuity. For each row the matrix records the clause topic, the source criterion with section reference (or [verify section]), the contract reference (clause or section number), the coverage status (present, partial, absent, not-applicable), the gap rationale in plain language, the recommended-amendment posture (a posture, not legal language), and the severity (low, medium, high).

Reading the contract is where the matrix earns its keep. Each clause status is a finding, not a checkbox. "Right to audit subject to reasonable cooperation" reads as a reservation of vendor discretion, not as audit rights; mark as partial and surface the missing scope, frequency, cost-allocation, and remedy when the auditor's findings dispute vendor representations. "Industry-standard SLA" reads as below the firm's tolerance until proven otherwise; compare against the criticality output's RTO and RPO tolerance, not the vendor's default. "Notification of cybersecurity events within a reasonable period" reads against the tightest applicable clock (the firm's public-company materiality determination window where listed; the New York State 72-hour cybersecurity-event-notification clock where the firm is a covered entity; the EU digital-operational-resilience-act major-ICT-related-incident reporting timetable where in scope); flag the contract-clock-versus-regulatory-clock gap and the upstream notification-chain breakage. "Sub-processor flow-down" reads as a contractual mechanic, not visibility; the contract should also require sub-processor identification, change notification, and rejection rights. Limit-of-liability caps below the firm's expected loss are a finding, not a deal-closer.

The mandatory-clause overlay, when the arrangement is in scope of the EU digital-operational-resilience act as a critical-or-important-function service, populates the enhanced clause rows. The high-leverage items: termination rights tied to supervisory recommendation; full description of services; locations of data processing and storage; sub-outsourcing notification timing and rejection rights; exit-strategy and transitional support; audit-and-access rights for the firm and the competent authority. These are mandatory-by-source; absence is a high-severity finding regardless of the firm's bilateral position.

The cyber clause cluster carries notification timing, cooperation on incident response, encryption posture in-transit and at-rest, key-management model, vulnerability-management cooperation, pen-test rights, and shared-responsibility-model articulation for cloud arrangements. The privacy clause cluster carries data-processing-agreement coverage, sub-processor change-notice and rejection, deletion-and-return, retention windows, cross-border-transfer mechanism, and (where PHI is in scope) HIPAA business-associate-agreement execution. The AI clause cluster, when ai_vendor=true, carries training-data-use commitments, abuse-monitoring exception scope, model-version pin and deprecation-notice clock, evaluation-evidence access, agent-tool sandbox and audit-trail commitments, and incident-notification timing on a model-safety incident.

The matrix closes with the legal-review triggers, the open questions for the contract owner, and the reviewer questions clustered for the forum that decides (TPRM forum for an operational arrangement, risk committee for a critical vendor, AI risk committee for an AI vendor, fund board where the arrangement sits inside a registered fund). The summary severity is the highest individual-clause severity, except where two or more medium findings concentrate in a single cluster (audit, termination, incident-notification) and lift the summary to high by aggregation.

Chaining

The skill is downstream of criticality-assessment (consumes the tier) and vendor-diligence (the diligence pack's contract_gap_summary carries a one-paragraph headline plus a pointer to the record produced here). It chains upstream to exit-plan (the termination, exit, and transitional-support clauses produced here are read by the exit-plan workflow) and to dora-register-builder (the mandatory-clause coverage flags feed the register entries where the arrangement is in scope). Where the diligence pack is being built in parallel, the contract record's contract_gap_record_id is the link the diligence pack writes back into contract_gap_summary.

Quality bar

Holds across every gap matrix regardless of contract type, audience, or render format. Every material clause finding cites a source from references/source-anchors.md (or a loaded overlay) by path. Unsupported findings are marked [evidence needed]. Section references that cannot be confirmed get [verify section] rather than fabricated. Source criterion, contract excerpt, generated inference, and open legal question stay distinguishable in the matrix. No named institutions in narrative unless they are public defendants in a finalised enforcement action with a published consent order. The skill stops at the gap matrix and the legal-review triggers. Counsel drafts language; the approver decides. RFP narrative is not evidence, anywhere.

Adaptation

Flexes by engagement. Matrix depth and length scale to criticality and review type. Audience drives shape: a TPRM-forum matrix reads short and operational; a risk-committee matrix for a critical vendor reads longer with reviewer questions clustered for the forum; a general-counsel-facing matrix reads as a redline-readiness brief. The sector overlay set drives which references/sector-overlays/<sector>.md is loaded; a dual-registrant or sponsor-bank-program arrangement may load two. Cross-cutting overlay loading follows scope plus the rule that cyber and privacy default-on for AI vendors and for any contract touching NPI, PHI, PCI, or important-business-service controls. The mandatory-clause overlay loads only when the digital-operational-resilience-act in-scope flag is true. Render format (Word, Excel, PowerPoint, Markdown) follows the workflow.

Pointers

references/source-anchors.md — citations and excerpts for the named anchors.
references/sector-overlays/banking.md, insurance.md, capital-markets.md, payments-fintech.md — sector-specific clause expectations loaded per scope.
references/cross-cutting/cyber.md, privacy.md — cross-cutting clause clusters; default-on for AI vendors and for any contract touching regulated data or IBS controls.
references/firm-overlay.md — firm-installed contract policy, paper standards, named legal-review forums beyond the regulatory baseline; consumed when present.
templates/default-output.md — gap matrix template.
schemas/contract-gap-review.schema.json — structured-output contract for downstream consumption.
examples/ — cloud IaaS contract for a regional U.S. bank; digital-operational-resilience-act-in-scope SaaS contract for an EU subsidiary's collections platform.
TROUBLESHOOTING.md — recurring pitfalls (audit-rights reservation, notification-clock mismatch, sub-processor flow-down conflated with visibility, exit clauses skipped on non-critical, liability cap below expected loss, mandatory-clause overlay missed).

The plugin-level shared references (references/source-map.md, references/policy-control-library.md, references/review-gates.md) sit at the plugin root and are consulted alongside the skill-level files.

Output

The deliverable is the contract gap matrix. Default to drafting against templates/default-output.md. Render as Word, Excel, PowerPoint, or Markdown when the audience or workflow asks for it (a redline-readiness brief for counsel may want Word; a clause-by-clause portfolio cut may want a workbook; a critical-vendor risk-committee read may want a deck). Produce the structured record at schemas/contract-gap-review.schema.json when downstream automation or a registered consumer needs it.

Downstream consumers: vendor-diligence reads the record summary into contract_gap_summary and contract_gap_record_id; exit-plan reads the termination, transitional-support, and data-return clause findings; dora-register-builder reads the mandatory-clause coverage flags for the ICT-third-party register entries where the act applies; concentration-risk-review reads the sub-contracting and change-of-control findings where the portfolio analysis needs them.

When the structured record is produced, treat the schema as a downstream contract: additive changes only. Add fields, do not rename or repurpose them. A breaking change is a versioned migration with the downstream skills told in advance.