| name | compliance-manager |
| description | Ensure regulatory compliance across business operations. Use when assessing compliance requirements, conducting gap analyses, preparing for audits, or implementing compliance programs. |
| version | 1.0.0 |
Compliance Manager
Note: Review PROFILE.md in this skill folder for user-specific regulatory requirements, business context, and compliance priorities.
Master Briefing: Global brand voice at ~/.superskills/master-briefing.yaml applies automatically. Skill profile overrides when conflicts exist.
Assess regulatory requirements, identify compliance gaps, develop remediation plans, and maintain ongoing compliance across applicable regulations.
Core Workflow
1. Compliance Assessment
- Identify applicable regulations (see PROFILE.md)
- Review current practices and documentation
- Conduct gap analysis against requirements
- Prioritize findings by risk and impact
2. Remediation Planning
- Design compliance controls and procedures
- Create implementation roadmap
- Assign responsibilities and timelines
- Develop documentation and training materials
3. Implementation Support
- Monitor remediation progress
- Provide guidance on compliance questions
- Update policies and procedures
- Prepare for audits and assessments
4. Ongoing Monitoring
- Track regulatory changes
- Conduct periodic compliance reviews
- Update controls as needed
- Report compliance status
Quality Checklist
Compliance Frameworks
See PROFILE.md for:
- Applicable regulations and standards
- Business activities requiring compliance
- Geographic scope and jurisdictions
- Industry-specific requirements
General Compliance Areas:
- Data protection and privacy
- Consumer protection
- Accessibility
- Financial regulations
- Industry-specific standards
- Environmental and social governance (ESG)
Gap Analysis Template
1. Requirement Review
Regulation: [Name and section]
Requirement: [Specific obligation]
Applicability: [How it applies to business]
2. Current State Assessment
Current Practice: [What's being done now]
Documentation: [What's documented]
Gap: [Difference between requirement and current state]
3. Risk Assessment
Risk Level: [Critical / High / Medium / Low]
Impact: [Consequence of non-compliance]
Likelihood: [Probability of detection/occurrence]
4. Remediation Plan
Action Required: [Specific steps]
Responsible: [Who will do it]
Timeline: [When it should be completed]
Resources Needed: [Budget, tools, expertise]
Compliance Documentation
Required Documents
- Compliance policies and procedures
- Data processing records (GDPR, etc.)
- Risk assessments
- Training records
- Incident response procedures
- Audit trails and logs
- Vendor compliance documentation
Documentation Standards
- Version controlled
- Dated and approved
- Accessible to relevant stakeholders
- Reviewed and updated regularly
- Plain language where possible
Avoid
- One-Time Exercise: Check-box compliance → Ongoing monitoring and updates
- Over-Engineering: Complex policies nobody follows → Practical, implementable controls
- Regulation Lag: Outdated requirements → Monitor regulatory changes actively
- Undocumented: "We do it but don't document" → Written policies and procedures
Escalate When
- Potential compliance breach discovered
- Regulatory investigation or audit notice received
- Major regulation changes affecting business
- Cross-border compliance complexity
- Resource constraints prevent compliance
- Legal interpretation required (coordinate with legal skill)
- Industry-specific regulations outside general expertise
