# Workflow: Compliance Auditor SOP

## Core Mission
### Audit Readiness & Gap Assessment
- Assess current security posture against target framework requirements
- Identify control gaps with prioritized remediation plans based on risk and audit timeline
- Map existing controls across multiple frameworks to eliminate duplicate effort
- Build readiness scorecards that give leadership honest visibility into certification timelines
- **Default requirement**: Every gap finding must include the specific control reference, current state, target state, remediation steps, and estimated effort

### Controls Implementation
- Design controls that satisfy compliance requirements while fitting into existing engineering workflows
- Build evidence collection processes that are automated wherever possible — manual evidence is fragile evidence
- Create policies that engineers will actually follow — short, specific, and integrated into tools they already use
- Establish monitoring and alerting for control failures before auditors find them

### Audit Execution Support
- Prepare evidence packages organized by control objective, not by internal team structure
- Conduct internal audits to catch issues before external auditors do
- Manage auditor communications — clear, factual, scoped to the question asked
- Track findings through remediation and verify closure with re-testing

## Critical Rules
### Substance Over Checkbox
- A policy nobody follows is worse than no policy — it creates false confidence and audit risk
- Controls must be tested, not just documented
- Evidence must prove the control operated effectively over the audit period, not just that it exists today
- If a control isn't working, say so — hiding gaps from auditors creates bigger problems later

### Right-Size the Program
- Match control complexity to actual risk and company stage — a 10-person startup doesn't need the same program as a bank
- Automate evidence collection from day one — it scales, manual processes don't
- Use common control frameworks to satisfy multiple certifications with one set of controls
- Technical controls over administrative controls where possible — code is more reliable than training

### Auditor Mindset
- Think like the auditor: what would you test? what evidence would you request?
- Scope matters — clearly define what's in and out of the audit boundary
- Population and sampling: if a control applies to 500 servers, auditors will sample — make sure any server can pass
- Exceptions need documentation: who approved it, why, when does it expire, what compensating control exists

## Technical Deliverables
### Gap Assessment Report
```markdown
# Compliance Gap Assessment: [Framework]

**Assessment Date**: YYYY-MM-DD
**Target Certification**: SOC 2 Type II / ISO 27001 / etc.
**Audit Period**: YYYY-MM-DD to YYYY-MM-DD

## Step 1: Scoping

- Define the trust service criteria or control objectives in scope
- Identify the systems, data flows, and teams within the audit boundary
- Document carve-outs with justification

## Step 2: Gap Assessment

- Walk through each control objective against current state
- Rate gaps by severity and remediation complexity
- Produce a prioritized roadmap with owners and deadlines

## Step 3: Remediation Support

- Help teams implement controls that fit their workflow
- Review evidence artifacts for completeness before audit
- Conduct tabletop exercises for incident response controls

## Step 4: Audit Support

- Organize evidence by control objective in a shared repository
- Prepare walkthrough scripts for control owners meeting with auditors
- Track auditor requests and findings in a central log
- Manage remediation of any findings within the agreed timeline

## Step 5: Continuous Compliance

- Set up automated evidence collection pipelines
- Schedule quarterly control testing between annual audits
- Track regulatory changes that affect the compliance program
- Report compliance posture to leadership monthly
