Compliance & Risk

Draft a compliance policy for [regulation/topic]:

Topic: [what policy covers]
Regulation: [applicable laws/standards]
Industry: [your industry]
Scope: [who it applies to]
Risk level: [compliance risk]
Current state: [existing practices]

Policy structure:
- Purpose and scope
- Regulatory background
- Policy statement (core requirements)
- Roles and responsibilities
- Prohibited activities
- Required procedures
- Exceptions and approval process
- Monitoring and enforcement
- Training requirements
- Reporting violations
- Consequences of non-compliance
- Review and update schedule
- Effective date
- Approval signatures

Create a compliance audit plan for [area]:

Audit scope: [what you're auditing]
Regulations: [applicable rules]
Prior audit findings: [previous issues]
Risk assessment: [areas of concern]
Timeline: [when audit occurs]
Resources: [audit team]

Audit plan:
- Audit objectives
- Scope and exclusions
- Compliance requirements checklist
- Testing procedures by requirement
- Sample sizes and selection criteria
- Documentation to review
- Interviews needed
- Testing timeline
- Reporting format
- Issue classification (critical, major, minor)
- Remediation expectations
- Follow-up procedures

Build a risk assessment for [business area/process]:

Area: [what you're assessing]
Regulatory environment: [applicable rules]
Business activities: [operations]
Current controls: [what's in place]
Incidents: [past issues if any]

Risk assessment:
- Risk identification by category
- Likelihood rating (1-5)
- Impact rating (1-5)
- Inherent risk score
- Current control effectiveness
- Residual risk score
- Control gaps
- Risk tolerance vs actual
- Mitigation recommendations
- Priority actions
- Ownership assignment
- Timeline for remediation

Format as risk matrix/heatmap.

Develop an incident response plan for [incident type]:

Incident type: [data breach, violation, etc.]
Regulatory obligations: [reporting requirements]
Stakeholders: [who needs to know]
Current readiness: [existing capabilities]
Risk level: [potential impact]

Response plan:
- Incident classification criteria
- Response team and roles
- Detection and reporting procedures
- Initial assessment steps
- Containment actions
- Investigation process
- Regulatory notification requirements
- External communication approach
- Remediation procedures
- Documentation requirements
- Lessons learned process
- Testing and update schedule

Create a regulatory update brief on [new regulation]:

Regulation: [name and reference]
Effective date: [when it takes effect]
Your organization: [industry and operations]
Current state: [compliance status]
Gap: [what needs to change]

Brief contents:
- Executive summary
- Regulation overview
- Specific requirements
- Impact on organization
- Gap analysis
- Compliance roadmap
- Resource requirements
- Implementation timeline
- Accountability
- Training needs
- Monitoring approach
- Risks of non-compliance
- Recommendations

Design a compliance training program for [topic]:

Topic: [compliance area]
Audience: [who needs training]
Current knowledge: [baseline]
Regulatory driver: [why required]
Format: [online, in-person, etc.]
Frequency: [how often]

Training program:
- Learning objectives
- Content outline by module
- Real-world scenarios and examples
- Interactive elements
- Assessment/quiz questions
- Passing criteria
- Duration per module
- Delivery method and platform
- Tracking and documentation
- Refresher training schedule
- Effectiveness measurement
- Updates and maintenance

Establish documentation standards for [compliance area]:

Compliance area: [what needs documenting]
Regulatory requirements: [what's mandated]
Audit frequency: [how often reviewed]
Retention period: [how long to keep]
Current practice: [existing approach]

Standards definition:
- What must be documented
- Documentation format and templates
- Required information elements
- Approval and sign-off requirements
- Version control approach
- Storage location and access
- Retention schedule
- Disposal procedures
- Audit trail requirements
- Training on standards
- Monitoring compliance with standards
- Exception handling

Create a remediation plan for [compliance finding]:

Finding: [describe issue]
Source: [audit, regulator, internal]
Severity: [critical, high, medium, low]
Regulation violated: [which rule]
Root cause: [why it happened]
Current state: [scope of issue]

Remediation plan:
- Issue description and impact
- Root cause analysis
- Immediate corrective actions
- Long-term preventive measures
- Control enhancements
- Timeline and milestones
- Resource requirements
- Responsibility assignments
- Validation and testing
- Monitoring and reporting
- Communication to stakeholders
- Evidence of remediation
- Sign-off process