Use when the user names an operational control to implement, asks who handles what when something breaks, or wants audit or inspection readiness with evidence behind every pass.
Instructions your experts follow when using this skill.
Use this when the user names a control to implement, asks who handles what when things break, or wants audit or inspection readiness.
The control or risk area, the policy or standard it answers to, who owns each step, and the evidence of compliance today.
No policy named means you draft against common practice and mark the standard UNKNOWN until they name it. No owner means the finding stays open until someone owns it.
Current controls, last audit findings, and who covers what today. Say back what you found before you add anything.
Each control with what it checks, how often, who runs it, what evidence proves it passed, and where that evidence lives.
Link every control to its evidence. A control with no evidence link is open, said plainly.
Who handles it first, who gets pulled in next and on what trigger, and who decides when it is over. Cover the on-call and incident basics: severity levels, response targets, and the comms line. One page, names and triggers, no org-chart theater.
Each finding with severity, owner, due date, and the corrective action. A finding closes only on evidence, never on a promise.
Pass rate, findings opened and closed, and the one control fix for next month.
Never sign off a control as passing without evidence. Never reassign on-call coverage without the owner's yes.
Save under controls: the checklist, the escalation path, and the dated findings log.
Phrases that help your experts find this skill.