Compliance monitor

Skill bromso/metapowers/plugins/legal/skills/compliance-monitor

Design ongoing compliance monitoring and reporting cadenceFrom its SKILL.md

Install

npx -y skills add bromso/metapowers --skill compliance-monitor

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

One thing to look at

1 stars1 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

SKILL.md

4.6 KB, 966 tokens by cl100k_base, as published. Nobody here has run it

Compliance Monitor

Design ongoing compliance monitoring and reporting for "$ARGUMENTS". Define monitoring scope per regulation, create dashboard metrics, assign compliance owners, and establish reporting cadence.

Note: AI-generated legal content does not constitute legal advice. Consult a qualified attorney.

Prerequisites

Check that .metapowers/legal/$ARGUMENTS/00-assess.md exists. If it does not exist, stop and tell the user:

"Run an Assess skill first (e.g. /legal:risk-assessment $ARGUMENTS) to generate the prerequisite assessment artifact."

If the user passes --skip-checks, bypass this check and log the skip to .metapowers/legal/$ARGUMENTS/skip-log.md with a timestamp and the reason "Prerequisite check skipped for compliance-monitor".

Process

Read inputs:
- Read .metapowers/legal/$ARGUMENTS/00-assess.md for risk context, applicable regulations, and jurisdiction
- Review any existing compliance artifacts in .metapowers/legal/$ARGUMENTS/
Define monitoring scope per regulation:
- GDPR:
  - Quarterly data mapping review
  - Annual DPIA (Data Protection Impact Assessment) refresh
  - Ongoing data subject request tracking
- CCPA:
  - Annual privacy policy update
  - Consumer request response time monitoring
  - Vendor data sharing audit
- SOC 2:
  - Continuous control monitoring
  - Evidence collection automation
  - Exception tracking and remediation
- Accessibility (WCAG):
  - Quarterly automated accessibility scan
  - Annual manual audit by qualified assessor
  - User complaint tracking and resolution
- For each regulation, define what "compliant" looks like with measurable criteria
Create compliance dashboard metrics:
- % controls operating effectively — ratio of passing controls to total controls
- Open findings — count and severity of unresolved compliance findings
- Days to remediate — average time from finding discovery to resolution
- Audit readiness score — composite score reflecting documentation completeness, control effectiveness, and evidence availability
- Define thresholds for each metric (green/yellow/red status)
Assign compliance owners per regulation:
- Map each regulation to a primary compliance owner
- Define backup owners for coverage during absences
- Establish clear accountability for control operation, evidence collection, and issue resolution
- Document owner responsibilities and expected time commitment
Define escalation procedures for non-compliance:
- Level 1 — owner self-remediates within defined timeline
- Level 2 — manager notification if remediation deadline missed
- Level 3 — executive escalation for high-severity or persistent non-compliance
- Level 4 — board notification for material compliance failures
- Define what triggers each escalation level and expected response times
Set reporting cadence:
- Monthly — operational compliance report to compliance team (control status, open findings, remediation progress)
- Quarterly — executive compliance summary (dashboard metrics, trend analysis, risk highlights)
- Annual — board-level compliance report (regulatory landscape, audit results, strategic compliance investments)
- Define report templates and distribution lists for each cadence
Create compliance calendar:
- Map all regulatory deadlines, filing dates, and renewal dates
- Schedule internal audits and reviews
- Include training deadlines and certification renewals
- Set preparation milestones ahead of each deadline
Write the artifact to .metapowers/legal/$ARGUMENTS/04-govern.md with frontmatter:
```
---
description: Compliance monitor for $ARGUMENTS
---
```
Include sections:
- Monitoring Scope — per-regulation monitoring activities and frequencies
- Dashboard Metrics — metric definitions, thresholds, and data sources
- Compliance Owners — responsibility matrix by regulation
- Escalation Procedures — escalation levels, triggers, and response times
- Reporting Cadence — report types, audiences, and schedules
- Compliance Calendar — key dates and milestones

Output

The compliance monitor written to .metapowers/legal/$ARGUMENTS/04-govern.md. Present a summary to the user highlighting:

Number of regulations under active monitoring
Key dashboard metrics and their current thresholds
Compliance owner assignments and any gaps
Upcoming compliance calendar deadlines

What ships with it

Read from the repository

Just SKILL.md. No reference files, no scripts.

Gives 0 of the 12 instructions most audit compliance skills give in 966 tokens

Counted across 937 of the 1,487 authors here whose files we hold, read 2026-08-07

Fetch latest guidelines before each reviewin 43 of 937, across 3 files
Group findings by severityin 43 of 937
Check files against all fetched rulesin 42 of 937, across 2 files
Output findings in terse file:line formatin 41 of 937, across 3 files
Ask user which files to review if none specifiedin 41 of 937, across 3 files
Read specified files or prompt user for filesin 39 of 937, across 1 file
Generate the audit reportin 33 of 937, across 30 files
Assign a severity to every findingin 25 of 937
Run automated accessibility scansin 23 of 937, across 13 files
Output a markdown audit reportin 22 of 937
Map findings to WCAG criteriain 20 of 937, across 10 files
Confirm audit scopein 19 of 937, across 9 files

Said here and by no other author read

verify the prerequisite assessment file exists
stop if the prerequisite file is missing
log skipped prerequisite checks with timestamp
define measurable compliance criteria per regulation
assign primary and backup compliance owners per regulation
create escalation procedures with defined response times

Grouped from the skills themselves: near-identical wordings counted once, and counted by distinct author, so one author publishing three of these counts once. Length counted with cl100k_base; the agent that loads this file may tokenize it differently.