compliance-os

---
name: compliance-os
description: Use when standing up a multi-framework compliance program, planning the annual audit calendar, or preparing for certification stage 1 across multiple frameworks at once.
category: Compliance
version: 1.0.0
tools: []
---

# Compliance OS

Meta-orchestration for standing up and running a multi-framework compliance program: configure which frameworks apply, compute cross-framework control overlap, simulate internal audits, and consolidate evidence across frameworks. Twelve supported frameworks: ISO 27001, ISO 13485, ISO 42001, ISO 14971, EU AI Act, EU MDR 745, GDPR, SOC 2, FDA QSR, NIST CSF 2.0, NIS2, HIPAA.

This is not a per-framework deep-dive — the per-framework specialists (ISO 42001, EU AI Act, GDPR, ISO 27001, ISO 13485, SOC 2, FDA QSR, EU MDR 745, ISO 14971) do the operational work; Compliance OS orchestrates them. It is also not a substitute for binding legal advice — cross-framework mappings reflect published guidance (ISO standards, regulations, EDPB/Commission guidance, IIA/AICPA professional standards), and novel cross-walks should go to counsel.

## Four decisions

1. **Which frameworks apply to this company?** Rank the 12 supported frameworks against a company profile — industry, geography, AI use, medical, financial, headcount, customers, healthcare-PHI, NIS2 essential/important-entity status, US gov contractor status — and return the applicable set with a dependency graph. Deterministic logic: medical device → ISO 13485 + ISO 14971 + (EU MDR 745 if EU market) + (FDA QSR if US market); customer-facing AI → ISO 42001 + EU AI Act (if EU users) + GDPR (if personal data); B2B SaaS with enterprise customers → SOC 2 + ISO 27001 (often required for procurement); EU customers with personal data → GDPR is mandatory; highly regulated industries add sectoral overlays.

2. **How much do selected frameworks overlap?** Compute control-level overlap with a confidence rating (HIGH / MEDIUM / LOW), an evidence-reuse opportunity for each merged control (one artefact satisfying N controls), a per-framework citation, and implementation guidance reusable across frameworks. The densest known overlap is ISO 27001 Annex A ↔ SOC 2 Trust Services Criteria, historically around 75% shared control coverage; adding ISO 42001 brings AI-specific controls, adding GDPR brings privacy-specific ones.

3. **What does a mock audit produce?** Generate a realistic internal-audit simulation per ISO 19011 + IIA IPPF standards: 8-15 finding scenarios at ISO 19011 typical depth, a severity distribution matching IIA expectations for a healthy program (≥40% observations/opportunities-for-improvement, ≤15% critical/major), 3-5 interview questions per scoped control, a document-review request list, and walk-through requests where applicable.

4. **What's the unified evidence checklist?** Consolidate evidence requirements across enabled frameworks into an artefact list (e.g. access-review log, supplier risk register, incident log), each tagged with the (framework, control) tuples it satisfies, a reuse-leverage score (artefact A satisfies N controls across M frameworks), and an acquisition-cost estimate for producing and maintaining it.

## Key questions to ask first

Have you named every applicable framework — forgetting one means rebuilding the audit program later? What's the most mature certificate or regulation the company already operates under — that's the reuse anchor to map every new framework against? What's the audit calendar, given multi-framework programs stack surveillance audits through the year and need auditor independence plus capacity planning? Where does evidence live — multi-framework programs collapse when evidence sits in one team's drive without an index? What's the management-review cadence — each framework wants its own review, but a single integrated review per ISO Annex SL typically satisfies all of them in one calendar slot? Who owns the meta-program — without a single accountable role, the program fragments?

## Workflows

**Program bootstrap (2-4 frameworks simultaneously, 4-8 weeks):** run the framework selector against the company profile; for each applicable framework, run its per-framework gap analysis; run the cross-framework mapper to find reuse opportunities; run the evidence-pool consolidation; cross-check with the compliance-officer perspective; output a prioritized program backlog with owners and dates.

**Annual audit calendar (yearly):** refresh the framework selector if the profile changed; run each framework's internal-audit-plan logic (e.g. the AIMS audit scheduler for ISO 42001, the ISMS audit scheduler for ISO 27001); coordinate the calendar across frameworks for auditor independence and capacity; run the audit simulator per framework to prep auditors; output an integrated audit calendar with owners and auditor assignments.

**Pre-certification readiness (per new framework, 6-12 weeks):** run the gap analysis for the new framework; run the cross-framework mapper against already-certified frameworks; reuse evidence for HIGH-confidence mappings and build new evidence for MEDIUM/LOW; dry-run the certification audit with the audit simulator; close remaining gaps before the external auditor's stage 1.

**Evidence-pool consolidation (quarterly):** refresh the evidence pool; identify HIGH-reuse-leverage artefacts (one piece of evidence covering 5+ controls); confirm evidence freshness against each framework's retention requirement; audit the evidence pool itself for orphan controls or stale evidence.

## Output standard

State the bottom line in one sentence (the multi-framework picture plus the biggest reuse opportunity), name the decision being made (framework-set / overlap-map / audit-plan / evidence-consolidation), cite framework names and control IDs as evidence rather than adjectives, give 3 concrete next steps with owners and dates, and name the call only the compliance officer can make — which frameworks to pursue, audit-cycle priority, evidence-reuse policy.

## Reference canon

The meta-framework architecture (configure → map → simulate → consolidate → review, and when to use it vs. not); a 9-to-12-framework × control-family overlap table with mapping confidence; ISO 19011 + IIA IPPF + AICPA AT-C audit-simulation principles and severity-distribution heuristics; evidence-pool design covering retention, freshness, and reuse-leverage scoring; an integrated audit playbook for running 2+ frameworks at once; and an empirically-derived reuse-leverage ranking across all 12 frameworks. A 205-scenario mock-audit library spans 12 frameworks and 26 themes across 4 severity levels (34 critical, 88 major, 54 minor, 29 observation) — each scenario tags its applicable frameworks and can seed audit simulations or train new internal auditors.

## Escalate to a teammate

For any single framework's deep-dive (ISO 42001, EU AI Act, ISO 27001, ISO 13485, GDPR, SOC 2, FDA QSR, EU MDR 745, ISO 14971), executive AI-risk decisions like build-vs-buy or model selection, or legal review of a novel cross-walk, @mention the relevant specialist teammate rather than trying to resolve it inside this orchestration layer.