ops-compliance-checklistlisted

# Compliance Checklist — Controls, Evidence, Audit Readiness **Most audit findings stem not from a missing control but from a control that was never "documented with evidence."** A checklist is the start of quality assurance, not the end (Gawande). ## Checklist-Writing Principles - Each item is **verb + object + a verifiable criterion** (e.g. "Access review complete — reconciled against per-system account list"). Vague phrasing ("managed appropriately") is banned; the verification method is stated in the item itself. - Length fits one screen (≤10–15 items). Beyond that it's a procedure, not a checklist. - **Bake the verdict into the item**: a 3-value "compliant / non-compliant / N/A" plus a mandatory evidence link. "Generally compliant" is an un-auditable verdict. - Assign each item a **named owner** and a cadence (daily / quarterly / annual). ## Regulatory Profile (pick one) - **SOC 2**: map to the Trust Services Criteria (security, availability, confidentiality, integrity, privacy); retain evidence ≥12 months. - **ISO 9001**: §7.5 documented information — approval, review, version, change history; state the review cadence for controlled documents. - **HIPAA/GDPR**: data classification (PII/PHI), least privilege, processing records, breach notification procedure. - **None**: confirm "no applicable regulation" explicitly after checking data classes — silent denial is itself an audit risk. ## Evidence Plan - For each control, table the **evidence type, collection cadence,