How to use the Compliance Readiness Check agent skill

What does the compliance-readiness skill make the agent do?

An agent skill is a folder containing a SKILL.md file. The file tells the agent when to use a specialised procedure and how to carry it out. This skill covers the moments when a compliance program is about to change: before adopting a new framework, before finalising the annual audit calendar, or before a certification stage 1 readiness sign-off.

The agent works through six questions. It checks which frameworks apply, where they overlap, who owns each piece of evidence, whether the audit calendar and auditor independence are sound, how a mock audit's findings are distributed, and whether management reviews are integrated across frameworks.

• Question 1: have you named every applicable framework?
• Question 2: where do the frameworks overlap, and what is the reuse leverage?
• Question 3: who owns each artefact, and which artefacts have the highest reuse score?
• Question 4: is the audit calendar sound and is auditor independence respected?
• Question 5: what does a mock audit produce, and is the severity distribution healthy?
• Question 6: is the management review cadence integrated across frameworks?

How do you install the compliance-readiness skill?

Download the ZIP file from the page where you found this skill. Unzip it into one of the skill folders that Claude Code reads. For a personal install, use ~/.claude/skills/. For a single project, use the .claude/skills/ folder inside that project.

If you use the Claude apps instead, open Settings, go to Capabilities, then Skills, and upload the skill there.

• Personal install: unzip into ~/.claude/skills/
• Project install: unzip into .claude/skills/ inside your project folder
• Claude apps: Settings → Capabilities → Skills, then upload the skill

What input files do you need to prepare?

The helper scripts read JSON input files that you prepare yourself. The skill's source names three of them: profile.json for the company profile, program.json for the compliance program, and scope.json for the mock audit scope. The source file does not describe the fields these files should contain, so check the helper scripts or the compliance-os plugin for the expected format.

The quality of these inputs sets the quality of the results. The mock audit is a simulation driven by what you enter, so incomplete or optimistic inputs will produce an optimistic report.

How do you trigger the skill with a request?

The documented way to run the skill is the slash command with the name of your program. You can also describe what you need in plain language, such as asking for a readiness check before you add a second framework or before a stage 1 audit. The skill is intended for three situations: before starting a new framework, when planning an annual audit calendar across standards, and when preparing for certification stage 1.

Name the program clearly in your request so the agent knows which compliance program to examine.

• Slash command: /compliance-os:compliance-readiness <program>
• Plain request: ask for a readiness check on a named program before adopting a new framework
• Plain request: ask for an audit calendar review across the standards you hold

What does the readiness report contain?

The report follows a fixed template. It opens with the decision being made, then lists the framework set, cross-framework overlap, the evidence pool, the audit calendar, and mock audit results for each framework. The verdict is one of three values: green READY, yellow STAGE-2-CANDIDATE, or red NOT-READY. The report ends with three concrete next steps with owners and dates.

The source gives a healthy severity distribution as at least 40% observation findings and at most 15% critical findings. Treat these as the skill's stated thresholds, not as values confirmed by an external standard.

• Framework set: applicable, binding, certifiable, and missing dependencies
• Evidence pool: artefact count, high-leverage count, stale evidence rate, unowned artefacts
• Audit calendar: frameworks scheduled, auditor independence Y/N, conflicts
• Verdict: READY, STAGE-2-CANDIDATE or NOT-READY
• Top 3 actions with owners and dates

What should you know about scripts, network and safety?

The skill runs Python helper scripts: framework_selector.py, cross_framework_mapper.py, evidence_pool_generator.py and audit_simulator.py. The source states that the skill does not use the network. The scripts and the compliance-os plugin folder they live in are referenced but are not included in the reviewed file, so you need to obtain them separately before the scripts will run.

The skill is a checklist and report template. It does not give legal advice, and it does not verify the framework requirements it refers to. Its output is not a substitute for a qualified auditor, lawyer or certification body. Read any script before you run it, as you would with any code.

• Requires Python to run the helper scripts
• Requires your own profile, program and scope JSON files
• Requires the compliance-os plugin folder and its scripts
• Runs scripts: yes. Uses network: no, according to the source

What are good tips for getting useful results?

Run the helper scripts in the order given in the workflow, because each step builds on the one before. Keep your input files accurate, and record who owns each piece of evidence before you run the mock audit. If evidence collection has grown by 50% or more year over year, or an audit produced more than 15% critical findings, the skill treats these as warning signs worth investigating.

• Run the four scripts in order: framework selection, overlap, evidence pool, mock audit
• Assign one accountable owner to every artefact
• Run the mock audit once per framework in scope
• Use the verdict as a prompt for action, not a final decision