Skip to content

SOP-033 — Compliance checklist

Guide

<!-- last-reviewed: 2026-06-01 · owner: Legal & Compliance (Compliance Analyst) -->

SOP-033 — Compliance checklist

SOP · owner: Legal & Compliance (Compliance Analyst). Layer: SOP/Runbook (docs/canon.md). Procedure for building and maintaining status-tagged compliance checklists that track obligations to closure. Feeds the Legal Director’s register (SOP-032 (docs/sop/SOP-032-compliance-register.md)).

Interface Contract

  • Inputs: obligation source (ADR / ToS / policy) ← from Legal Director · trigger: “audit requested”
  • Outputs: compliance checklist + evidence → to Legal Director · trigger: “scan complete”
  • Outputs: legal-opinion question + evidence → to Legal Director · trigger: “escalation requested”
  • Handoff trigger (in): the Legal Director requests a checklist, or a new obligation (new ADR, ToS update, policy change) appears
  • Handoff trigger (out): every in-scope obligation has a status (open / compliant / waived-with-reason), a cited source+date, and the file that will close it
  • Definition of Done before handoff:
    • [ ] Each obligation item carries status, severity, source citation + date
    • [ ] Each open item names the owner and the file/migration that closes it
    • [ ] Items needing a legal opinion routed to the Legal Director (escalation requested), not answered
    • [ ] Checklist handed to the Legal Director; learnings captured if any

Trigger note. audit requested, scan complete, and escalation requested are registered verbatim phrases (Wave 1 additions, Operations-approved 2026-06-01) in docs/handoff-triggers.md. The producer/consumer phrasing is mirrored verbatim with SOP-031/032/034 so the register reconciles green.

Purpose

Turn obligations that live as prose (e.g. inside ADR-0017) into a tracked, citable checklist so the Legal Director and Principal can see, at a glance, what must be done, by whom, by when — and prove it.

When to use

On a Legal Director request (audit requested), when a new ADR/ToS/policy creates obligations, or on periodic refresh. The richest current source is ADR-0017, which holds ≥5 discrete open obligations with named owners but no checklist tracking them.

Flow

flowchart LR
  A["Locate primary<br/>source (ADR/ToS/policy)"] --> B["Extract obligations"]
  B --> C["Status + severity<br/>+ owner + closing file"]
  C --> D{"Needs legal<br/>opinion?"}
  D -->|yes| E["Route to Legal Director<br/>(escalation requested)"]
  D -->|no| F["Record status"]
  E --> G["Hand checklist<br/>→ Legal Director"]
  F --> G
  classDef s fill:#1d4ed8,color:#fff,stroke:#1e3a8a
  classDef d fill:#0f766e,color:#fff,stroke:#134e4a
  class A,B,C,E,F,G s
  class D d

Text fallback: locate the primary source → extract each obligation → tag status, severity, owner, and the file that closes it → if an item needs interpretation, route it to the Legal Director with evidence; otherwise record its status → hand the completed checklist to the Legal Director.

Steps

  1. Locate the primary source (read the actual ADR/ToS/policy text — not a summary).
  2. Extract obligations: permitted uses, required actions, prohibited uses, expiry.
  3. Compare against current practice — is each obligation actually met? Cite the file that proves it, or mark open.
  4. Classify each item: status (open / compliant / waived-with-reason), severity (critical / moderate / low), owner, and the file/migration that closes it.
  5. Escalate any item needing a legal opinion to the Legal Director with evidence attached (escalation requested) — do not answer it yourself.
  6. Hand the checklist to the Legal Director (scan complete); capture learnings.

Roles / approvers

Authored and run by the Compliance Analyst; legal interpretation and severity calls by the Legal Director; closure evidence from the named owner (often Engineering).

Guardrails

  • Cite sources + dates. Undated/unsourced items are flagged unverified.
  • Label confidence: confirmed vs. inferred vs. unknown. No “probably fine.”
  • No legal opinions — route them up (.claude/agents/compliance-analyst.md).
  • No security-control or HR-policy edits — track whether, not author.

See also: SOP-032 (docs/sop/SOP-032-compliance-register.md) · charter (docs/units/legal-compliance/charter.md) · ADR-0017 (primary obligation source).