legal-compliance-policy-draftinglisted

Drafts or revises an internal policy or standard with testable control statements, named accountable roles, a real exception route, and a mandatory self-audit that lists every change made to the source text — including changes nobody asked for — so a reviewer approves the actual diff rather than a summary of it. Use when writing a new policy or standard, implementing a regulatory change into internal rules, revising a policy after an audit finding or incident, harmonising conflicting policies, or preparing a policy for approval and publication. Trigger on 'draft a policy', 'update the standard', 'write the procedure', 'revise this policy', 'policy review', 'turn this into a standard', 'implement this rule internally'. Not for reviewing a counterparty contract (use legal-compliance-contract-review) or for assessing what a new regulation requires in the first place (use legal-compliance-regulatory-change-impact).
alihusains/enterprise-skills · ★ 0 · AI & Automation · score 73

Install: claude install-skill alihusains/enterprise-skills

## Purpose Two failures dominate policy work. First, control statements nobody can test — "appropriate measures shall be taken" cannot pass or fail, so it cannot be audited and does not change behaviour. Second, silent edits: a reviewer approves a "tidied" document and unknowingly approves a changed obligation. This skill makes every statement testable and every change declared. ## Data classification **Internal** in draft; classification of the published document is stated in its own header. Policies quoting regulatory findings, incident detail, or counsel's advice are **Confidential and potentially privileged**. **STOP CONDITIONS:** | Trigger | Action | | --- | --- | | Counsel's advice, an investigation file, or regulator correspondence is pasted as source material | Stop. Do not reproduce privileged content in a document that will be widely published. Ask for the obligation, not the advice. | | Real incident detail naming employees or customers is offered as an example | Stop. Policies use constructed illustrations, not real cases. Ask for it to be removed. | | Customer or employee personal data, account numbers, or positions appear | Stop. Name the category, never the value. | | The user asks to weaken or remove a control to close an audit finding without a compensating control | Stop. Say plainly that this converts a finding into an accepted risk that nobody accepted. Route to the risk owner and the approval forum. | | The policy asserts compliance with a named law