janderscience-skills 0.0.0-stage → 1.0.0

package/sources/headcount/plugins/legal-risk/skills/corporate-governance/references/sources.md

@@ -0,0 +1,33 @@
+# Sources — `legal-risk:corporate-governance`
+
+<!-- Generated by scripts/build-sources.py from sources/*.toml. Do not edit. -->
+
+Check these before answering on anything they cover, and cite what you used. The use note on each one is binding: most of what a professional cites is free to read and not free to reproduce.
+
+## 17 CFR Part 243 — Regulation FD
+
+US Securities and Exchange Commission · US · public domain (US government) — quote freely
+
+<https://www.ecfr.gov/current/title-17/chapter-II/part-243>
+
+**Authoritative for:** When selective disclosure of material nonpublic information triggers a mandatory public disclosure, and on what timeline. The rule that decides whether a given investor conversation was lawful.
+
+## Delaware General Corporation Law
+
+State of Delaware · US-DE · public domain — quote freely
+
+<https://delcode.delaware.gov/title8/c001/index.html>
+
+**Authoritative for:** What a board may and may not do — board power, interested-director transactions, exculpation, merger mechanics and appraisal rights. Primary law for most US public companies and nearly every venture-backed one.
+
+## NYSE Listed Company Manual
+
+New York Stock Exchange · US · **read and cite only — copyrighted, do not reproduce**
+
+<https://nyse.wolterskluwer.cloud/listed-company-manual>
+
+**Authoritative for:** What a listed issuer must do to stay listed — board independence tests, committee composition, shareholder approval thresholds and immediate disclosure obligations. Binding as a listing condition.
+
+---
+
+Sources are maintained in `sources/` upstream, not here. If one is wrong, out of date, or missing, fix it there — this file is regenerated and an edit to it is lost.

package/sources/headcount/plugins/legal-risk/skills/disputes-and-legal-holds/SKILL.md

@@ -0,0 +1,83 @@
+---
+name: disputes-and-legal-holds
+description: Handles a dispute from the first sign of it — recognizing when preservation obligations attach, issuing and scoping a legal hold, suspending automatic deletion across every system that holds relevant material, preserving privilege, managing outside counsel and cost, and evaluating settlement against the real cost of continuing. Use this to respond to a claim or demand letter, issue a hold, work out which systems the hold has to reach, or decide whether to fight.
+---
+
+# Disputes and legal holds
+
+The decisions that determine how a dispute goes are made in the first week, usually by people who
+do not know a dispute has started.
+
+**This structures the operational response. Procedural obligations and their deadlines vary by
+jurisdiction and forum — get counsel engaged early, and let them drive strategy.**
+
+## Preservation attaches earlier than most people expect
+
+The obligation to preserve begins when litigation is reasonably anticipated — which can be a demand
+letter, a threat made in a meeting, a regulator's inquiry, or an internal complaint serious enough
+that a claim is foreseeable. It does not wait for a filing.
+
+**Destruction after that point is treated far more seriously than the underlying dispute.** Routine
+automatic deletion continuing through a hold is the common version, and "it was our normal policy"
+is not the defense people assume.
+
+## Issue the hold in writing, and make it reach the systems
+
+A hold has two halves and organizations routinely do only the first.
+
+- **Notify the people.** Written, naming the matter in general terms, describing the categories of
+  material to preserve, instructing recipients not to delete and not to discuss, and requiring
+  acknowledgment. Identify custodians by what they touched, not by seniority.
+- **Suspend the machinery.** Automatic deletion runs on schedules nobody remembers setting: mail
+  retention, chat history expiry, ticket archival, log rotation, backup rotation, CRM purges,
+  device wipe on offboarding. Each needs an explicit suspension for the affected scope.
+
+**The systems half is where holds fail**, because the notice goes out and everyone assumes it was
+sufficient. Keep a list of every system with an automatic deletion schedule so that the question is
+answerable in an afternoon rather than a fortnight.
+
+## Maintain the hold as a live thing
+
+Re-notify periodically, add custodians as the matter develops, and cover departures — an employee
+leaving under a hold means their mailbox, files and device do not follow the standard offboarding
+path. Release the hold in writing when counsel says so, and only then.
+
+## Privilege is easy to lose and cannot be recovered
+
+Privilege protects legal advice, not facts and not business decisions dressed as legal ones.
+Copying a lawyer onto a business discussion does not make it privileged; forwarding privileged
+advice widely inside the organization can waive it.
+
+Where an investigation is being run for the purpose of legal advice, structure it that way from the
+start — directed by counsel, marked, and circulated narrowly. Retrofitting privilege afterward
+generally fails.
+
+## Manage counsel and cost deliberately
+
+Agree scope, staffing, rates and a budget with checkpoints before work starts, and require early
+written assessment of the realistic range of outcomes. Discovery is usually the largest cost and
+the most controllable one — narrowing custodians and date ranges early matters more than any hourly
+rate negotiation.
+
+## Decide about settlement on expected cost, not on principle
+
+Compare the realistic range of outcomes, weighted, against the full cost of continuing: fees,
+management time, disruption, disclosure risk, and the effect on other matters. Management time is
+the cost most consistently omitted and is often the largest.
+
+Consider what a settlement signals to other potential claimants, and get releases that are broad
+enough to actually end it.
+
+## Sources
+
+`references/sources.md` in this skill lists the outside authorities that settle the questions
+here — what each one is authoritative for, and what you may do with it. Check them before
+answering on anything they cover, and cite what you used. Most are free to read and not free
+to reproduce; the use note on each is binding.
+
+## Never
+
+- Wait for a filing before preserving.
+- Send a hold notice without suspending the automatic deletion it depends on.
+- Offboard someone under a hold through the standard process.
+- Assume copying counsel on a message makes it privileged.

package/sources/headcount/plugins/legal-risk/skills/disputes-and-legal-holds/references/sources.md

@@ -0,0 +1,33 @@
+# Sources — `legal-risk:disputes-and-legal-holds`
+
+<!-- Generated by scripts/build-sources.py from sources/*.toml. Do not edit. -->
+
+Check these before answering on anything they cover, and cite what you used. The use note on each one is binding: most of what a professional cites is free to read and not free to reproduce.
+
+## Federal Rules of Civil Procedure
+
+Administrative Office of the US Courts · US · public domain (US government) — quote freely
+
+<https://www.uscourts.gov/forms-rules/current-rules-practice-procedure/federal-rules-civil-procedure>
+
+**Authoritative for:** The duty to preserve and what follows from failing it — proportionality, the discovery conference, form of production, and the exclusive framework and intent threshold for sanctions over lost electronic evidence.
+
+## General Records Schedules
+
+US National Archives and Records Administration · US · public domain (US government) — quote freely
+
+<https://www.archives.gov/records-mgmt/grs>
+
+**Authoritative for:** Minimum retention and disposition periods for common administrative record classes. Binding on federal agencies only — for a private company it is a defensible published baseline rather than law, which is still better than arguing from habit.
+
+## The Sedona Principles and Commentary on Legal Holds
+
+The Sedona Conference · US · **read and cite only — copyrighted, do not reproduce**
+
+<https://www.thesedonaconference.org/publications>
+
+**Authoritative for:** The operational standard of care for electronic discovery that federal courts routinely cite — when the duty to preserve triggers, the scope of a defensible hold, and custodian notice practice. Free to download, copyrighted, so cite rather than reproduce.
+
+---
+
+Sources are maintained in `sources/` upstream, not here. If one is wrong, out of date, or missing, fix it there — this file is regenerated and an edit to it is lost.

package/sources/headcount/plugins/legal-risk/skills/enterprise-risk/SKILL.md

@@ -0,0 +1,79 @@
+---
+name: enterprise-risk
+description: Identifies, assesses, and tracks organizational risk — building and maintaining a risk register, scoring exposure, assigning owners and treatments, and preparing for audit. Use this to stand up a risk program, assess the risk in a decision or initiative, prepare for a certification or audit, decide whether a risk should be accepted, mitigated, transferred, or avoided, or report risk posture to leadership.
+---
+
+# Enterprise risk
+
+## The register is the artifact
+
+A risk that is not written down with an owner is not managed. Each entry carries:
+
+- **The risk stated as a cause and consequence** — "if X happens, then Y." "Cybersecurity" is a
+  category, not a risk. "If an employee's credentials are phished, an attacker reaches customer
+  records" is a risk you can do something about.
+- **Likelihood and impact**, on a stated scale, with the reasoning. The reasoning matters more than
+  the score.
+- **Current controls** and an honest view of whether they work.
+- **Residual risk** after those controls — the number that actually matters and the one most often
+  omitted.
+- **A named owner.** A person, not a department.
+- **Treatment and a date.**
+
+## Treatment is a decision with four options
+
+**Mitigate** (reduce it), **transfer** (insure or contract it away), **avoid** (do not do the
+thing), or **accept**. Accepting is legitimate and often correct — but acceptance must be explicit,
+at the right level of authority, and recorded. Risk accepted by silence is risk nobody owns.
+
+Anything above the threshold that only the chief executive can accept goes to them. Never let an
+unacceptable risk be quietly downgraded to fit an existing authority.
+
+## Scoring honestly
+
+Two failure modes, both common:
+
+- **Everything is high.** The register stops discriminating and gets ignored.
+- **Scores drift downward** as items age without the underlying exposure changing.
+
+Re-assess on a schedule and require evidence for any reduction. A control's existence is not
+evidence it works; a test of the control is.
+
+## Audit readiness
+
+Continuous, not a project. What auditors need: documented policies, evidence they are followed,
+records of exceptions and approvals, and a clear line from the framework's requirement to your
+control to the evidence.
+
+Collect evidence as work happens. Assembling a year of it retrospectively is expensive, and gaps
+found then cannot be fixed retroactively.
+
+## Reporting
+
+Leadership needs the few risks whose residual exposure is above appetite, what is being done, and
+what needs a decision. Not the whole register. A risk report that requires reading forty rows to
+find the three that matter will not be read.
+
+## Sources
+
+`references/sources.md` in this skill lists the outside authorities that settle the questions
+here — what each one is authoritative for, and what you may do with it. Check them before
+answering on anything they cover, and cite what you used. Most are free to read and not free
+to reproduce; the use note on each is binding.
+
+## Tooling
+
+A risk register is a table, and for most organizations a spreadsheet or a database in
+Notion, Airtable, or Confluence is the honest answer. Dedicated platforms — LogicGate,
+AuditBoard, Riskonnect, ServiceNow IRM, and similar — earn their place when the register
+has to reconcile with audit findings and control testing in one system.
+
+Compliance automation tools cover control evidence, not enterprise risk. Do not let one
+stand in for the other.
+
+## Never
+
+- Score residual risk on controls that are planned rather than operating.
+- Accept a risk without naming who accepted it and when it is reviewed again.
+- Keep a register with no review cadence. That is documentation, not risk management.
+- Close a risk because the project that raised it ended.

package/sources/headcount/plugins/legal-risk/skills/enterprise-risk/references/sources.md

@@ -0,0 +1,17 @@
+# Sources — `legal-risk:enterprise-risk`
+
+<!-- Generated by scripts/build-sources.py from sources/*.toml. Do not edit. -->
+
+Check these before answering on anything they cover, and cite what you used. The use note on each one is binding: most of what a professional cites is free to read and not free to reproduce.
+
+## COSO Internal Control — Integrated Framework
+
+Committee of Sponsoring Organizations of the Treadway Commission · global · **sold — cite the identifier only, never the text**
+
+<https://www.coso.org/guidance-on-ic>
+
+**Authoritative for:** The internal-control framework a SOX program is organized around and an auditor expects to be named. The framework document is sold — cite the component, not the text.
+
+---
+
+Sources are maintained in `sources/` upstream, not here. If one is wrong, out of date, or missing, fix it there — this file is regenerated and an edit to it is lost.

package/sources/headcount/plugins/legal-risk/skills/intellectual-property/SKILL.md

@@ -0,0 +1,91 @@
+---
+name: intellectual-property
+description: Covers what the organization owns and what it is only borrowing — trademarks and clearance, copyright and work-for-hire, patents and trade secrets, open-source license obligations and copyleft reach, and IP terms in customer, contractor and AI-tool agreements. Use this to check whether a name is usable, establish that you own work you paid for, decide how to handle a license obligation in a dependency, or respond to an infringement claim.
+---
+
+# Intellectual property
+
+Most IP damage is done quietly and early — by a name adopted without a search, a contractor
+agreement missing an assignment clause, or a dependency added without reading its license. All
+three are cheap to prevent and expensive to unwind.
+
+**This structures the questions and the recurring failure patterns. IP rights are jurisdictional,
+deadline-driven and fact-specific — get qualified counsel before adopting a name, filing anything,
+or responding to a claim.**
+
+## The four rights protect different things and are not interchangeable
+
+- **Trademark** protects a name or mark as an indicator of source, within classes of goods and
+  services and within territories. Rights come from use and are strengthened by registration.
+- **Copyright** protects expression, not ideas. It arises automatically on creation; registration
+  matters mainly for what you can recover in a dispute.
+- **Patent** protects an invention, in exchange for publishing it, and is defeated by your own
+  prior public disclosure in many regimes. If patenting is plausible, file before you present,
+  publish, or demonstrate.
+- **Trade secret** protects information whose value depends on being secret, for as long as you
+  actually keep it secret — which requires demonstrable measures, not just intent.
+
+## Clear a name before you build on it
+
+A search is cheap; a rebrand after launch is not, and the cost lands after you have printed
+material, bought domains, and built recognition. Search registered marks in the classes and
+territories you will operate in, and check for confusingly similar marks rather than exact matches.
+
+Domain availability tells you nothing about trademark risk. Neither does the absence of a company
+with that exact name.
+
+## Establish ownership of work you paid for, in writing, before it starts
+
+This is the most common and most avoidable failure in the whole area.
+
+- **Employee work** is often owned by the employer by default, but the default varies by
+  jurisdiction and by whether the work relates to the job.
+- **Contractor and agency work is usually owned by the contractor** unless the agreement assigns it.
+  A paid invoice is not an assignment. Logos, code, photography, and copy commissioned without an
+  assignment clause routinely turn out to be licensed rather than owned — discovered during
+  diligence, at the worst possible time.
+- **Get assignment plus a waiver of moral rights where they apply**, and confirm the contractor had
+  the right to assign anything they incorporated.
+
+## Open-source obligations are license terms, not etiquette
+
+Every dependency carries a license with conditions, and the conditions attach to distribution.
+
+- **Permissive licenses** mostly require attribution and notice retention. Cheap, but not zero —
+  the notices have to actually ship.
+- **Strong copyleft** can require you to offer source for the combined work you distribute. Whether
+  it reaches your code depends on how you combine and whether you distribute, and that analysis is
+  worth doing before adoption rather than before a release.
+- **Network copyleft** treats providing the software as a service as triggering the obligation,
+  which surprises teams who assumed a hosted product avoids distribution entirely.
+
+Maintain an inventory of dependencies and their licenses, generated rather than maintained by hand,
+and gate new licenses at the point of adoption. Removing a dependency after it is embedded is a
+project.
+
+## Read the IP terms in agreements you sign
+
+In customer contracts, watch for ownership of deliverables and of anything developed during the
+engagement, broad license grants back to the customer, and feedback clauses assigning your
+improvements. In tooling agreements, including AI services, check what rights are claimed over your
+inputs and outputs and whether your content trains anything.
+
+## Responding to a claim
+
+Do not reply substantively before counsel sees it, do not admit anything, and preserve everything —
+a claim letter triggers a preservation obligation immediately. Check whether insurance responds,
+and check the indemnity you may hold from a supplier whose component is the actual subject.
+
+## Sources
+
+`references/sources.md` in this skill lists the outside authorities that settle the questions
+here — what each one is authoritative for, and what you may do with it. Check them before
+answering on anything they cover, and cite what you used. Most are free to read and not free
+to reproduce; the use note on each is binding.
+
+## Never
+
+- Adopt a name on the strength of domain availability.
+- Commission work without a written assignment signed before the work starts.
+- Add a dependency without knowing its license and what it requires on distribution.
+- Respond to an infringement claim before counsel has seen it.

package/sources/headcount/plugins/legal-risk/skills/intellectual-property/references/sources.md

@@ -0,0 +1,45 @@
+# Sources — `legal-risk:intellectual-property`
+
+<!-- Generated by scripts/build-sources.py from sources/*.toml. Do not edit. -->
+
+Check these before answering on anything they cover, and cite what you used. The use note on each one is binding: most of what a professional cites is free to read and not free to reproduce.
+
+## Compendium of U.S. Copyright Office Practices
+
+US Copyright Office · US · public domain (US government) — quote freely
+
+<https://www.copyright.gov/comp3/>
+
+**Authoritative for:** What is protectable and registrable, including the Office's position on human authorship for machine-generated material and how much of a layout or typeface is protectable at all.
+
+## SPDX License List
+
+The Linux Foundation · global · CC BY — quote with attribution
+
+<https://spdx.org/licenses/>
+
+Machine-readable: <https://github.com/spdx/license-list-data>
+
+**Authoritative for:** The canonical identifier and full text of every common open-source license — the reference for an inbound license review, and for what a share-alike obligation actually says.
+
+## Trademark Manual of Examining Procedure
+
+US Patent and Trademark Office · US · public domain (US government) — quote freely
+
+<https://tmep.uspto.gov/>
+
+**Authoritative for:** Whether a proposed name, logo or tagline is registrable — distinctiveness, descriptiveness refusals, likelihood of confusion, specimen requirements. Settles whether you can actually own a name.
+
+## USPTO search and guidance
+
+US Patent and Trademark Office · US · public domain (US government) — quote freely
+
+<https://www.uspto.gov/>
+
+Machine-readable: <https://developer.uspto.gov/>
+
+**Authoritative for:** Whether a mark or an invention is already claimed, and the examination standards a filing will be judged against.
+
+---
+
+Sources are maintained in `sources/` upstream, not here. If one is wrong, out of date, or missing, fix it there — this file is regenerated and an edit to it is lost.

package/sources/headcount/plugins/legal-risk/skills/privacy-and-data-protection/SKILL.md

@@ -0,0 +1,71 @@
+---
+name: privacy-and-data-protection
+description: Assesses and improves how personal data is collected, used, shared, and retained — data mapping, lawful basis, consent, processor agreements, subject rights, and breach obligations. Use this before launching anything that handles personal data, when adding a vendor that will process it, when a data subject request arrives, when assessing exposure under GDPR or US state privacy laws, or when preparing for a privacy review.
+---
+
+# Privacy and data protection
+
+> Not legal advice. Regimes differ by jurisdiction and change; material questions need qualified
+> counsel. This structures the assessment and identifies what to escalate.
+
+## Start from the data map
+
+You cannot assess what you have not inventoried. For each category of personal data:
+
+- What is collected, from whom, and where it came from.
+- Why — the specific purpose, and the lawful basis where one is required.
+- Where it lives, who can reach it, and which vendors receive it.
+- How long it is kept, and what deletes it. "Indefinitely" is a finding, not an answer.
+- Whether it crosses a border, and under what mechanism.
+
+Most privacy failures are inventory failures: data nobody remembered was being collected, in a
+system nobody owned.
+
+## Design decisions that prevent problems
+
+- **Collect less.** Every field is a liability with a maintenance cost. The cheapest way to protect
+  data is not to hold it.
+- **Purpose limitation is real.** Data collected for one purpose is not automatically available for
+  another — particularly for training models, which is where this most often goes wrong now.
+- **Separate identifiers from behavior** where analysis does not require linkage.
+- **Retention with an enforcing mechanism.** A policy with no deletion job is a statement of intent.
+
+## Consent, where it applies
+
+Specific, informed, freely given, and as easy to withdraw as to give. Pre-ticked boxes, bundled
+consent, and cookie walls that offer no genuine choice fail on their face in the regimes that
+require consent.
+
+Note that consent is one lawful basis among several and often the weakest — it can be withdrawn,
+and then the processing must stop.
+
+## Vendors
+
+Any third party processing personal data on your behalf needs a written agreement covering purpose,
+security, sub-processors, deletion, and assistance with subject rights. Sending data to a vendor
+without one is a common and easily avoided violation.
+
+Assess the vendor's actual security, not their questionnaire answers, in proportion to the
+sensitivity of what they will hold.
+
+## Subject rights and breaches
+
+Have a working process before the first request: how it arrives, how identity is verified, how the
+data is located across systems, and the deadline. Locating the data is the part that fails.
+
+For breaches, know your notification clock before you need it — several regimes measure it in hours
+from awareness. Decide in advance who determines that awareness has occurred.
+
+## Sources
+
+`references/sources.md` in this skill lists the outside authorities that settle the questions
+here — what each one is authoritative for, and what you may do with it. Check them before
+answering on anything they cover, and cite what you used. Most are free to read and not free
+to reproduce; the use note on each is binding.
+
+## Never
+
+- Collect data because it may be useful later. Purpose first, then collection.
+- Retain personal data past the period you published.
+- Send personal data to a vendor before the contract terms and the transfer basis are in place.
+- Load production personal data into a test environment.

package/sources/headcount/plugins/legal-risk/skills/privacy-and-data-protection/references/sources.md

@@ -0,0 +1,33 @@
+# Sources — `legal-risk:privacy-and-data-protection`
+
+<!-- Generated by scripts/build-sources.py from sources/*.toml. Do not edit. -->
+
+Check these before answering on anything they cover, and cite what you used. The use note on each one is binding: most of what a professional cites is free to read and not free to reproduce.
+
+## California Consumer Privacy Act — Attorney General
+
+California Office of the Attorney General · US-CA · public domain — quote freely
+
+<https://oag.ca.gov/privacy/ccpa>
+
+**Authoritative for:** The largest US state privacy regime, and the template several other states followed. Start here before generalizing about 'US state privacy law', which is not one thing.
+
+## European Data Protection Board guidelines and recommendations
+
+EDPB · EU · free to use with attribution — credit the publisher
+
+<https://www.edpb.europa.eu/our-work-tools/general-guidance/guidelines-recommendations-best-practices_en>
+
+**Authoritative for:** How supervisory authorities actually read the GDPR — lawful basis, transfers, legitimate interest balancing — which is where a plain reading of the regulation stops being enough.
+
+## Regulation (EU) 2016/679 — GDPR
+
+Publications Office of the European Union · EU · free to use with attribution — credit the publisher
+
+<https://eur-lex.europa.eu/eli/reg/2016/679/oj>
+
+**Authoritative for:** The operative text of the GDPR. EU legal texts are reusable with attribution under the Commission's reuse decision, so this is quotable where a national summary is not.
+
+---
+
+Sources are maintained in `sources/` upstream, not here. If one is wrong, out of date, or missing, fix it there — this file is regenerated and an edit to it is lost.

package/sources/headcount/plugins/legal-risk/skills/regulatory-compliance/SKILL.md

@@ -0,0 +1,82 @@
+---
+name: regulatory-compliance
+description: Identifies which regulations apply and builds the program that keeps you inside them — obligation mapping, controls, monitoring, and responding to regulators. Use this to work out what applies to your business, stand up a compliance program, prepare for a regulatory exam or certification, respond to a finding, or assess exposure before entering a new market.
+---
+
+# Regulatory compliance
+
+Compliance failures are rarely defiance. They are almost always an obligation nobody knew applied,
+in a jurisdiction nobody was watching, discovered by someone external.
+
+**This structures the work and names what to ask. Which regulations apply, and what they require,
+are legal determinations that vary by jurisdiction and change — they belong with qualified counsel.
+Nothing here substitutes for that.**
+
+## Start with an obligation map, not a framework
+
+The first question is not "are we SOC 2 compliant" but "what are we actually obliged to do, by
+whom, and what happens if we do not." Build the map from facts about the business:
+
+- **What you sell, and to whom.** Selling to regulated customers pulls their obligations onto you
+  through contract even when the regulation does not reach you directly.
+- **What data you hold.** Personal data, health data, payment data and children's data each carry
+  distinct regimes — see `legal-risk:privacy-and-data-protection`.
+- **Where you operate and where your customers are.** Obligations follow the customer more often
+  than companies expect.
+- **How you are funded and structured.** Public, regulated, or government-adjacent adds regimes.
+
+Distinguish three things that get conflated: **law** you must follow, **certifications** you choose
+to obtain commercially, and **contractual commitments** you signed. Only the first carries state
+enforcement; all three carry consequences.
+
+## Certifications are evidence, not compliance
+
+SOC 2, ISO 27001 and their equivalents demonstrate that controls exist and operate. They do not
+establish that you meet any legal obligation, and a clean report is not a defense to a regulator.
+
+Where they earn their cost is commercially — an enterprise prospect makes the certification a
+condition of the deal, and the certification is what unblocks it. Scope them to what the market
+asks for rather than to everything, since scope drives cost more than any other decision.
+
+## The program is monitoring, not documentation
+
+A compliance program that produces policies and stops is a shelf. What makes it real:
+
+- **An owner per obligation** — a named person, not a department.
+- **Controls that produce evidence as a by-product** of the work, rather than evidence assembled
+  before an audit. See `finance:internal-controls-and-audit` for the control design pattern.
+- **Monitoring that would detect failure** before an external party does, with the frequency matched
+  to how fast the obligation can be breached.
+- **Horizon scanning.** Regulation changes; a map built once is wrong within a year.
+
+## When a regulator arrives
+
+Respond promptly, accurately, and narrowly — answer what was asked. Route everything through counsel
+before it goes out, preserve records from the moment you are aware, and never let an informal
+conversation become an undocumented commitment.
+
+Findings get root-caused like any other failure. A remediation that consists of retraining people on
+a process that made the failure easy will produce the same finding next cycle.
+
+## Sources
+
+`references/sources.md` in this skill lists the outside authorities that settle the questions
+here — what each one is authoritative for, and what you may do with it. Check them before
+answering on anything they cover, and cite what you used. Most are free to read and not free
+to reproduce; the use note on each is binding.
+
+## Tooling
+
+Compliance automation — Vanta, Drata, Secureframe, Keel GRC, and similar — collects
+evidence continuously and maps one control across several frameworks. It earns its cost on
+the second audit far more often than the first.
+
+Policy and attestation lives in those same tools, or in the HRIS, or in Confluence. What
+matters is that a policy carries a version, an owner, and a record of who acknowledged it.
+
+## Never
+
+- Treat a certification as evidence of legal compliance.
+- Build a compliance program without a named owner per obligation.
+- Assemble control evidence retrospectively for an audit.
+- Answer a regulator without counsel reviewing the response.