Map applicable requirements to internal policy evidence
Compare an approved requirement set with current internal documentation. Prepare a traceable matrix of evidence, apparent gaps and questions for qualified review.
How this works
The purpose is to make a specialist’s review easier to trace. The assistant identifies candidate requirements, retrieves internal passages and organizes questions about missing or conflicting documentation. It does not issue a legal opinion or certify that operations comply.
Work from a requirement set and jurisdictional scope supplied or approved by the responsible owner. Preserve definitions, exceptions and hierarchy: an isolated sentence may mean something different when read with its parent clause. Actual operating effectiveness remains a separate review from documented coverage.
Before you start
Qualified owner
Identify the compliance or legal reviewer responsible for scope, applicability and final findings.
Controlled corpus
Use dated requirement documents and current approved policies, with superseded versions clearly marked.
Applicability rules
Obtain the company activities, jurisdictions and explicit inclusions or exclusions for this review.
Prepare the inputs
- requirements
- Required
approved documents and effective dates
Check page completeness, amendment references and authoritative version metadata.
- internal_documents
- Required
policy IDs, versions, passages and owners
Exclude drafts from confirmed evidence unless specifically in scope.
- scope
- Required
activities, jurisdictions and review date
Unknown applicability criteria must be escalated, not guessed.
- review_taxonomy
- Required
finding labels and priority rules
Use the owner’s definitions; do not invent legal severity thresholds.
Implementation, step by step
Register the document set
- Inventory requirement and internal-policy versions, dates and owners. Record missing attachments or incorporated references.
- Retain page and section coordinates through parsing, including definitions and exceptions attached to each clause.
Checkpoint: The reviewer can reconstruct the exact corpus used.
Extract candidate requirements
- Separate operative obligations from background explanation. Keep conditions, subject, action, timing and exceptions in distinct fields.
- Quote only the minimal passage needed in the internal review artifact and attach its coordinate; do not replace a clause with a misleading shorthand.
Checkpoint: Each requirement retains its parent context and source location.
Apply the approved scope
- Compare each candidate with the supplied activities and applicability rules. Mark applicable, out of scope or specialist decision needed.
- Explain ambiguous applicability as a question with evidence, rather than resolving it using general model knowledge.
Checkpoint: No requirement disappears without a recorded scope decision.
Map internal evidence
- Retrieve policy passages that address each applicable requirement and inspect their full context.
- Distinguish explicit coverage, partial coverage, contradictory provisions and no located evidence. A missing search result is not proof that a control does not exist.
Checkpoint: Each requirement has linked evidence or a clearly described search gap.
Prepare findings for review
- Describe the apparent documentation issue, its supporting passages and the question needed to resolve it.
- Apply only the supplied prioritization rules. Separate urgent review dates from legal risk conclusions.
Checkpoint: Findings are framed as reviewable observations rather than compliance verdicts.
Capture specialist decisions
- Record accepted, rejected and revised mappings with reviewer rationale and date.
- Return unresolved questions to policy owners and preserve previous decisions when a later document version changes the result.
Checkpoint: The final matrix distinguishes machine proposals from specialist-confirmed conclusions.
Decisions along the way
A referenced standard is missing
Mark the affected requirement incomplete and request the approved source.
Policy text describes a control but evidence of operation is absent
Report documented coverage separately from untested operating effectiveness.
What you will produce
requirement-evidence-matrix.csv
CSVA source-linked working matrix for qualified review.
Include: requirement_id · source_location · applicability · policy_evidence · coverage_status · question · review_status
review-questions.md
MarkdownA prioritized set of specific questions, not a legal determination.
Include: finding_id · apparent_gap · evidence · owner · next_action
Check the result
- Sample both apparent gaps and apparently covered requirements.
- Check definitions and exceptions for every high-priority observation.
- Ensure all applicability and severity changes have a reviewer or approved rule.
When something goes wrong
Document layout loses clause hierarchy
Repair the affected pages manually and hold dependent findings.
Two policy versions conflict
Ask the owner which version governs and retain the conflict in the handoff.
A worked example
SYNTHETIC EXAMPLE · NOT A REPORTED BUSINESS RESULT
Request
Synthetic: check documentation for an approved access-review requirement.
Inputs
The supplied rule requires quarterly review of privileged access. Policy P4 mentions annual account review; no privileged-access procedure is present in the supplied corpus.
Expected result
Create a potential frequency-and-scope gap with both passages. Ask the control owner whether a current privileged-access procedure exists; do not conclude the company fails the requirement.
Run a small pilot
Start small
A small approved requirement set already reviewed by a specialist.
Record the baseline
Record manual mapping time and the specialist’s accepted evidence and findings.
Agree success criteria
Set acceptable omission and unsupported-finding rates, with complete source traceability.
Stop or revise
Pause if governing sources, scope or qualified review are unavailable.
Keep the scope clear
- This workflow supports professional review and does not make legal or regulatory decisions.
- Use document-level permissions; a consolidated matrix must not broaden access to restricted policies.
Check before using
The responsible compliance or legal specialist confirms applicability and findings.
Business activities
- Maintain shared company knowledge
- Operate and improve AI workflows
FROM A RECIPE TO YOUR WORKFLOW
Bring the company context together.
This workflow needs reliable inputs before it needs a better prompt. Moat8 Vault brings working information into a readable archive for the AI tools you use.
For this recipe: Approved requirement documents · Internal policies and procedures · Applicability criteria
Start with one recurring task, agree which sources to use, and review the first result with your team.
Discuss this workflow