Comparable registers
Score every risk identically, so results hold up across teams, entities and quarters.
— Risk & Compliance
Regulatory gap assessment
Name the regulation and upload your current-state evidence (policies, procedures, controls, registers, prior audits).
- Risk & Compliance
- Human review built in
- Traceable reasoning
- Runs anywhere
2–3 weeks → ~25 minutes
For a typical multi-document review workflow
No coding required
- Input
- Risk registers, control descriptions and policy documents
- Output
- A scored register with the reasoning per risk
- Runs in
- Skillsize · ChatGPT · Claude · Copilot
- Export
- SKILL.md · MCP
- Time saved
- ~2–3 weeks per run
— USE CASES
What people use Regulatory gap assessment for
Committee-ready evidence
Show the basis for each rating rather than asserting a residual score.
Coverage instead of sampling
Assess the whole of the risk universe in scope rather than the subset there was time for.
What it works from
- Risk registers, control descriptions and policy documents
- Your scoring scales, thresholds and appetite statements
What you get back
- A scored register with the reasoning per risk
- An aggregated view at the level the committee reads
— HOW IT BEHAVES
How Regulatory gap assessment produces its result
The mechanics behind this specific template — what it reads, what it calculates, and where a human stays in the loop.
Scored against your criteria
Each risk is assessed against criteria you control and weight, so the same standard applies to every risk in the risk universe in scope.
Risk, control and policy documentation pulled into one schema
Every risk is captured in the same field structure, so records drawn from different documents and sources stay comparable.
Whole sets of risk, control and policy documentation at once
All of your risk, control and policy documentation is processed as one set, so patterns across documents surface instead of being read one file at a time.
Live research on the risk universe in scope
Current external sources on the risk universe in scope are researched during the run rather than recalled from training data, and every source travels with the output.
Human sign-off before the write-up
The run pauses for a person to confirm the risks that matter before the deliverable is composed.
Composed as work product
Findings on the risk universe in scope are written up as a document that reads like professional output, with each claim tied back to a risk.
Why this is expensive by hand
Assessing the risk universe in scope by hand means every assessor scores slightly differently and the register stops being comparable. Comparable registers is the typical trigger — score every risk identically, so results hold up across teams, entities and quarters. Done properly it is defensible; done at pace it becomes a judgement call nobody can retrace. And "properly" usually means 2–3 weeks of manual work.
How this Skill produces it
Here the same job runs as a Skill. Your material goes in; a scored register with the reasoning per risk comes out, alongside an aggregated view at the level the committee reads. The judgement is built in — how items are broken up, what standard they are held to, and where the run stops for a human review. The practical effect: 2–3 weeks of manual work becomes a ~25 minutes run, held to an identical standard on the tenth engagement as on the first.
Who it's for
- Internal audit and risk functions
- Compliance and controls teams
- Second-line functions reporting to committees
- Risk consultants running assessments
Run it in Skillsize — or export it anywhere
Regulatory gap assessment exports as a structured SKILL.md file and is MCP-ready, so the same method runs in ChatGPT, Claude, Copilot or your own AI products. Adapt it to your methodology, and the intelligence stays yours — not locked to one vendor.
ChatGPTClaudeCopilotAI Products (MCP)
More Risk & Compliance Skills
Browse the full library →Risk & Compliance
Case escalation risk
Upload a case-log export with a row per case and a column recording how it ended (e.g. 'Case outcome' = Escalated/Resolved, blank for open cases).
Risk & Compliance
Regulation scan
Researches regulatory change in a defined area, classifies the findings, and states the implications for your specific business context.
Risk & Compliance
Control gap assessment (SOC 2 / ISO 27001)
Extracts documented controls and framework requirements, then grades every requirement covered, partial or absent for SOC 2 or ISO 27001 readiness.