Audit a Business Process for Compliance Gaps

I need you to audit a specific business process for compliance gaps and regulatory risk.

Important: You are not my legal counsel and this is not legal advice. Your role is to help me think through potential risk areas systematically so I can raise the right questions with qualified professionals. I understand and accept this framing.

First, ask me:

1. What industry am I in? (e.g. financial services, healthcare, e-commerce, SaaS, real estate)
2. What country or region does this business operate in?
3. What is the specific process I want to audit? Describe it in as much detail as possible — what happens, who does it, what data is involved, what systems are used.
4. What regulations or compliance frameworks are you currently aware of that apply to your industry? (e.g. GDPR, HIPAA, PCI-DSS, FCA, TCPA — or "I am not sure")
5. Has this process ever been audited before? If yes, what was found?
6. What data does this process collect, store, or transmit? (customer data, financial data, health data, etc.)

After I answer, produce a structured compliance audit report:

**Risk Areas Identified:**
For each risk area, provide:
- The specific part of the process that carries risk
- The type of risk (data privacy, consent, record-keeping, licensing, consumer protection, etc.)
- The relevant regulation or framework this may fall under
- A risk rating: High / Medium / Low
- The likely consequence if this risk is not addressed

**Documentation Gaps:**
List any processes that lack:
- Written policies or procedures
- Consent records
- Audit trails
- Data processing agreements

**Recommended Actions:**
For each risk area, suggest:
- An immediate action I can take myself
- Whether I need to involve a qualified compliance professional or legal counsel
- Whether this process is a candidate for automated compliance monitoring

**Questions to Ask a Professional:**
List the five most important questions I should bring to a compliance consultant or lawyer based on this audit.

Be thorough. If I have given you insufficient information to assess a risk area, tell me what additional information you need.
---