Compliance Projects | Audit Trail & Tracking Guide
Track regulatory requirements with GitScrum: tasks for each requirement, linked source regulations, implementation status, and audit-ready documentation.
8 min read
Compliance projects have strict deadlines and documentation requirements. GitScrum helps teams track regulatory work, maintain audit trails, and demonstrate compliance.
Compliance Planning
Requirements Tracking
COMPLIANCE REQUIREMENT TRACKING:
┌─────────────────────────────────────────────────────────────┐
│ │
│ COMPLIANCE EPIC: │
│ ┌─────────────────────────────────────────────────────────┐│
│ │ COMP-001: GDPR Compliance Implementation ││
│ │ ││
│ │ Regulation: General Data Protection Regulation ││
│ │ Deadline: May 25, 2024 ││
│ │ Owner: @privacy-lead ││
│ │ Status: In Progress (65%) ││
│ │ ││
│ │ REQUIREMENTS: ││
│ │ Article 15 - Right of Access: ││
│ │ ├── COMP-010: User data export ││
│ │ ├── COMP-011: Data inventory ││
│ │ └── COMP-012: Request handling process ││
│ │ ││
│ │ Article 17 - Right to Erasure: ││
│ │ ├── COMP-020: Data deletion capability ││
│ │ ├── COMP-021: Propagation to processors ││
│ │ └── COMP-022: Retention policy enforcement ││
│ │ ││
│ │ Article 32 - Security: ││
│ │ ├── COMP-030: Encryption at rest ││
│ │ ├── COMP-031: Encryption in transit ││
│ │ └── COMP-032: Access controls ││
│ │ ││
│ │ DOCUMENTATION: ││
│ │ ├── COMP-040: Privacy policy update ││
│ │ ├── COMP-041: Processing agreement templates ││
│ │ └── COMP-042: DPIA documentation ││
│ └─────────────────────────────────────────────────────────┘│
└─────────────────────────────────────────────────────────────┘
Requirement Task
COMPLIANCE TASK STRUCTURE:
┌─────────────────────────────────────────────────────────────┐
│ │
│ TASK WITH COMPLIANCE CONTEXT: │
│ ┌─────────────────────────────────────────────────────────┐│
│ │ COMP-020: Implement data deletion capability ││
│ │ ││
│ │ REQUIREMENT SOURCE: ││
│ │ GDPR Article 17 - Right to Erasure ││
│ │ "The data subject shall have the right to obtain ││
│ │ from the controller the erasure of personal data..." ││
│ │ ││
│ │ ACCEPTANCE CRITERIA: ││
│ │ ☐ User can request deletion from settings ││
│ │ ☐ All user data deleted within 30 days ││
│ │ ☐ Deletion confirmed via email ││
│ │ ☐ Deletion logged for audit ││
│ │ ☐ Third-party systems notified ││
│ │ ││
│ │ SCOPE: ││
│ │ Data types: Profile, activity, preferences ││
│ │ Exceptions: Financial records (legal hold) ││
│ │ ││
│ │ EVIDENCE REQUIRED: ││
│ │ • Test results showing deletion works ││
│ │ • Audit log of test deletion ││
│ │ • Sign-off from legal ││
│ │ ││
│ │ DEADLINE: April 30, 2024 (before GDPR deadline) ││
│ │ STATUS: In Development ││
│ └─────────────────────────────────────────────────────────┘│
└─────────────────────────────────────────────────────────────┘
Audit Trails
Documenting Compliance
AUDIT DOCUMENTATION:
┌─────────────────────────────────────────────────────────────┐
│ │
│ FOR EACH REQUIREMENT, DOCUMENT: │
│ │
│ REQUIREMENT EVIDENCE: │
│ ┌─────────────────────────────────────────────────────────┐│
│ │ COMP-020: Data Deletion - EVIDENCE ││
│ │ ││
│ │ REQUIREMENT MET: ✅ Yes ││
│ │ COMPLETION DATE: April 25, 2024 ││
│ │ ││
│ │ IMPLEMENTATION: ││
│ │ • Code: PR #1234 (merged April 20) ││
│ │ • Tests: QA-567 (passed April 22) ││
│ │ • Deploy: Released v2.5.0 (April 25) ││
│ │ ││
│ │ EVIDENCE: ││
│ │ • Test report: [link to test results] ││
│ │ • Audit log sample: [link to sample] ││
│ │ • Screenshot of user flow: [link] ││
│ │ ││
│ │ APPROVALS: ││
│ │ • Technical: @tech-lead (April 22) ││
│ │ • Legal: @legal-counsel (April 24) ││
│ │ • Privacy: @dpo (April 25) ││
│ │ ││
│ │ NOTES: ││
│ │ Financial records excluded per legal retention req. ││
│ │ See COMP-025 for financial data handling. ││
│ └─────────────────────────────────────────────────────────┘│
│ │
│ LINK EVERYTHING: │
│ Requirement → Task → Code → Test → Approval │
│ Complete traceability for auditors │
└─────────────────────────────────────────────────────────────┘
Compliance Dashboard
COMPLIANCE STATUS OVERVIEW:
┌─────────────────────────────────────────────────────────────┐
│ │
│ GDPR COMPLIANCE DASHBOARD │
│ │
│ Overall: ██████████████████░░ 85% │
│ Deadline: May 25, 2024 (30 days remaining) │
│ │
│ BY ARTICLE: │
│ Art. 15 (Access): ████████████████████ 100% ✅ │
│ Art. 17 (Erasure): ██████████████░░░░░░ 70% ⏳ │
│ Art. 32 (Security): ████████████████████ 100% ✅ │
│ Art. 33 (Breach): ████████████████░░░░ 80% ⏳ │
│ Documentation: ██████████████████░░ 90% ⏳ │
│ │
│ ─────────────────────────────────────────────────────────── │
│ │
│ BLOCKING ITEMS: │
│ 🔴 COMP-021: Third-party processor notification │
│ Blocked: Waiting for vendor API │
│ Risk: May delay Art. 17 compliance │
│ Mitigation: Manual process as backup │
│ │
│ UPCOMING: │
│ ⏳ COMP-035: Breach notification process (due Apr 15) │
│ ⏳ COMP-042: DPIA documentation (due Apr 20) │
│ │
│ COMPLETED THIS WEEK: │
│ ✅ COMP-030: Encryption at rest │
│ ✅ COMP-040: Privacy policy update │
└─────────────────────────────────────────────────────────────┘
Prioritization
Compliance vs Features
COMPLIANCE PRIORITIZATION:
┌─────────────────────────────────────────────────────────────┐
│ │
│ PRIORITY ORDER: │
│ │
│ 1. COMPLIANCE (Hard deadlines, legal consequences) │
│ GDPR deadline is May 25 - non-negotiable │
│ │
│ 2. SECURITY FIXES (Risk reduction) │
│ Can't be compliant if not secure │
│ │
│ 3. CRITICAL BUGS (User impact) │
│ Production issues affecting users │
│ │
│ 4. FEATURES (Business value) │
│ Only after compliance is on track │
│ │
│ ─────────────────────────────────────────────────────────── │
│ │
│ SPRINT PLANNING: │
│ ┌─────────────────────────────────────────────────────────┐│
│ │ Sprint 15 Allocation ││
│ │ ││
│ │ Capacity: 30 points ││
│ │ ││
│ │ Compliance (must do): 18 points (60%) ││
│ │ ├── COMP-021: Processor notification (8 pts) ││
│ │ ├── COMP-035: Breach notification (5 pts) ││
│ │ └── COMP-042: DPIA documentation (5 pts) ││
│ │ ││
│ │ Features (can do): 12 points (40%) ││
│ │ ├── FEAT-101: Dashboard improvements (5 pts) ││
│ │ └── FEAT-102: Export formats (7 pts) ││
│ │ ││
│ │ NOTE: If compliance slips, features get cut ││
│ └─────────────────────────────────────────────────────────┘│
└─────────────────────────────────────────────────────────────┘
Multiple Regulations
Managing Multiple Standards
MULTI-REGULATION COMPLIANCE:
┌─────────────────────────────────────────────────────────────┐
│ │
│ REGULATIONS TRACKING: │
│ │
│ GDPR (EU): │
│ Status: ██████████████████ 90% │
│ Deadline: May 25, 2024 │
│ │
│ SOC 2 (Annual audit): │
│ Status: ██████████████ 70% │
│ Next audit: July 2024 │
│ │
│ HIPAA (Healthcare): │
│ Status: ██████████████████ 85% │
│ Ongoing compliance │
│ │
│ PCI-DSS (Payments): │
│ Status: ████████████████████ 100% │
│ Recertification: December 2024 │
│ │
│ ─────────────────────────────────────────────────────────── │
│ │
│ OVERLAP MAPPING: │
│ ┌─────────────────────────────────────────────────────────┐│
│ │ Control: Encryption at rest ││
│ │ ││
│ │ Satisfies: ││
│ │ ☑ GDPR Art. 32 ││
│ │ ☑ SOC 2 CC6.1 ││
│ │ ☑ HIPAA 164.312(a)(2)(iv) ││
│ │ ☑ PCI-DSS 3.4 ││
│ │ ││
│ │ Implementation: COMP-030 ││
│ │ Status: Complete ││
│ └─────────────────────────────────────────────────────────┘│
│ │
│ EFFICIENCY: │
│ Map controls to multiple regulations │
│ Implement once, satisfy many │
│ Reduces duplicate work │
└─────────────────────────────────────────────────────────────┘
Ongoing Compliance
Continuous Compliance
CONTINUOUS COMPLIANCE:
┌─────────────────────────────────────────────────────────────┐
│ │
│ RECURRING TASKS: │
│ │
│ QUARTERLY: │
│ ☐ Access review (who has access to what) │
│ ☐ Vendor security assessment │
│ ☐ Training completion verification │
│ ☐ Policy review │
│ │
│ MONTHLY: │
│ ☐ Vulnerability scan review │
│ ☐ Access log audit │
│ ☐ Incident review │
│ │
│ ONGOING: │
│ ☐ Security patches │
│ ☐ Compliance monitoring │
│ ☐ Evidence collection │
│ │
│ ─────────────────────────────────────────────────────────── │
│ │
│ RECURRING TASK: │
│ ┌─────────────────────────────────────────────────────────┐│
│ │ COMP-REC-001: Quarterly Access Review ││
│ │ ││
│ │ Frequency: Every quarter (Jan, Apr, Jul, Oct) ││
│ │ Owner: @security-lead ││
│ │ Duration: 1 week ││
│ │ ││
│ │ CHECKLIST: ││
│ │ ☐ Export current access list ││
│ │ ☐ Review with each team lead ││
│ │ ☐ Remove terminated employees ││
│ │ ☐ Adjust over-provisioned access ││
│ │ ☐ Document changes made ││
│ │ ☐ Sign-off from CISO ││
│ │ ││
│ │ EVIDENCE: Access review report, change log ││
│ └─────────────────────────────────────────────────────────┘│
└─────────────────────────────────────────────────────────────┘