{
  "id": "workflow:annual-compliance-review",
  "_kind": "Workflow",
  "_file": "workflows/workflows/workflows-cross-functional.yaml",
  "_cluster": "workflows",
  "attributes": {
    "displayName": "Annual Compliance Review",
    "workflowKind": "governance",
    "triggerType": "scheduled",
    "typicalCadence": "annually",
    "complexity": "cross-team",
    "description": "Conducts the annual organization-wide compliance review across\nregulatory frameworks -- auditing adherence to SOC 2, GDPR, HIPAA, or\nindustry-specific regulations, reviewing policy document currency and\nemployee attestation completion, validating control effectiveness\nthrough evidence sampling, coordinating with external auditors on gap\nremediation timelines, assessing new regulatory requirements for\nimpact analysis, and updating the compliance risk register. Produces\nannual compliance assessment report and remediation roadmap. Excludes\ncontrol implementation.\n"
  },
  "outgoingEdges": [
    {
      "from": "workflow:annual-compliance-review",
      "to": "role:security-reviewer",
      "kind": "involves_role",
      "attributes": {}
    },
    {
      "from": "workflow:annual-compliance-review",
      "to": "role:engineering-manager",
      "kind": "involves_role",
      "attributes": {}
    },
    {
      "from": "workflow:annual-compliance-review",
      "to": "role:license-auditor",
      "kind": "involves_role",
      "attributes": {}
    },
    {
      "from": "workflow:annual-compliance-review",
      "to": "skill-area:threat-modeling",
      "kind": "requires_skill_area",
      "attributes": {}
    },
    {
      "from": "workflow:annual-compliance-review",
      "to": "skill-area:identity-security",
      "kind": "requires_skill_area",
      "attributes": {}
    },
    {
      "from": "workflow:annual-compliance-review",
      "to": "domain:legal",
      "kind": "applies_to_domain",
      "attributes": {}
    },
    {
      "from": "workflow:annual-compliance-review",
      "to": "domain:operations",
      "kind": "applies_to_domain",
      "attributes": {}
    },
    {
      "from": "workflow:annual-compliance-review",
      "to": "responsibility:security-review",
      "kind": "triggers_responsibility",
      "attributes": {}
    },
    {
      "from": "workflow:annual-compliance-review",
      "to": "responsibility:dependency-audit",
      "kind": "triggers_responsibility",
      "attributes": {}
    },
    {
      "from": "workflow:annual-compliance-review",
      "to": "org-unit:compliance-team",
      "kind": "performed_by_org_unit",
      "attributes": {}
    },
    {
      "from": "workflow:annual-compliance-review",
      "to": "org-unit:legal-team",
      "kind": "performed_by_org_unit",
      "attributes": {}
    },
    {
      "from": "workflow:annual-compliance-review",
      "to": "org-unit:security-team",
      "kind": "performed_by_org_unit",
      "attributes": {}
    }
  ],
  "incomingEdges": []
}