Compliance Assessment Report

Detects populated compliance assessment and audit reports: the report title (compliance assessment / audit / review report, regulatory compliance assessment, gap analysis report) together with populated finding, control, status, rating and remediation fields.

Type

regex

Engine

boost_regex

Confidence

medium

Confidence justification

Medium: the report titles are distinctive, but guidance, templates and news use them too, so enforcement requires populated assessment fields; 85 additionally needs a named framework. Tiers are heuristic evidence gates, not measured accuracy.

Jurisdictions

au

Regulations

Information Privacy Act 2009 (Qld), Privacy Act 1988 (Cth), Security of Critical Infrastructure Act 2018 (Cth)

Frameworks

DISP, ISO 27001, NIST CSF

Data categories

governance, legal

Scope

narrow

Risk rating

8

Platform compatibility

Purview: Compatible, GCP DLP: Compatible, Macie: Compatible, Zscaler: Compatible, Palo Alto: Degraded, Netskope: Unsupported

Pattern

(?i)\b(?:compliance\s+(?:assessment|audit|review)\s+report|regulatory\s+compliance\s+(?:assessment|report)|gap\s+analysis\s+report|compliance\s+(?:gap|maturity)\s+assessment)\b

Should match

• Privacy Act compliance assessment report - Harbour Freight Pty Ltd Assessed by: Jordan Staffson Assessment period: 01/07/2025 to 30/06/2026 Finding 1: APP 11 access reviews not performed for the payroll system Rating: High Status: Non-compliant Remediation owner: Avery Teston — 85 - populated assessment (finding, rating, status, owner) with a named framework (Privacy Act)
• Compliance gap assessment - records management Control: RM-04 disposal authority applied Status: Partially compliant Due date: 30/11/2026 — 75 - three populated assessment fields, no named framework
• Gap analysis report Requirement: CPS 230 business continuity testing Status: Not met — 75 - two populated fields; a framework is named but 85 needs three distinct fields
• Compliance assessment report received for filing. — 65 discovery - report title without populated fields
• Compliance assessment report: regulatory gap and non-compliance finding — 65 discovery - title with topic words but no populated fields

Should not match

• Compliance with traffic rules — Everyday compliance wording
• In compliance with building codes — Everyday compliance wording
• This guide explains how to prepare a compliance assessment report, what each finding should contain and how status ratings are assigned under the Privacy Act. — Guidance text naming the report and a framework without populated fields (65 at most)
• Compliance assessment report Finding 1: ________ Status: ________ Remediation owner: [insert name] Due date: [dd/mm/yyyy] — Blank report template - placeholder fields are rejected
• Regulator publishes compliance review report: 40 per cent of agencies were non-compliant with the Essential Eight, the watchdog said on Monday. — News about a published review - no populated assessment fields
• Sample template for documenting control gaps against the Privacy Act. — Adjacent template language is not a populated assessment record
• Security incident report: root cause and containment findings. — Sibling report language does not satisfy the compliance-assessment primary

Known false positives

• Generic compliance in everyday contexts. Mitigation: Require assessment or report keywords alongside compliance.

References

• Privacy Act 1988 (Cth)
• Security of Critical Infrastructure Act 2018 (Cth)