How do you implement automated compliance monitoring and reporting workflows?

Compliance automation continuously monitors systems, processes, and data for regulatory adherence. Architecture: data collectors pull configuration and activity data from systems (cloud infrastructure, databases, applications), compliance rules engine evaluates collected data against regulatory requirements, and reporting generates evidence packages for auditors. Regulatory frameworks: SOC 2 (security, availability, processing integrity, confidentiality, privacy), GDPR (data protection, consent management, right to erasure), HIPAA (PHI protection, access controls, audit trails), PCI DSS (cardholder data protection, network security, monitoring). Implementation: infrastructure compliance (AWS Config, Azure Policy, or OPA/Rego for multi-cloud), code compliance (static analysis for security vulnerabilities, license compliance for dependencies), data compliance (PII detection and classification, data lineage tracking, retention policy enforcement), and access compliance (periodic access reviews, privilege escalation detection, orphaned account identification). Automated controls: continuous monitoring dashboards showing compliance posture, automated evidence collection for audit requests, drift detection alerting when configurations deviate from baselines, and automated remediation for common violations (e.g., auto-encrypt unencrypted storage, auto-revoke excessive permissions). Reporting: generate compliance reports on schedule (monthly, quarterly), maintain evidence repositories with versioning, and create audit-ready documentation packages. Workflow integration: compliance violations trigger incident workflows, remediation tasks auto-assign to responsible teams, and closure requires evidence of fix verification.