DG-12
Compliance Review Not Completed Before Development
DoD Gates
Default severity: medium
ProcessOutputQuality
What it detects
Configured compliance review fields (security, GDPR, legal, etc.) are unchecked when the issue enters the configured development stage. Compliance field names are configurable per regulatory context.
Detection formula
compliance_fields = config.dod.compliance_fields // e.g. \[\'security_reviewed\', \'gdpr_reviewed\', \'legal_reviewed\'\] FOR each_field F IN compliance_fields: IF field_value(F) = false AND issue.status IN config.dod.development_stages THEN FLAG with field_name in outputExamples in practice
- Issues advance workflow stages without meeting the configured Definition of Done score.
- Stage transitions occur before required DoD evidence is present.
- A team shows configured compliance review fields (security, gdpr, legal, etc while compliance fields is set to \[\].
Suggested response
Hold stage transitions until DoD evidence is complete and visible for auditors.
Coaching playbook
Symptom
Configured compliance review fields (security, GDPR, legal, etc.) are unchecked when the issue enters the configured development stage. Compliance field names are configurable per regulatory context.
Why it matters
When "Compliance Review Not Completed Before Development" keeps appearing, the team is signalling a repeatable process gap. Left unexamined, the pattern hides where work really stalls and makes improvement metrics harder to trust.
What you can achieve
Hold stage transitions until DoD evidence is complete and visible for auditors.
Facilitation questions
- What system change would stop "Compliance Review Not Completed Before Development" from firing again?
- What do the cited issues have in common — same root cause or same workaround?
- Who owns the two-week experiment and how will we verify on the next import?
Run this rule against your own tracker data with Flow Analyzer.