Analyze why a compliance breach happened and prevent repeats
Analyzes a breach or incident to separate people, process, system, and governance causes and recommend fixes that prevent repeats.
The prompt
Help me do a root cause analysis of a compliance breach or control failure.
What happened: [FACTS - timeline, what was breached, how it was detected]
Impact: [customers affected, financial, regulatory, reputational - only what is known]
Relevant policy or control: [PASTE]
People and teams involved (by role): [ROLES]
What has been done so far: [CONTAINMENT and any immediate fixes]
Work through:
1. Timeline - key events in order, including the moments it could have been prevented or detected earlier.
2. 5 Whys - at least two separate chains, not just one.
3. Cause categories - people (knowledge, capacity, incentives), process (unclear steps, handoffs), technology (system gaps, manual workarounds), governance (ownership, oversight, escalation), culture (pressure, tone).
4. Why existing controls did not prevent or detect it.
5. Similar exposures - where else the same root cause could exist.
6. Recommendations table - columns: Root cause addressed, Action, Type (preventive/detective/corrective), Owner role, Effort, Priority.
7. Notification check - questions to ask legal about whether this triggers reporting to a regulator, customers, or others, and by when.
Rules: "human error" is never a final root cause - ask why the error was possible and why it was not caught. Do not assign blame to individuals. Mark assumptions [CONFIRM].
Highlighted [brackets] are blanks to replace with your own details.
Fill in the blanks and use this promptMore Legal & Compliance prompts
What to fill in
- FACTS - timeline, what was breached, how it was detected
- PASTE
- ROLES
- CONTAINMENT and any immediate fixes
- CONFIRM
How this prompt is built
This prompt follows the RTF structure (Role, Task, Format). RTF tells the model who to be, what to do and what shape the answer should take. It is the quickest structure that still gives noticeably better results than a bare request.
Related prompts
- Build a SOC 2 readiness plan for my startupA gap assessment and phased plan to get SOC 2 Type I and then Type II without over-engineering.
- Assess the impact of a regulatory changeWhat a new rule requires, who it affects, and what must change.
- Assess subrecipient risk and plan grant monitoringA risk assessment and monitoring plan for organizations you pass grant funds to, scaled to their risk and aligned to your award terms.
- Check auditor independence before accepting a new attest clientA structured independence and threats-and-safeguards review for a CPA firm before taking on an audit, review, or other attest engagement.