Evaluate how severe a control deficiency is
Works through likelihood, magnitude, and compensating controls to classify a deficiency and document a defensible conclusion.
The prompt
Help me evaluate the severity of a control deficiency.
The control and what went wrong: [DESCRIPTION, number of exceptions, sample size]
Account, process, or obligation affected: [e.g. revenue, payroll, AML monitoring]
Exposure: [dollar volume through the control, or number of customers/transactions affected]
Was an actual error or breach found? [YES - details / NO]
Other controls that might catch the same issue: [COMPENSATING CONTROLS and whether they were tested]
Framework we use: [e.g. SOX deficiency / significant deficiency / material weakness; or our internal rating scale - PASTE]
Materiality or tolerance thresholds: [if applicable]
Walk through:
1. Is it a design or operating deficiency? And why.
2. Likelihood that the control would fail to prevent or detect an error or breach - consider the nature of the risk, susceptibility to fraud, subjectivity, and how the failure happened.
3. Magnitude of the potential error or harm - the realistic maximum, not just what was found.
4. Compensating controls - do they operate at a precision that would actually catch the issue? What evidence supports that?
5. Aggregation - questions to ask about other deficiencies in the same area that could combine.
6. Proposed classification under my framework, with the reasoning a reviewer or external auditor would expect.
7. Documentation memo - a 200-word draft conclusion I can adapt.
Flag every assumption as [CONFIRM]. This supports my professional judgment; final classification should be agreed with my audit lead and, for SOX, the external auditor.
Highlighted [brackets] are blanks to replace with your own details.
Fill in the blanks and use this promptMore Legal & Compliance prompts
What to fill in
- DESCRIPTION, number of exceptions, sample size
- e.g. revenue, payroll, AML monitoring
- YES - details / NO
- COMPENSATING CONTROLS and whether they were tested
- if applicable
- CONFIRM
How this prompt is built
This prompt follows the Few-Shot structure (Few-shot prompting). A few-shot prompt includes one or more worked examples of the input and the output you want, so the model can copy the pattern instead of guessing it.
Related prompts
- Check my AI workflow for privacy and data-protection risksMaps the personal and confidential data in an AI-assisted process and flags privacy and compliance risks to fix before launch.
- Write a suspicious activity report (SAR) narrativeA clear, chronological SAR narrative that answers who, what, when, where, why, and how, ready for compliance review.
- Assess subrecipient risk and plan grant monitoringA risk assessment and monitoring plan for organizations you pass grant funds to, scaled to their risk and aligned to your award terms.
- Run a HIPAA security risk assessment for a small practiceA structured security risk analysis covering where ePHI lives, threats, likelihood and impact ratings, and a documented remediation plan.