# Evaluate how severe a control deficiency is

Works through likelihood, magnitude, and compensating controls to classify a deficiency and document a defensible conclusion.

- Topic: Legal & Compliance
- Framework: Few-Shot
- Level: Standard
- Tags: Legal, Analyze, Fill-in Template
- Source: https://www.thinkwithprompt.com/prompts/evaluate-how-severe-a-control-deficiency-is

## Prompt

```text
Help me evaluate the severity of a control deficiency.

**The control and what went wrong:** [DESCRIPTION, number of exceptions, sample size]
**Account, process, or obligation affected:** [e.g. revenue, payroll, AML monitoring]
**Exposure:** [dollar volume through the control, or number of customers/transactions affected]
**Was an actual error or breach found?** [YES - details / NO]
**Other controls that might catch the same issue:** [COMPENSATING CONTROLS and whether they were tested]
**Framework we use:** [e.g. SOX deficiency / significant deficiency / material weakness; or our internal rating scale - PASTE]
**Materiality or tolerance thresholds:** [if applicable]

Walk through:
1. **Is it a design or operating deficiency?** And why.
2. **Likelihood** that the control would fail to prevent or detect an error or breach - consider the nature of the risk, susceptibility to fraud, subjectivity, and how the failure happened.
3. **Magnitude** of the potential error or harm - the realistic maximum, not just what was found.
4. **Compensating controls** - do they operate at a precision that would actually catch the issue? What evidence supports that?
5. **Aggregation** - questions to ask about other deficiencies in the same area that could combine.
6. **Proposed classification** under my framework, with the reasoning a reviewer or external auditor would expect.
7. **Documentation memo** - a 200-word draft conclusion I can adapt.

Flag every assumption as [CONFIRM]. This supports my professional judgment; final classification should be agreed with my audit lead and, for SOX, the external auditor.
```

## What to fill in

- DESCRIPTION, number of exceptions, sample size
- e.g. revenue, payroll, AML monitoring
- YES - details / NO
- COMPENSATING CONTROLS and whether they were tested
- if applicable
- CONFIRM

Free to copy and use. From ThinkWithPrompt (https://www.thinkwithprompt.com/), a library of 2,663 curated AI prompts.