Validate that an audit issue is really fixed before closing it
Sets out the evidence and tests needed to confirm remediation is effective and sustained, so issues are not closed on paper only.
The prompt
Help me validate whether an audit or compliance issue has actually been remediated.
Original issue: [CONDITION, root cause, and rating]
Agreed action plan: [WHAT management committed to, owner role, due date]
What management says they did: [THEIR UPDATE]
Evidence they provided: [LIST or PASTE]
Time since the fix went live: [e.g. 2 months]
Assess and return:
1. Does the action address the root cause or only the symptom? Explain.
2. Evidence evaluation - for each item: what it proves, what it does not prove, and whether it is sufficient.
3. Validation tests I should perform - e.g. re-perform the control on a sample after the change date, inspect system configuration, confirm with users, re-run the original test.
4. Sustainability check - has the fix operated long enough and through enough cycles (e.g. at least one quarter-end for a quarterly control)?
5. Recommendation - close / keep open / close with residual risk accepted (by whom) / re-rate.
6. Closure note - a 100-word draft for the issue tracker.
7. If not ready - a firm, constructive message to the action owner explaining what is still needed and why.
Do not accept a new policy, a training session, or an email as proof a control operates. Mark anything uncertain [CONFIRM].
Highlighted [brackets] are blanks to replace with your own details.
Fill in the blanks and use this promptMore Legal & Compliance prompts
What to fill in
- CONDITION, root cause, and rating
- WHAT management committed to, owner role, due date
- THEIR UPDATE
- LIST or PASTE
- e.g. 2 months
- CONFIRM
How this prompt is built
This prompt follows the Few-Shot structure (Few-shot prompting). A few-shot prompt includes one or more worked examples of the input and the output you want, so the model can copy the pattern instead of guessing it.
Related prompts
- Assess subrecipient risk and plan grant monitoringA risk assessment and monitoring plan for organizations you pass grant funds to, scaled to their risk and aligned to your award terms.
- Check auditor independence before accepting a new attest clientA structured independence and threats-and-safeguards review for a CPA firm before taking on an audit, review, or other attest engagement.
- Build a risk-based annual internal audit planScores the audit universe on risk factors and turns it into a prioritized annual plan that fits my team's capacity.
- Assess the impact of a regulatory changeWhat a new rule requires, who it affects, and what must change.