AI Prompts for Compliance and Audit Teams That Actually Work

Most prompt collections are written for marketing teams, where a weak output costs an hour. Compliance and audit work differently: the output may be relied on, cited in a file, or questioned by a regulator. That changes what is worth asking for.

What follows is organised by task, with the limits stated. Every one assumes you verify the result — see our verification method — and that no client-identifiable or personal data goes into a tool your organisation has not approved.

Before anything: the confidentiality line

The single most important habit is to work with the shape of a problem rather than the data. Describe the scenario in generic terms. Replace names, amounts and identifiers. If the task genuinely requires the real data, it belongs in an approved internal tool or not in a tool at all.

Making a rule readable

Strong use. Models handle explanation of well-documented frameworks well, and you can check the result against the source.

Explain this obligation in plain English for a non-specialist audience. Keep every condition and exception intact. List the conditions as a numbered sequence, then state separately what is NOT required. Flag anything in the text that is ambiguous rather than resolving it.

The last clause is the useful part. Asking it to flag ambiguity rather than smooth it over surfaces the places you need to think.

Building a test plan or checklist

I am testing whether a control operates effectively. The control is [describe generically]. Propose a set of tests covering design and operating effectiveness, state what evidence each test would require, and identify what each test would NOT detect.

The blind-spot clause is what makes this worth running. A list of tests is easy; knowing what the tests miss is the professional judgement.

Challenging your own conclusion

The highest-value use in assurance work, and the least used.

Here is my conclusion and my reasoning: [paste]. Argue the opposite position as strongly as you can. Identify the weakest link in my reasoning, what evidence would overturn it, and what I appear to have assumed without stating it.

Used before you finalise, this catches unstated assumptions. Used after, it is a formality.

Drafting a finding or an exception

Draft a finding using this structure: condition, criterion, cause, effect, recommendation. Keep it factual and neutral. Do not characterise intent. Flag any point where I have given you effect without evidence of cause.

Models drift toward asserting cause because it reads better. The final clause pushes back on that.

Preparing for a difficult conversation

I need to raise [issue described generically] with a senior stakeholder who is likely to resist. List the three strongest objections they will make and a factual response to each. Tell me which of my points is weakest.

Summarising a long document

Summarise this for a reader who must decide whether it changes our obligations. Structure as: what changed, who it applies to, from when, and what is unchanged. Quote the specific wording for anything that imposes a duty. Say explicitly if the document does not address a point I should expect it to.

Insisting on quoted wording for duties gives you something checkable rather than a paraphrase.

What not to delegate

• Whether something is reportable. That is a judgement with consequences and it is yours.
• Current legal position on anything recent. Training data lags, and the model will not know it is out of date. The EU AI Act Article 4 amendment of July 2026 is a live example — material written before it reads perfectly and is wrong.
• Anything where you cannot check the source. If you could not verify it, do not rely on it.
• Risk appetite and materiality. These are organisational positions, not general knowledge.

Three habits that improve every prompt

Ask for the limitation. Adding "and tell me what this analysis cannot establish" to almost any prompt improves what comes back.

Give the audience. For a board, for a file, for a regulator — these produce materially different and better output than an unspecified request.

Refuse the smooth answer. If a response has no caveats and no gaps, that is usually a property of the writing rather than of the subject.

Frequently asked questions

Can I use these with client data?

Only in a tool your organisation has approved for it. Work with the generic shape of the problem by default.

Does using AI need to go in the file?

Record what you verified and how. That is the part that matters if the work is questioned.

Will this count toward CPD?

AI capability is relevant to compliance and audit roles, so it generally counts if recorded. Check your own body rules.

Our CPD courses cover AI for compliance and audit roles specifically, and our guide to AI certification for compliance professionals covers what credentials are worth your hours.