Prepare a draft audit of [AUDIT AREA] for the period [AUDIT PERIOD], using the records and policies in [SOURCE MATERIALS]. The purpose is [AUDIT OBJECTIVE]. Apply these criteria: [CONTROL CRITERIA]. Work only from the evidence I provide. Do not invent transactions, balances, policies, test results, management explanations, sample sizes, control operation, or conclusions. If data is unavailable, label it “not provided” and explain the effect on the audit work. Produce a structured audit memo with these sections: 1. Scope and objective: entities, period, systems, population, and exclusions. 2. Criteria: each control or policy requirement, with its source. 3. Method and assumptions: population definition, sampling method, sample size, thresholds, and any calculations. State why each assumption was necessary. 4. Procedures performed: a numbered procedure list tied to the relevant criterion and evidence. 5. Results: a table with criterion, evidence reviewed, test result, exception count, calculated exception rate where supportable, and evidence gap. 6. Findings: condition, criterion, likely cause only when supported, risk, and a practical corrective action with owner and target date placeholders. 7. Conclusion: clearly distinguish what the evidence supports from items requiring additional testing. For numbers, show formulas, inputs, units, rounding, and reconciliation steps. Do not call an exception a control failure unless the evidence supports that conclusion. Use neutral audit language; do not assign blame or provide legal, tax, or accounting advice beyond the supplied criteria. Before answering, reconcile every number to a stated source or mark it unverified. Then check that each finding cites both evidence and criterion. Ask up to 3 clarifying questions only if a required input is missing.
Fill in
| Placeholder | What to enter | Example |
|---|---|---|
| [AUDIT AREA] | Enter the process, account, system, or control area being reviewed. | Employee expense reimbursements |
| [AUDIT PERIOD] | Enter the exact date range or reporting period. | January 1 through June 30, 2026 |
| [SOURCE MATERIALS] | Paste or describe the policies, reports, transaction files, walkthrough notes, and evidence available. | Expense policy v4, reimbursement register of 842 claims, 30 receipt packets, approval workflow export, and AP reconciliation |
| [AUDIT OBJECTIVE] | State the assurance question the audit is intended to address. | Assess whether reimbursements were supported, approved, and paid in line with policy |
| [CONTROL CRITERIA] | List the policies, control requirements, regulations, or internal standards to test against. | Receipts required above $25; manager approval before payment; alcohol and personal expenses are nonreimbursable; claims submitted within 60 days |
How to use
- Paste the prompt into Copilot and attach or paste only the records you are authorized to use.
- Replace each placeholder, including the full control criteria and the audit period.
- Trace the result table back to source files and correct any unsupported calculation or conclusion.
- Send this follow-up: “Convert finding 2 into a workpaper with a test population, sample selection log, and evidence references.”
Variations
Control walkthrough
Use this before testing to document how a control is supposed to operate.
Create a control walkthrough memo for [PROCESS] based only on [WALKTHROUGH NOTES] and [POLICY]. Map each step from initiation through review, approval, recording, and reconciliation. Identify control owner, frequency, system evidence, handoffs, and segregation-of-duties points. Separate documented design from observed operation. List gaps as questions, not conclusions. Return a process narrative, a control matrix, and five targeted test procedures. Do not infer approvals, system settings, or control effectiveness. Ask up to 3 questions only if a required input is absent.
Exception analysis
Use this after a test to quantify and explain exceptions without overstating them.
Analyze the audit exceptions in [TEST RESULTS] against [CRITERIA]. Build a table showing population, sample, exception type, affected items, exception count, rate, financial amount if provided, and supporting evidence. Group recurring patterns, but do not infer root cause without documentation. Write a concise finding for material patterns using condition, criterion, evidence, risk, and recommended action. Identify whether results can be projected to the full population and state the assumptions needed. Flag any missing denominator, duplicate item, or unreconciled total before concluding.
Management response
Use this to turn a supported finding into a practical response draft.
Draft a management action-plan response to this audit finding: [FINDING]. Use these operational constraints: [CONSTRAINTS]. Produce a response with acknowledgment limited to supported facts, root cause marked as confirmed or to-be-validated, corrective actions, accountable owner, target dates, evidence of completion, and residual-risk statement. Do not concede legal liability or claim a fix has been completed unless my notes say so. Keep it under 300 words. Check that each action directly addresses a stated criterion or risk, and flag commitments that lack an owner or date.
Tips
- Define the population before asking for sampling analysis; a reimbursement register, paid invoices, and submitted claims may be different populations.
- Ask the model to show each formula because percentages can look credible while using the wrong denominator.
- Keep design assessment separate from operating-effectiveness testing; a well-written policy does not prove the control ran.
- Use evidence references that another reviewer can locate, such as file name, report date, transaction ID, or workpaper number.
FAQ
Can Copilot perform an audit on its own?
It can organize evidence and draft workpapers, but audit judgment, evidence sufficiency, testing, and sign-off remain human responsibilities.
Should I paste confidential audit evidence into Copilot?
Use only an approved enterprise environment and follow your organization’s data-handling policy. Redact identifiers when the work does not require them.
How do I avoid fabricated audit findings?
Require evidence references for every result, explicitly label missing data, and reject any conclusion that is not tied to a criterion and documented test result.