I am an auditor working on [ENGAGEMENT TYPE] for [CLIENT OR ENTITY] for the period [PERIOD]. My applicable framework and firm requirements are [STANDARDS AND FIRM GUIDANCE]. Based only on the information I provide, create six separate copy-paste prompts for ChatGPT, Claude, or Gemini to support my work. Create one prompt each for: 1) a planning risk assessment, 2) walkthrough questions and expected controls, 3) a substantive testing program, 4) a workpaper review for missing evidence or conclusions, 5) a draft client information request, and 6) a finding or management-letter observation. Every prompt must instruct the AI to distinguish facts, management assertions, auditor procedures, evidence obtained, and conclusions. For risk and testing prompts, require the output to connect the relevant assertion, risk, control or procedure, population, sample approach, evidence, exceptions, and conclusion. For findings, use condition, criteria, cause, effect or risk, and recommendation; do not assume a cause if none is documented. For client requests, specify the requested records, period, format, preparer, and due date only when I supply them. Output a numbered list of six prompts, each with a short title and 90-140 words. Include a brief “Use this when” line under each prompt. Ask up to three clarifying questions only if a required input is missing. Before answering, check that no prompt asks the AI to fabricate evidence, management representations, sample results, control operation, or audit conclusions. Also flag where professional judgment, firm methodology, or consultation is still required.
Fill in
| Placeholder | What to enter | Example |
|---|---|---|
| [ENGAGEMENT TYPE] | State the audit, review, internal audit, or compliance engagement and its objective. | Internal audit of procure-to-pay controls |
| [CLIENT OR ENTITY] | Enter the client or entity name or a non-confidential description. | North Harbor Foods, a regional distributor |
| [PERIOD] | Enter the reporting period or dates under examination. | January 1 through June 30, 2026 |
| [STANDARDS AND FIRM GUIDANCE] | Name the accounting, auditing, regulatory, and firm methodology requirements that apply. | IIA Standards, company internal audit methodology, and delegated-authority policy |
How to use
- Replace each bracketed field with the engagement facts and governing standards.
- Paste the prompt, then provide only approved, non-sensitive engagement information.
- Check that procedures tie to the right assertion or control objective and that evidence is named precisely.
- Follow up with: “Turn prompt 3 into a testing sheet with columns for population, sample item, evidence, exception, and reviewer sign-off.”
Variations
Audit planning memo
Use this when you need a concise planning document for reviewers.
I am preparing an audit planning memo for [ENGAGEMENT] covering [PERIOD]. Use only [BACKGROUND AND PRIOR-YEAR ISSUES]. Draft a 600-word memo with scope, objectives, significant risks, relevant assertions or control objectives, planned procedures, staffing assumptions, and open questions. Separate known facts from planning assumptions. Do not invent controls, prior findings, or risk ratings. Ask up to 3 questions only if required inputs are missing, then check that every planned procedure addresses a stated risk.
Control walkthrough
Use this when documenting a process walkthrough with a control owner.
Create a walkthrough interview guide for [PROCESS] at [ENTITY] for [PERIOD]. My known process details are [PROCESS NOTES]. Produce 12-15 sequenced questions that trace one transaction from initiation through recording and review. For each question, state the expected evidence, responsible role, relevant risk, and possible follow-up when the control is absent or manual. Do not treat management explanations as evidence. Ask up to 3 questions only if an input is missing. Check that the guide covers initiation, authorization, processing, reconciliation, and exception handling.
Audit finding draft
Use this when evidence supports an observation but the wording needs discipline.
Using [DOCUMENTED CONDITION] and [APPLICABLE CRITERIA], draft an audit observation for [ENTITY OR PROCESS]. Include condition, criteria, risk or effect, and a practical recommendation in 250-350 words. Include cause only if [CAUSE EVIDENCE] supports it; otherwise label cause as needing management input. Do not state a monetary impact unless [QUANTIFIED IMPACT] is supplied. Ask up to 3 questions only if required inputs are missing. Check that each factual claim is traceable to the provided material and that the recommendation addresses the condition.
Tips
- Treat AI output as draft workpaper support, not audit evidence or a substitute for required supervision and review.
- Give the model the relevant assertion or control objective; “test revenue” is too broad to produce a defensible procedure.
- Remove client names, account numbers, payroll data, and other restricted information unless your firm-approved AI environment permits it.
- For every generated procedure, confirm the population, period, evidence source, exception criterion, and conclusion are feasible before using it.
FAQ
Can I use AI to write audit conclusions?
It can organize documented facts into a draft, but the engagement team must evaluate sufficiency and appropriateness of evidence and reach the conclusion.
What information should I avoid pasting into an AI tool?
Follow your firm and client policies. Usually this includes confidential client data, personal data, credentials, and information outside an approved AI environment.
Will these prompts work for internal and external audit?
Yes, but replace the standards and framework fields and adjust the evidence, reporting, and independence requirements for the engagement.