Act as an internal audit professional helping me prepare a transparent audit workpaper and draft report. Use only the evidence and figures I provide. Do not fabricate test results, population sizes, control operation, interviews, policy requirements, exceptions, or management responses. Audit objective and scope: [AUDIT SCOPE] Process, risks, and control objectives: [PROCESS AND RISKS] Criteria and policies: [AUDIT CRITERIA] Evidence, data, and sample information: [EVIDENCE AND DATA] Reporting audience and period: [AUDIENCE AND PERIOD] Ask up to 3 clarifying questions only if a required input is missing. Then produce: 1. A planning summary: objective, in-scope and out-of-scope areas, period, criteria, key inherent risks, and limitations. 2. A risk-and-control matrix. For each risk, show control objective, stated control activity, frequency, owner role, evidence expected, test procedure, population or sample basis, result status, and residual risk. Use "not provided" where evidence is absent. 3. A findings log with condition, criteria, cause only when supported, effect or exposure, evidence reference, severity rationale, recommendation, accountable management role, and target date placeholder. 4. A concise draft report: executive summary, scope and method, findings, and limitations. Label all untested controls and incomplete evidence clearly. Do not equate the presence of a policy with operating effectiveness. Do not quantify exposure unless my evidence supports the calculation; show the formula, source fields, and assumptions for every number. Distinguish control design gaps from operating exceptions, and distinguish fact from auditor inference. Before answering, self-check that each finding maps to a criterion and evidence reference, and flag any conclusion that exceeds the supplied sample or evidence.
Fill in
| Placeholder | What to enter | Example |
|---|---|---|
| [AUDIT SCOPE] | State the audit objective, entities or systems included, process boundaries, and exclusions. | Review employee expense reimbursement approvals for the U.S. sales team, excluding corporate card transactions and payroll, from January 1 through June 30. |
| [PROCESS AND RISKS] | Describe the process flow, key risks, existing controls, and responsible roles. | Employees submit in Concur; managers approve; AP checks receipts over $25. Risks include unapproved spend, duplicate claims, missing receipts, and approval after reimbursement. |
| [AUDIT CRITERIA] | Provide relevant policy clauses, regulatory requirements, standards, or management-approved criteria. | Travel policy v4.2 requires manager approval before payment, itemized receipts for expenses over $25, and finance approval for alcohol over $100. |
| [EVIDENCE AND DATA] | Provide available documents, test results, data fields, population counts, sample method, and exceptions. | Population: 486 reimbursements totaling $182,400. Random sample: 30. Four lacked itemized receipts; two were approved one day after payment; no duplicates found in the sample. |
| [AUDIENCE AND PERIOD] | State who will receive the report and the audit period covered. | Report to controller and Audit Committee; period January-June 2026. |
How to use
- Paste the approved audit scope and criteria first, then add only evidence you can point to or reproduce.
- State the population and sampling basis so the draft does not imply broader assurance than the work supports.
- Check each finding for a condition, criterion, evidence reference, and a recommendation that addresses the actual gap.
- Follow up with: "Draft management action-plan questions for each finding without proposing management's response for them."
Variations
Audit test program
Use this before fieldwork to turn risks and criteria into documented procedures.
Create a risk-based internal audit test program for [PROCESS] using [RISKS], [CONTROL OBJECTIVES], [CRITERIA], and [AVAILABLE DATA]. Produce a table with audit objective, risk, control, design test, operating-effectiveness test, required evidence, population definition, sampling consideration, exception criteria, and workpaper conclusion field. Separate inquiry, observation, inspection, and reperformance procedures. Do not assert that any control operates effectively or prescribe a sample size without stating its assumptions. Ask up to 3 questions only if a required input is missing.
Finding rewrite
Use this to make a draft finding factual, clear, and defensible before reporting.
Rewrite this internal audit finding: [DRAFT FINDING]. Use these supporting details: [EVIDENCE], [CRITERIA], and [SCOPE LIMITS]. Return a title, condition, criteria, cause only if evidence supports it, risk or effect, recommendation, and severity rationale. Preserve uncertainty and label missing evidence. Avoid accusatory language and do not infer intent. State whether it is a design deficiency, operating exception, or both. Ask up to 3 questions only if essential information is absent.
Management action tracker
Use this after reporting to monitor remediation without closing actions prematurely.
Build an audit remediation tracker from [FINDINGS] and [MANAGEMENT ACTIONS]. For each item, include finding ID, root cause as validated or unvalidated, action, owner role, due date, milestone, evidence needed for validation, status, overdue trigger, and closure decision. Flag actions that describe activity but do not address the control objective. Do not mark anything closed without validation evidence. Ask up to 3 clarifying questions only if a required input is missing.
Tips
- Start with criteria before writing a finding; an undesirable condition is not automatically an audit finding without an applicable requirement or control objective.
- Record the population, sample selection, and exceptions separately so readers can understand the limits of the conclusion.
- A control that exists on paper still needs evidence it operated at the required frequency and before the relevant risk event.
- Recommendations should repair the control objective, not merely request more training or reminders unless evidence shows that is the root cause.
FAQ
Can AI write an internal audit report from raw notes?
Yes, it can organize notes into a draft, but the auditor must validate evidence, scope, severity, and conclusions. AI should not be used to create test results or management responses.
What makes an audit finding defensible?
It ties an observed condition to a defined criterion, evidence, scope, and a reasonable explanation of risk. Unsupported causes and quantified exposure weaken it.
Can this prompt determine sample size?
It can describe sampling considerations, but sample-size decisions depend on population, risk, expected error rate, audit methodology, and required assurance.