30 Claude Prompts for Auditors

You are an audit senior designing substantive testing. <context> I need to document how I selected my sample so the workpaper stands on its own for review. </context> <inputs> - Population: [POPULATION DESCRIPTION, ALL VENDOR INVOICES] - Population size: [POPULATION SIZE] - Sampling method: [RANDOM, HAPHAZARD, OR STATISTICAL] - Sample size: [SAMPLE SIZE] - Confidence level if statistical: [CONFIDENCE LEVEL] </inputs> <task> Write the sample selection methodology section of a testing workpaper, explaining why this method fits the population and how the sample size was determined. </task> <constraints> Justify the sample size with a real reason tied to risk or population characteristics, not just a round number. Keep it factual, no hedging language. </constraints> <format> Return a short paragraph followed by a bullet list of the key parameters used. </format>

You are an internal audit tester. <context> I am testing a control and need an attribute sheet before I pull the sample. </context> <inputs> - Control description: [CONTROL DESCRIPTION] - Control frequency: [DAILY, WEEKLY, MONTHLY] - Population period: [PERIOD, JANUARY TO DECEMBER] - Attributes to test: [KEY ATTRIBUTES, APPROVAL SIGNATURE PRESENT] </inputs> <task> Build an attribute testing sheet that lists each attribute to check, the source document to pull it from, and what counts as an exception. </task> <constraints> Define exceptions precisely, an attribute that is ambiguous about pass or fail will produce inconsistent results across testers. Keep each attribute to one clear yes or no test. </constraints> <format> Return a table with columns Attribute, Source Document, Pass Criteria, Fail Criteria. </format>

You are an audit senior performing substantive analytics. <context> I want to use analytics instead of full sampling for this account and need to document an acceptable procedure. </context> <inputs> - Account: [ACCOUNT NAME] - Expected relationship or driver: [EXPECTED RELATIONSHIP, TIED TO HEADCOUNT] - Threshold for investigation: [THRESHOLD PERCENTAGE OR AMOUNT] - Data source: [DATA SOURCE] </inputs> <task> Design a substantive analytical procedure that states the expectation, the threshold that triggers further investigation, and the follow-up steps if the actual result exceeds the threshold. </task> <constraints> The expectation must be precise enough to actually test, not just directionally reasonable. State the threshold as a specific number. </constraints> <format> Return four short sections: Expectation, Data Used, Threshold, Follow-Up Steps. </format>

You are an auditor documenting a process walkthrough. <context> I just finished a walkthrough interview and need to turn my notes into a clean narrative for the file. </context> <inputs> - Process name: [PROCESS NAME, PROCURE TO PAY] - Interviewee and role: [INTERVIEWEE NAME AND TITLE] - Raw notes: [PASTE RAW WALKTHROUGH NOTES] - Systems involved: [SYSTEM NAMES] </inputs> <task> Turn the raw notes into a clear step by step process narrative, identifying where controls occur and flagging any step that sounded manual or informal. </task> <constraints> Preserve the actual sequence described, do not reorder steps to look tidier than what was described. Flag gaps or unclear points as open questions rather than guessing. </constraints> <format> Return a numbered step by step narrative, with control points marked using the label CONTROL and open questions listed at the end. </format>

You are an audit tester who found sample exceptions. <context> My testing turned up exceptions and I need to summarize them before discussing with the client. </context> <inputs> - Sample size tested: [SAMPLE SIZE] - Number of exceptions: [EXCEPTION COUNT] - Exception details: [PASTE EXCEPTION DETAILS] - Root cause if known: [ROOT CAUSE OR UNKNOWN] </inputs> <task> Summarize the exceptions found, calculate the exception rate, and state whether this rate suggests the control is operating effectively, needs extended testing, or should be considered failed. </task> <constraints> Show the exception rate as a percentage. Do not soften a clear failure into ambiguous language just to avoid a difficult conversation. </constraints> <format> Return a short summary paragraph followed by a recommendation line stating one of: Effective, Extend Sample, or Not Effective. </format>

You are an audit senior organizing the file. <context> I am assembling the workpaper file for this section and need a clean index before the reviewer opens it. </context> <inputs> - Audit area: [AUDIT AREA] - List of workpapers prepared: [LIST OF WORKPAPER NAMES] - Related financial statement line items: [LINE ITEMS] </inputs> <task> Create a workpaper index that lists each workpaper, its purpose in one line, and which financial statement assertion or line item it supports. </task> <constraints> Use the standard assertion names such as existence, completeness, valuation, rights and obligations, and presentation. Keep the purpose line under fifteen words each. </constraints> <format> Return a table with columns Workpaper Reference, Purpose, Assertion or Line Item Supported. </format>

You are audit staff finishing a testing workpaper. <context> I finished my testing and need a proper conclusion paragraph plus a tickmark legend before I mark this workpaper done. </context> <inputs> - Procedure performed: [PROCEDURE PERFORMED] - Items tested and result: [RESULTS SUMMARY] - Tickmarks used: [LIST OF TICKMARKS AND MEANINGS] </inputs> <task> Write the standard conclusion paragraph stating what was tested, what was found, and whether the objective of the procedure was met, plus format the tickmark legend. </task> <constraints> The conclusion must explicitly state whether the objective was achieved, do not leave that implied. Keep the tickmark legend to short phrases, not full sentences. </constraints> <format> Return a Conclusion paragraph followed by a Tickmark Legend as a simple list of symbol and meaning pairs. </format>

You are an audit senior responding to reviewer comments. <context> My reviewer left comments on my workpaper and I need to draft responses before resubmitting. </context> <inputs> - Review note text: [PASTE REVIEW NOTE] - Additional work performed or evidence found: [WHAT YOU DID TO ADDRESS IT] - Workpaper reference: [WORKPAPER REFERENCE NUMBER] </inputs> <task> Draft a clear response to the review note explaining what additional work was done and where the reviewer can find the supporting evidence. </task> <constraints> Reference the exact workpaper or page where new evidence lives. If the note cannot be fully resolved, say so directly instead of implying it is closed. </constraints> <format> Return a short response formatted as Note, Response, Evidence Location, Status (Resolved or Open). </format>

You are audit staff preparing a supporting schedule. <context> I built a supporting schedule in a spreadsheet and need a short narrative to accompany it in the workpaper. </context> <inputs> - Schedule purpose: [SCHEDULE PURPOSE] - Source of data: [DATA SOURCE] - Key totals or figures: [KEY FIGURES] - Tie out to general ledger: [TIE OUT AMOUNT OR REFERENCE] </inputs> <task> Write a narrative explaining what the schedule shows, where the data came from, and how the totals were tied to the general ledger. </task> <constraints> State the exact tie out figure and reference. Keep the narrative under 150 words. </constraints> <format> Return a single narrative paragraph, no headers needed. </format>

You are an audit manager closing out a file before archiving. <context> Fieldwork is done and I need a checklist to confirm the file is ready to close before it goes to the partner. </context> <inputs> - Audit area: [AUDIT AREA] - Outstanding items: [LIST OF OPEN ITEMS, IF ANY] - Sign off requirements: [WHO MUST SIGN OFF] </inputs> <task> Produce a file completion checklist covering documentation completeness, open item resolution, and required sign offs before archiving. </task> <constraints> Call out any outstanding item as a blocker, do not bury it in a general note. Keep each checklist item actionable and specific. </constraints> <format> Return a checklist with checkbox style items grouped under Documentation, Open Items, and Sign Off. </format>

You are an audit senior writing up a control deficiency. <context> I identified a control gap during testing and need to write it up in a format the client and partner will both accept. </context> <inputs> - Condition observed: [WHAT WAS OBSERVED] - Criteria or standard expected: [CRITERIA OR POLICY REFERENCE] - Root cause: [ROOT CAUSE] - Potential effect: [POTENTIAL EFFECT OR EXPOSURE] </inputs> <task> Write the finding using the condition, criteria, cause, and effect structure, ending with a recommendation. </task> <constraints> Keep each section to two or three sentences. State the effect in concrete terms such as dollar exposure or compliance risk, not vague language like could be an issue. </constraints> <format> Return four labeled sections: Condition, Criteria, Cause, Effect, followed by a Recommendation section. </format>

You are an audit manager rating a finding before it goes into the report. <context> I need to justify why I rated this finding as high, medium, or low severity before the partner review. </context> <inputs> - Finding summary: [FINDING SUMMARY] - Financial or operational impact: [IMPACT ESTIMATE] - Likelihood of recurrence: [LIKELIHOOD] - Compensating controls if any: [COMPENSATING CONTROLS OR NONE] </inputs> <task> Recommend a severity rating and justify it based on impact, likelihood, and any compensating controls, using a consistent rating scale. </task> <constraints> Pick one rating, do not hedge between two levels. Explicitly address whether compensating controls lower the rating and why. </constraints> <format> Return a Recommended Rating line followed by a short justification paragraph. </format>

You are an audit senior requesting a formal response to a finding. <context> I need to send the finding to the process owner and ask for their management response and remediation plan. </context> <inputs> - Process owner name: [PROCESS OWNER NAME] - Finding summary: [FINDING SUMMARY] - Response due date: [DUE DATE] </inputs> <task> Draft a professional email that presents the finding, asks for a management response and remediation timeline, and sets the due date. </task> <constraints> Keep the tone direct but not accusatory. State the due date explicitly in the first paragraph, not buried at the end. </constraints> <format> Return a subject line and email body, under 180 words. </format>

You are an audit manager investigating a repeat finding. <context> This same type of issue showed up last year and again this year, and I need to dig into why it keeps happening. </context> <inputs> - Issue description: [ISSUE DESCRIPTION] - Prior year occurrence: [PRIOR YEAR DETAILS] - Current year occurrence: [CURRENT YEAR DETAILS] - Process changes attempted: [WHAT MANAGEMENT TRIED, IF ANYTHING] </inputs> <task> Analyze why the same issue recurred despite prior remediation, distinguishing a surface cause from the underlying systemic cause. </task> <constraints> Do not accept the prior remediation plan's stated cause at face value if the issue recurred, dig one level deeper. Be specific about what evidence supports the deeper cause. </constraints> <format> Return two sections: Surface Cause and Underlying Cause, each with a short explanation, followed by one sentence on why the prior fix did not hold. </format>

You are an audit director preparing the committee presentation. <context> I need to summarize all findings from this engagement into a short section for the audit committee packet. </context> <inputs> - List of findings with severity: [LIST OF FINDINGS AND RATINGS] - Overall audit opinion or conclusion: [OVERALL CONCLUSION] - Number of high severity items: [COUNT] </inputs> <task> Write an executive summary that gives the overall conclusion first, then summarizes findings grouped by severity, written for people who will not read the detailed workpapers. </task> <constraints> Lead with the overall conclusion, not a list of findings. Keep it to one page equivalent, plain language, no jargon without explanation. </constraints> <format> Return an Overall Conclusion paragraph followed by three short sections: High Severity, Medium Severity, Low Severity, each a brief bullet list. </format>

You are an internal audit senior building a control matrix. <context> I am documenting the risk and control matrix for a process before testing begins. </context> <inputs> - Process name: [PROCESS NAME] - Risks identified: [LIST OF RISKS] - Controls in place: [LIST OF CONTROLS] - Control owner: [CONTROL OWNER ROLE] </inputs> <task> Build a risk and control matrix that pairs each risk with its mitigating control, the control owner, and whether the control is preventive or detective. </task> <constraints> Every risk must map to at least one control, flag any risk with no mapped control instead of leaving it blank. Classify each control as preventive or detective, not both. </constraints> <format> Return a table with columns Risk, Control Description, Control Owner, Type (Preventive or Detective). </format>

You are an audit senior assessing control design before testing operating effectiveness. <context> Before I test whether a control operates, I need to assess whether it is even designed well enough to prevent the risk. </context> <inputs> - Control description: [CONTROL DESCRIPTION] - Risk it addresses: [RISK ADDRESSED] - Frequency and who performs it: [FREQUENCY AND PERFORMER] </inputs> <task> Assess whether the control as designed would actually prevent or detect the risk if operating as described, and identify any design gaps. </task> <constraints> Separate a design gap from an operating gap, this assessment is about design only. If the control would not catch the risk even when working perfectly, say so plainly. </constraints> <format> Return a short assessment stating Design Adequate or Design Gap, followed by a one paragraph explanation. </format>

You are an audit senior reviewing access and role assignments. <context> I have a list of who can perform which functions in the system and need to check for segregation of duties conflicts. </context> <inputs> - Roles and access list: [PASTE ROLES AND ACCESS RIGHTS] - System or application: [SYSTEM OR APPLICATION NAME] - Incompatible function pairs to check: [PAIRS TO CHECK, CREATE VENDOR AND APPROVE PAYMENT] </inputs> <task> Identify any individual or role holding both sides of an incompatible function pair, and note the risk each conflict creates. </task> <constraints> Only flag actual conflicts based on the access list given, do not assume a conflict exists without evidence in the inputs. State the specific risk for each conflict found. </constraints> <format> Return a table with columns Person or Role, Conflicting Functions Held, Risk Created. </format>

You are an internal audit manager reducing an oversized control list. <context> The process owner listed twenty controls for this process and I need to identify which ones are actually key controls worth testing. </context> <inputs> - Full control list: [PASTE FULL CONTROL LIST] - Top risks for the process: [TOP RISKS] - Testing budget or hours available: [HOURS AVAILABLE] </inputs> <task> Rank the controls by how directly each one mitigates a top risk, and recommend which controls should be classified as key controls given the testing budget. </task> <constraints> Justify each key control selection by tying it to a specific top risk, not just its position on the original list. State clearly which controls are being excluded and why. </constraints> <format> Return two lists: Key Controls Recommended For Testing, and Controls Excluded With Reason. </format>

You are an audit senior updating documentation after a system change. <context> The client rolled out a new system for this process and my existing control matrix is now out of date. </context> <inputs> - Old control matrix summary: [OLD CONTROLS SUMMARY] - New system or process description: [NEW SYSTEM DESCRIPTION] - Controls confirmed still in place: [CONTROLS CONFIRMED] - Controls confirmed removed or changed: [CONTROLS CHANGED OR REMOVED] </inputs> <task> Update the control matrix to reflect the new system, flagging which controls carried over unchanged, which changed, and which are new gaps needing a control. </task> <constraints> Do not assume an old control still works the same way in the new system unless it was confirmed. Flag any risk that now has no control as a priority item. </constraints> <format> Return a table with columns Risk, Old Control Status, New Control Status, Action Needed. </format>

You are an audit manager drafting the final report. <context> Fieldwork and review are complete and I need a first draft of the executive summary section of the report. </context> <inputs> - Audit objective: [AUDIT OBJECTIVE] - Overall conclusion: [OVERALL CONCLUSION] - Number and severity of findings: [FINDINGS COUNT AND SEVERITY] - Scope period: [SCOPE PERIOD] </inputs> <task> Draft an executive summary stating the objective, scope, overall conclusion, and a brief count of findings by severity. </task> <constraints> State the overall conclusion in the first two sentences. Keep the entire summary under 200 words. </constraints> <format> Return a single executive summary section, no subheadings needed. </format>

You are an audit senior reviewing a client's remediation plan. <context> The process owner sent back a remediation plan for a finding and I need to check it is actually adequate before I accept it. </context> <inputs> - Finding it addresses: [FINDING SUMMARY] - Remediation plan as submitted: [PASTE REMEDIATION PLAN] - Target completion date: [TARGET DATE] </inputs> <task> Evaluate whether the remediation plan actually addresses the root cause of the finding, has a realistic timeline, and names a responsible owner. </task> <constraints> If the plan only addresses symptoms and not the root cause, say so directly and explain what is missing. Do not accept a plan with no named owner as adequate. </constraints> <format> Return an Adequate or Needs Revision decision line, followed by a short explanation of what is missing if applicable. </format>

You are an internal audit director reporting to executive leadership. <context> I need to give leadership a short quarterly update on where all open audits and findings stand. </context> <inputs> - Audits in progress: [LIST OF AUDITS IN PROGRESS] - Audits completed this quarter: [LIST OF COMPLETED AUDITS] - Open high severity findings across the department: [LIST OF OPEN HIGH SEVERITY ITEMS] </inputs> <task> Summarize the quarter's audit activity and highlight any open high severity finding that is approaching or past its remediation deadline. </task> <constraints> Lead with anything overdue or at risk, not with a general activity recap. Keep the whole update to a half page equivalent. </constraints> <format> Return three short sections: In Progress, Completed This Quarter, Attention Needed. </format>

You are an audit manager closing out an engagement. <context> The engagement just wrapped and I want to capture what went well and what should change before the next audit of this area. </context> <inputs> - Audit area: [AUDIT AREA] - Challenges encountered during fieldwork: [CHALLENGES FACED] - Team feedback: [TEAM FEEDBACK NOTES] </inputs> <task> Summarize lessons learned from this engagement, separating process improvements for the audit team from observations to carry into next year's planning. </task> <constraints> Be specific enough that next year's planner could act on it, avoid generic statements like communication could improve. Name the actual friction point. </constraints> <format> Return two sections: For Next Year's Planning, and For the Audit Team's Process. </format>

You are an audit senior tracking overdue findings. <context> A finding's remediation deadline has passed with no update from the process owner and this needs to go up a level. </context> <inputs> - Finding summary: [FINDING SUMMARY] - Original due date: [ORIGINAL DUE DATE] - Days overdue: [DAYS OVERDUE] - Process owner and their manager: [PROCESS OWNER AND MANAGER NAMES] </inputs> <task> Draft an escalation note to the process owner's manager explaining the overdue status and requesting a firm new commitment date. </task> <constraints> State the days overdue as a specific number in the first sentence. Keep the tone professional and factual, not confrontational. </constraints> <format> Return a short escalation note under 150 words, addressed to the manager. </format>