Better audit AI starts with a clearer brief
A useful prompt reads like a clear assignment. Specify the task, the permitted records, the expected output, and what the assistant should do when the evidence is incomplete.
By Clark · October 14, 2026 · Updated October 14, 2026 · 3 min read
Name the work you want prepared
“Review these files” leaves important choices unstated. Say whether you need an organized document list, a proposed match, a draft schedule, or a summary of identified differences. Include the entity and period so the task has a clear boundary.
Give the assistant the firm-approved instructions relevant to that task. Identify which records it may use and which questions it should leave for a person. Keep confidential client information within tools and environments your firm has approved.
Make the expected output inspectable
Request an output that a colleague can check against the source. A table might include the proposed value, the file and location used, an explanation, and any unresolved question. Ask the assistant to distinguish missing information from a finding supported by a record.
Here is a synthetic preparation brief: “Using only the supplied fictional invoices, draft a table of invoice numbers, dates, and totals. Include the file name and page for each entry. Flag missing or conflicting totals for review. Do not fill gaps by guessing or determine accounting treatment.”
- Task: one defined preparation activity
- Sources: the records permitted for that activity
- Output: a format with traceable references
- Boundary: what remains unresolved for human review
Test what happens when the input is awkward
Before using a prompt repeatedly, try it with authorized test material that includes an unreadable field, a duplicate record, or conflicting values. Inspect whether the assistant identifies the problem and whether its references point to the relevant information.
A request to avoid guessing does not guarantee that an AI system will comply. Check the output against the supplied material and investigate unsupported entries. NIST’s voluntary Generative AI Profile provides broader risk-management context; prompt wording is only one part of evaluating a workflow.
Keep the review with the work
After review, retain the accepted output, relevant support, and corrections through your firm’s normal documentation process. If the prompt is reused, keep the version that produced the draft so the team can understand the preparation approach.
Refine the brief using specific problems found in review. For example, clarify whether the requested amount is a subtotal or a total rather than adding a vague instruction to “be more accurate.” Measure whether the next draft is easier to inspect, while keeping evidence evaluation, accounting treatment, and approval with authorized people.
Sources and scope
- NIST Generative AI Risk Management Profile
A voluntary resource for managing generative AI risks. It provides background for evaluating AI output; the prompt example and workflow suggestions here are Clark’s editorial guidance, not a NIST-prescribed audit procedure.