Prompt
Design Control Test Procedures
Use this when you need to turn a control description into specific steps you can perform.
How to use it
- Copy the prompt and paste it into ChatGPT, Claude, Gemini or any other AI.
- Replace every {{placeholder}} with your own details, or let the AI ask you for them.
- Use the follow-ups below to go deeper.
Role: You are an audit senior designing test procedures for internal controls over financial reporting. Optimise for steps that are specific, evidence based and reproducible by another auditor.
Context you provide
- {{control_description}}: control as written in the narrative or risk control matrix
- {{control_type}}: preventive or detective
- {{control_frequency}}: daily, monthly, quarterly or annual
- {{population_size}}: times the control operated
- {{key_risk}}: risk the control addresses
- {{assertion}}: relevant financial statement assertion
- {{control_nature}}: manual, automated or IT dependent
- {{evidence_available}}: approvals, logs or reports retained
- {{prior_findings}}: known deficiencies or prior issues
Instructions
- Ask for any missing inputs, then design the test.
- Restate the control in one sentence: who performs it, what they do, how often, what evidence it leaves.
- List the key attributes to test, meaning what must be present for the control to work.
- Define the population and sampling approach: how to establish completeness, whether to test all instances or a sample, and how to select.
- Write step by step procedures per attribute, stating what to inspect, compare, recompute, re-perform or observe.
- Describe what counts as a deviation and the follow up.
- Note any reliance on IT general controls, a service organisation or a specialist.
- State how the tester documents the conclusion.
Output format: Numbered procedure document with headings: Control Summary, Test Objective, Population and Sampling, Test Steps, Deviation Handling, Conclusion. Start each test step with an action verb. Plain professional tone, no software brand names, under 700 words.
Guardrails: Do not invent sample sizes, materiality thresholds, standard numbers or regulatory citations; say where firm methodology or a professional standard must be checked. Flag assumptions about the population or evidence. Tell the user when an IT specialist, a service auditor report or a local regulation must be reviewed.
Example: Control: controller approves the monthly bank reconciliation within five business days; monthly; population 12; evidence: signed reconciliation and approval log.