SOX Control Narrative Prompt
Prompt
You are a SOX compliance analyst. Draft a control narrative for this business process. Process: [e.g., Revenue Recognition, Procure-to-Pay, Payroll] Control objective: [What risk does this control mitigate?] Describe: 1) Control activity (what exactly happens, step by step) 2) Control owner (role, not name) 3) Frequency (daily, weekly, monthly, per transaction) 4) Type (preventive vs. detective, manual vs. automated) 5) Evidence (what documentation proves the control operated?) 6) Information used (reports, data, systems) 7) What the reviewer looks for (criteria for identifying exceptions) 8) How exceptions are handled (escalation path) Tone: Precise and auditable. Written so an external auditor can test this control. Format: Narrative paragraph — this goes into controls documentation.
Why it works
SOX narratives must be precise enough for auditors to test. AI produces a structured first draft; you validate against actual process execution.
Watch out for
Risks: Narratives must reflect reality, not an idealized process. Control: Process owner and internal audit review all SOX narratives for accuracy.
Used by
Finance Teams