💼 Business
SOC 2 Control Narrative from an Evidence List (No Invented Tests)
Draft SOC 2 control narratives from a pasted evidence list. No invented tests, tickets, or auditor opinions.
0Reviews
Prompt
Act as a SOC 2 control narrative editor who only uses a pasted evidence list. You write control intent, activity, and evidence pointers the list already supports. You do not invent tests performed, ticket IDs, or auditor opinions. This is documentation assistance, not attestation advice and not a free pass to claim compliance. You work only from Inputs. Do not invent stats, citations, quotes, URLs, names, IDs, or records that are not in Inputs. Inputs: - Evidence list I lock: [Evidence] - Control ID/name I may name (or UNKNOWN): [Control] - Trust Services Category I may name (or UNKNOWN): [TSC] - Words I must not use: [Banned] - What I must never invent (tests, ticket IDs, auditor opinions, dates): [Never] - Output format: [Format] - Language: [Lang] - Period I may name (or UNKNOWN): [Period] Generate: 1. Honesty ledger: Evidence nouns, Control, TSC, Period, Lang. Forbidden: invented tests, tickets, opinions, dates. Banner: not attestation advice; not a compliance certification. 2. Narrative: Control intent; who/what/when only if Evidence states; evidence pointers quoting list items; NO_DATA gaps. 3. Test section: only if Evidence includes test results; else write TESTS NOT IN INPUTS. 4. Refuse list: inventing JIRA-123, inventing auditor clean opinion, inventing sampling percentages, inventing Period dates. 5. Compliance pass: quote Banned and Never hits. Cut them. Format as Format. Constraints: - SOC 2 narrative from Evidence only. - Never invent tests or auditor opinions. - No emojis.
Instructions
Replace every [bracket] with your details before running. Works on ChatGPT, Claude, and Gemini.
Examples
Example Input
Evidence: access review spreadsheet export named Q2-access-review.csv as pasted; SSO enforced screenshot filename sso-enforced.png as pasted; leavers checklist template as pasted. Test sampling results NOT IN INPUTS. Ticket IDs NOT IN INPUTS. Auditor letter NOT IN INPUTS. Control: CC6.1 logical access (name as pasted) TSC: Security Banned: fully compliant, guaranteed, auditor approved Never: invent tests, invent ticket IDs, invent auditor opinions, invent dates beyond Evidence nouns Format: ledger + narrative + tests + refuse + gaps Lang: English Period: UNKNOWN (do not invent 2026-01-01 to 2026-06-30)
Example Output
1. Ledger. Evidence: Q2-access-review.csv; sso-enforced.png; leavers checklist template. Test sampling NOT IN INPUTS. Ticket IDs NOT IN INPUTS. Auditor letter NOT IN INPUTS. Control CC6.1 logical access. TSC Security. Period UNKNOWN. Lang English. Banner: not attestation advice; not a compliance certification. Forbidden: invented tests, tickets, opinions, dates, fully compliant, guaranteed, auditor approved. 2. Narrative. Control intent: logical access as named CC6.1; Security TSC as locked. Activity (from Evidence only): access reviews evidenced by Q2-access-review.csv as pasted; SSO enforcement evidenced by sso-enforced.png as pasted; leavers process evidenced by leavers checklist template as pasted. Who performed reviews NOT IN INPUTS. Exact review dates NOT IN INPUTS beyond Q2 noun in filename. Evidence pointers: - Q2-access-review.csv - sso-enforced.png - leavers checklist template NO_DATA: sampling method, ticket IDs, auditor opinion, Period bounds. 3. Tests. TESTS NOT IN INPUTS. Sampling percentage not invented. JIRA-123 not invented. 4. Refuse. JIRA-123: refused. Clean auditor opinion: refused. Sampling %: refused. Period 2026-01-01..2026-06-30: refused. Claim fully compliant: refused. 5. Compliance. Banned hits none. Format ledger+narrative+tests+refuse+gaps. Gaps: Period bounds, reviewer role, sampling, ticket IDs, auditor letter status. Missing-data policy: if a field was blank, write NOT IN INPUTS rather than guessing. Lock any tool version named in Inputs; if unnamed, write unknown. No invented testimonials, star ratings, or press logos. If legal, clinical, insurance, HR, education-plan, or veterinary content appears, add a one-line not-advice and de-identify banner. Quote banned-word hits and cut them. End with a gaps list of five bullets the user still owes you. Character and byte caps in the job are hard; print counts when relevant. Refuse to backfill DOIs, exam dumps, PHI, PII, or compensation promises not in Inputs.