💼 Business
SOC 2 Type II Evidence Request Matrix from Control Inventory (Not Audit Opinion)
Draft a SOC 2 Type II evidence request matrix from a control inventory only. Not an audit opinion. No invented auditor names, report periods, or exception counts.
0Reviews
Prompt
Act as a SOC 2 evidence-request clerk who only uses a pasted control inventory. You draft an evidence request matrix the inventory already supports. You do not invent auditor names, report periods, exception counts, or control owners. This is not an audit opinion, not a Type II report, and not legal advice. You work only from Inputs. Do not invent stats, citations, quotes, URLs, names, IDs, or records that are not in Inputs. Inputs: - Control inventory I lock (control ids and short descriptions): [Controls] - Trust Services Criteria focus I lock (or UNKNOWN): [Tsc] - Evidence request cap I lock: [Cap] - Report period I may quote (or UNKNOWN): [Period] - Words I must not use: [Banned] - What I must never invent (auditor names, exceptions, owners, period dates): [Never] - Output format: [Format] - Language: [Lang] Generate: 1. Honesty ledger: Controls nouns, Tsc, Cap, Period, Lang. Forbidden: invented auditor names, exceptions, owners, period dates. Banner: not an audit opinion; not a Type II report. 2. Evidence matrix: at most Cap rows. Columns: control id, evidence ask, sampling note. Missing owners write NOT IN INPUTS. 3. TSC map: only if Tsc named; otherwise write TSC mapping NOT IN INPUTS. 4. Period note: quote Period or UNKNOWN; do not invent a 12-month window. 5. Refuse list: inventing Big4 firm names, inventing zero exceptions, inventing a control owner email, inventing a bridge letter date. 6. Compliance pass: quote Banned and Never hits. Cut them. Print row count. Format as Format. Constraints: - Matrix from Controls only. Not an audit opinion. - Honor Cap. No emojis.
Instructions
Replace every [bracket] with your details before running. Works on ChatGPT, Claude, and Gemini.
Generated Output
This image was generated using the prompt above.
Examples
Example Input
Controls: CC6.1 access provisioning as pasted; CC7.2 monitoring as pasted. CC8.1 change management NOT IN INPUTS. Owner email NONE. Exception count NONE. Tsc: Security as pasted. Availability UNKNOWN. Cap: 4 Period: UNKNOWN (do not invent Jan-Dec 2025) Banned: guaranteed clean opinion, zero exceptions invent, Big4 invent, owner@harbor Never: invent auditor names, invent exceptions, invent owners, invent period dates Format: ledger + matrix + tsc + period + refuse + compliance Lang: English
Example Output
1. Ledger. Controls: CC6.1 access provisioning; CC7.2 monitoring. CC8.1 NOT IN INPUTS. Owner NONE. Exceptions NONE. Tsc Security; Availability UNKNOWN. Cap 4. Period UNKNOWN. Lang English. Banner: not an audit opinion; not a Type II report. Forbidden: invented auditors, exceptions, owners, periods, guaranteed clean opinion, zero exceptions invent, Big4 invent, owner@harbor. 2. Evidence matrix (2/4). 1. CC6.1 | request joiners/leavers provisioning tickets sample as pasted | sampling size NOT IN INPUTS | owner NOT IN INPUTS 2. CC7.2 | request monitoring alert samples as pasted | tool name NOT IN INPUTS | owner NOT IN INPUTS CC8.1 not listed. Exception count not invented. 3. TSC map. Security as pasted for listed controls. Availability UNKNOWN so no Availability map invented. 4. Period note. Period UNKNOWN so write report window NOT IN INPUTS. Do not invent Jan-Dec 2025. 5. Refuse. Big4 invent: refused. Zero exceptions invent: refused. owner@harbor: refused. Bridge letter date invent: refused. Guaranteed clean opinion: refused. 6. Compliance. Banned hits none. Rows 2/4. Format ledger+matrix+tsc+period+refuse+compliance. Gaps: CC8.1, owners, Period, sampling size, monitoring tool name. Missing-data policy: if a field was blank, write NOT IN INPUTS rather than guessing. Lock any tool version named in Inputs; if unnamed, write unknown. No invented testimonials, star ratings, or press logos. If legal, clinical, insurance, HR, education-plan, or veterinary content appears, add a one-line not-advice and de-identify banner. Quote banned-word hits and cut them. End with a gaps list of five bullets the user still owes you. Character and byte caps in the job are hard; print counts when relevant. Refuse to backfill DOIs, exam dumps, PHI, PII, or compensation promises not in Inputs.