Ask C1Risk works best when treated like a dedicated GRC analyst with access to review authorized C1Risk records. Providing clear context and a specific goal yields faster, more accurate, and actionable results.
1. The Golden Rule
A strong Ask C1Risk prompt is built on three core elements:
- Specific: Clearly names exact target entities, scopes, or Record IDs.
- Context-Rich: Points to specific fields, relationships, subtabs, or evidence.
- Outcome-Oriented: Specifies the required output format and structure.
2. The Recommended Prompt Formula
To get consistent results, structure your prompts using this standard format:
"For [Entity] [Record ID] - [Record Name], analyze [Specific Data or Relationships]. Focus on [GRC Objective] and return [Desired Format], including [Gaps, Owners, Due Dates, or Recommendations]."
Formula Example:
"For Internal Control ICI-000836, review linked policies, evidence, and test results. Identify verified gaps and overdue actions. Return a prioritized table with Gap, Evidence, Owner, Due Date, and Recommended Action."
3. Key Best Practices
1. Always Include the Record ID
Record IDs help Ask C1Risk instantly pinpoint the target record in your environment.
Prompt Quality | Prompt Example |
|---|---|
Weak | "Check this evidence." |
Better | "For Evidence EVI-000071, review the current document request status and linked controls. Identify missing or overdue information." |
Flexible | "Summarize Document Request DR1-006415 or DRI-006415." |
2. Specify What to Review
Direct Ask C1Risk to the precise fields, tabs, or relationships that matter to your review:
- "Review linked policies and test results."
- "Check evidence owner, due date, and status."
- "Review open findings and risk mitigations."
- "Analyze the last three months of assessment responses."
- "Compare overdue mitigations."
3. Define the Desired Output
Specify the format that best fits your immediate task:
- Executive summary
- Prioritized action list
- Comparison table
- Gap analysis
- Audit observation
- Evidence request list
- Draft reviewer note / Draft email
- Record ID and status list
4. Core Capabilities & Search Strategies
Global Keyword Search
When searching across your entire C1Risk instance, define your scope, criteria, and limits:
- Targeted Scope: "Search Internal Controls, Policies, and Evidence for MFA. Return only active records."
- Time-Filtered: "Search globally for vendor risk modified in the last 90 days. Group results by vendor type and return the top 20 matches."
- Exact Matching: "Search all C1Risk records for the exact phrase MFA. Return IDs and names only."
- Two-Step Strategy: "Search Findings and Mitigations for overdue remediation. First return a compact match list, then analyze only the records I select."
Refer to https://c1risk.freshdesk.com/support/solutions/articles/73000673788-keyword-search-prompt-examplesfor global keyword search prompt examples
Deep GRC Analysis (Facts vs. Recommendations)
For complex evaluations, explicitly instruct Ask C1Risk to separate verified facts from recommendations. Ask the assistant to break its analysis down into:
- Verified Facts
- Records and Evidence Reviewed
- Control, Compliance, or Process Gaps
- Risk and Business Impact
- Data Limitations and Assumptions
- Prioritized Recommended Actions (including owner, priority, due date, and supporting Record IDs)
Example: "For Risk RSK-000118, explain inherent versus residual risk, review linked findings, identify overdue actions, and separate verified facts from recommendations."
Refer to https://c1risk.freshdesk.com/support/solutions/articles/73000673787-deep-grc-analysis-prompt-examples for prompt examples
Customized Reporting Based on User Requests
For customized reports, clearly define the report scope, filters, columns, relationships, grouping, sorting, and record limits. Ask C1Risk to structure the report into:
- Report Scope
- Applied Filters
- Selected Columns
- Grouped Results
- Key Findings
- Data Gaps or Limitations
- Recommended Next Steps
Example: "Create a report of active Internal Controls with failed tests or missing evidence. Show Control ID, Control Name, Primary Contact, test result, evidence status, finding priority, and remediation due date. Group by owner and sort by priority."
Refer to https://c1risk.freshdesk.com/support/solutions/articles/73000673786-ask-c1risk-custom-report-prompt-examples for custom report prompt examples
5. Workflow Examples by Record Type
Record Type | Effective Prompt Example |
|---|---|
Internal Control | "For Control ICI-000836, review linked policies, evidence, and test results. Identify evidence gaps and recommended next actions." |
Finding | "For Finding FID-000091, summarize the verified root cause, risk impact, owner, due date, and outstanding remediation actions." |
Risk Register | "For Risk RSK-000118, explain inherent and residual risk, linked controls, overdue mitigations, and the next risk treatment decision." |
Document Request | "For Document Request DRI-006415, summarize status, due date, primary contact, submitted response, linked evidence, and overdue follow-up actions." |
Vendor | "For Vendor AID-000723, explain risk score drivers, open findings, overdue evidence, assessment status, and next review actions." |
Audit | "For Audit AUD-000045, summarize evidence completion, open issues, current blockers, owners, and upcoming deadlines." |
6. Iterative Prompting & System Capabilities
Use Follow-Up Questions (Iterative Prompting)
To refine your answers efficiently, start broad and narrow down step-by-step:
- "Find records containing access review."
- "Show only active Internal Controls and Policies."
- "Summarize the three records with overdue evidence."
- "Compare the gaps and prioritize the next actions."
What to Avoid
- Vague Queries: Avoid prompts like "What is wrong?", "Help me with risk.", "Summarize everything.", "Check this.", or "Find all problems."
- Over-Broad Data Requests: Avoid asking for every field, comment, attachment, and historical log item unless strictly required for your analysis.
System Capabilities & Limitations
- Read-Only Assistant: Ask C1Risk operates strictly as a read-only assistant. It can search, summarize, compare, analyze, and draft recommendations, but it cannot create, update, delete, deactivate, or link C1Risk records.
Was this article helpful?
That’s Great!
Thank you for your feedback
Sorry! We couldn't be helpful
Thank you for your feedback
Feedback sent
We appreciate your effort and will try to fix the article