# AI prompt library

> Ready-to-copy prompts for Fibo and MCP-connected assistants covering setup, evidence, policies, risk, vendors and audits.

Source: https://docs.csquaregrc.com/getting-started/ai-prompts


Copy any prompt below and paste it into Fibo in the app, or into Claude, Cursor or another assistant connected through the [cSquare MCP server](/mcp/connect). Replace anything in `<angle brackets>`.

**Tips for good results**

- Name the program: "my SOC 2 Type II 2026 program" beats "my program".
- Ask for a format: a table, a checklist, an email draft.
- Ask Fibo to explain before acting when the change is large. See [Ask, Do and Build](/concepts/ask-do-build).

## Setup

```text
Review my organization profile and tell me which frameworks apply to us, in priority order, with one sentence on why for each.
```

```text
Which single connector would cover the most controls in my current program? Rank the top three.
```

```text
Suggest an owner role for each unassigned control in my <program name> program, grouped by department.
```

## Controls and evidence

```text
List controls in <program name> with stale or missing evidence, sorted by how much they affect the readiness score.
```

```text
Draft an implementation narrative for control <control ID> using our existing policies and evidence. Keep it under 150 words and in auditor-friendly language.
```

```text
Which of my controls in <framework A> also satisfy requirements in <framework B>? Show the mapping as a table.
```

## Policies

```text
Draft an <policy name> policy for a <industry> company of <headcount> people that satisfies <framework> requirements. Include purpose, scope, roles, policy statements and review cadence.
```

```text
Compare my approved policies with my program's controls and list controls with no supporting policy.
```

## Risk

```text
Suggest ten risks for a <industry> company handling <data types>, each with likelihood, impact, an owner role and a linked control.
```

```text
Which of my risks have a residual score above our appetite, and what treatment would reduce each the most?
```

## Vendors

```text
Draft a security questionnaire for <vendor> scaled to their access: they process <data types> and connect to <systems>.
```

```text
Summarize the SOC 2 report I uploaded for <vendor>: scope, exceptions, complementary user entity controls we must implement.
```

## Audit

```text
Prepare my <program name> program for auditor access: list stale evidence, missing narratives and unjustified not-applicable decisions.
```

```text
Write an executive readiness update: score, trend, top five gaps with owners and dates, and what is needed from leadership.
```