Free AI Compliance Prompts: 12 Prompts for Ethics and Speak-Up

How to Use This Prompt Pack

Each prompt below names its job, the phase of the compliance cycle it serves, and the bracketed placeholders you replace before running it. Two disciplines make the pack work. The first is the context rule: describe roles, industries, and patterns, never names, clients, or identifying figures. A prompt that cannot run on an anonymized description is a prompt you should not be running. The second is the ownership rule: AI drafts, you decide, and every output that influences a real determination gets a named human signature. The model is the first reader, never the last word.

The twelve free compliance prompts follow the arc of real ethical work: test the decision before it is made, speak up and document when something is wrong, build the systems that prevent the next problem, and keep your own practice clean. If you want the underlying decision method first, the 4-Box Ethics Test is the framework the pack is built around.

Why Prompt Discipline Beats Policy Memoranda

The case for practicing decisions rather than reciting policies is a detection story. The ACFE's Report to the Nations, the largest recurring study of occupational fraud, finds that 43 percent of detected frauds surface through tips, with internal audit at 14 percent and management review at 13 percent. The external audit, the control organizations spend most on, catches 3 percent. The human channel is the primary control, which means the skills that feed it, recognizing patterns, voicing concerns, documenting reasoning, are where training effort pays.

Prompt libraries attack exactly that layer. A memorized policy cannot tell you whether this expense, this deadline, or this instruction is the beginning of a pattern; a structured prompt sequence can surface the pattern, stress the decision, and produce the documentation that makes the next step defensible. The bars below are the detection argument in one view.

Phase One: Test the Decision (Prompts 1-3)

This phase runs before anything is signed, shipped, or said. Its purpose is to convert a gut call into an examined one, and to produce the written trace that distinguishes a defensible decision from a lucky one.

Prompt 1: the 4-Box run

Prompt: "Act as a compliance advisor. I am considering whether to [DESCRIBE THE DECISION, ANONYMIZED]. Run the 4-Box Ethics Test: 1) Legal, laws, regulations, contractual obligations; 2) Company policy, internal rules and precedents; 3) Professional standards, industry norms and codes; 4) Personal values. For each box, list the key considerations, then rate green, yellow, or red with one line of justification. Finish by naming every conflict between boxes and the two questions a reviewer would ask me." The conflict list is the deliverable, a decision with no conflicts deserves a second look precisely because real gray areas rarely produce none.

Prompts 2-3: the gray-area stress test and the red-flag radar

Prompt 2, the stress test: "Here is a decision where the rules are silent: [DESCRIBE]. Give the three strongest arguments it is defensible, the three strongest arguments it is not, the stakeholder most likely to be harmed, and how the decision reads on the front page of a trade journal. End with the question I should answer before proceeding." The trade-journal line is doing real work, it is the newspaper test with a readership that understands your industry.

Prompt 3, the red-flag radar, built on the fraud triangle: "Act as a fraud-risk analyst. For this situation, [DESCRIBE THE PATTERN, ANONYMIZED], examine pressure (deadlines, targets, personal circumstances), opportunity (control gaps, oversight lapses), and rationalization (justifications circulating in the team). List every red flag by category, rate the overall risk low, medium, or high, and suggest two preventive measures for the top flag." Patterns, not incidents, is the instruction that matters: most compliance trouble announces itself as a slow drift long before it is an event.

Phase Two: Speak Up and Document (Prompts 4-6)

The ACFE tip-line number has a corollary: the people who report problems are making a difficult communication under stress, usually without a script. These three prompts write the script in advance, the ninety-second opener, the memo that makes the case, and the escalation email that does not overreach.

Prompt 4, the speak-up script: "I need to raise a compliance concern with [ROLE: my manager, compliance, audit committee]. Draft a 90-second opening: the observation in neutral facts, the specific standard in question, what I have and have not verified, and the ask, investigate, advise, or take it from here. Neutral tone, no accusations, no adjectives. Then give me two likely responses and how to answer each." Rehearsing this in advance follows the same logic as AI rehearsal for hard conversations: the first live attempt should not be the first attempt. Prompt 5, the decision memo: "Structure a one-page memo on [ISSUE]: executive summary with recommendation; background in facts only; analysis across the four boxes; risks and consequences; recommended actions with owners and dates. Objective, evidence-based, no hedging. Flag any place my summary lacks evidence." Prompt 6, the escalation email: "Draft a concise escalation: what happened, when, who is affected, the standard implicated, what has been done, what I recommend, and what I need from you by when. Facts only. Two paragraphs maximum."

Phase Three: Build the System (Prompts 7-9)

Individual decisions compound into systems. This phase turns prompt practice into infrastructure: policies that answer real situations, third-party relationships that survive diligence, and training scenarios that rehearse judgment instead of vocabulary.

Prompt 7, the policy gap checker: "Compare this situation, [DESCRIBE], against this policy section: [PASTE]. Does the policy answer it? If yes, cite the line. If no, list exactly what it fails to address and draft the two-sentence clarification that would close the gap, marked as proposed wording." Run quarterly, this prompt is how a policy library stays alive; for the fuller drafting loop, our guide to writing an SOP with AI covers the record-transcribe-structure method. Prompt 8, the third-party diligence set: "Generate a due-diligence question set for engaging [COUNTERPARTY TYPE] in [JURISDICTION]: ownership and control questions, red-flag indicators to screen for, documentation to require, and the three walk-away conditions. Structured for a first meeting, not a data room." Prompt 9, the scenario generator: "Create a branching compliance scenario for [ROLE] on [RISK]: a realistic setup, three decision points, consequences for each branch, and the debrief question that reveals the reasoning. Anonymize industry specifics. End with the two-sentence lesson the scenario teaches." Every generated scenario is a draft until a human confirms its legal and cultural accuracy, review capacity is the constraint, not generation.

Phase Four: Keep It Clean (Prompts 10-12)

The final phase is maintenance, of privacy, of awareness, and of your own judgment. Prompt 10, the anonymization checker: "Review this text, [PASTE], for identifying details: names, clients, projects, dates, and figures that could identify a party. List each risk and suggest a generic replacement that preserves the analytical value, then output the safe version." Make it the last prompt before any paste when you are unsure. Prompt 11, the regulatory briefing: "Summarize this regulation or update, [PASTE OR DESCRIBE], for a non-specialist executive: what changes, who is affected, by when, the three actions that follow, and what remains uncertain. Flag anything requiring legal confirmation." Prompt 12, the quarterly ethics audit: "Act as my ethics sounding board. Here are the decisions I ran through the 4-Box test this quarter, anonymized: [PASTE]. Diagnose patterns: which lens do I consistently underweight, which cases should have been escalated rather than decided alone, and what single practice should change next quarter?" Managers who run prompt 12 honestly usually find one lens chronically underweighted, professional standards is the common culprit.

The Evidence Base: What Ethics Infrastructure Controls

The economics behind this pack are the cost asymmetry the research keeps reproducing. The Ponemon Institute's cost-of-compliance research put average annual non-compliance costs at $14.8 million per organization studied, against $5.5 million for staying compliant, roughly a factor of three before reputational damage. IBM's Cost of a Data Breach report adds the per-incident anchor: $4.9 million for an average 2024 breach. The discipline bar on the chart below is what structured judgment, documentation, and early escalation buy.

None of the prompts replaces the compliance function; they feed it. Better decisions reach escalation earlier, documentation arrives structured instead of reconstructed, and the human detection channel, the one that catches nearly half of everything, gets practiced instead of improvised. That is the mechanism by which an evening of prompt practice shows up in the numbers.

The Privacy Firewall

Compliance material is exactly the material that must never leak, and prompts make it portable. The firewall is three rules, written to be pasted into a team's shared document. First, anonymize by default: roles, industries, and patterns, never names, clients, identifying figures, or anything touching personal data, health, or ongoing investigations. Second, tier the tooling: consumer chat tiers for frameworks and hypotheticals; approved business tiers with training opt-outs for anything case-like; nothing, at any tier, for what counsel would call privileged. Third, outputs are drafts: a prompt output about a real matter is a working document until a named human owns it.

• Describe the pattern, not the party, roles and industries carry the analytical weight
• Business tier with training opt-out for case-like material; consumer tier for frameworks only
• If output influences a determination, a named human signs it, the model is never the signature

Common Failure Modes and Their Fixes

Four failures account for most disappointment with AI-assisted compliance work, and each has a one-line correction.

• Generic analysis, the context line was too thin; add industry, role, jurisdiction, and the constraint you actually face
• False confidence, demand the conflict list and the reviewer questions; a run with no conflicts is a run to repeat
• Escalation avoidance, if the output says escalate, escalating is the task, not a suggestion
• Prompt sprawl, twelve prompts is a library, not a checklist; prompts 1, 3, and 4 carry most of the value in month one

What Good Looks Like in 30, 60, and 90 Days

Thirty days: run prompts 1, 3, and 4 on your next real gray-area decision, and file the one-page memo. The observable outcome is that your reasoning survives review, anyone reading the memo can follow how you got there. Sixty days: add the policy gap checker on a quarterly cycle, run the scenario generator once for your team's top risk, and rehearse the speak-up script before you need it. Ninety days: run the quarterly ethics audit against your filed memos, note which lens you underweight, and change one practice, deliberately, in writing.

The free compliance course day one pairs with this timeline if you want the frameworks taught rather than prompted; it is free with any account and produces the same 4-Box discipline in a working session format.

The Complete Compliance System

These prompts are the working layer; the Compliance & Business Ethics Essentials program is the structure underneath it, the full decision frameworks, the scenario library, and the speak-up mechanics that turn good intentions into defensible practice. Day 1 is free with any account, and it hands you a framework and a worked case you can use the same afternoon.

Start with the three starter prompts, respect the firewall, and file the memos. Compliance capability is not a certificate on a wall; it is a documented habit of examining decisions before they harden, and a prompt library is the cheapest instrument that habit has ever had.

Frequently asked questions