{"id":"risk-ddq-contradiction-memo","audience":"compliance","category":"legal-compliance","track":"legal","technique":"verification","level":"advanced","title":"Sort vendor due-diligence answers into stated, contradicted, missing","free":false,"task":"Compare a vendor's questionnaire with the reviewer's notes on its attachments. Write a prompt for plain text with four labeled sections in this order: Stated:, Contradicted:, Missing:, then a last line starting \"Next step for the risk owner:\". Under 200 words. Contradicted means the attachments disagree with the questionnaire. Do not approve or reject the vendor.","materialLabel":"Your material (attached to your prompt automatically)","material":"VENDOR: Northgate Analytics\n\nQUESTIONNAIRE ANSWERS\n- Certification: our SecureSeal certificate is current.\n- Hosting: all customer data stays in US data centres.\n- Penetration testing: performed annually by an independent firm.\n- Encryption: AES-256 at rest and in transit.\n- Incident contact: 24x7 security desk.\n- Subprocessors: list attached.\n- Insurance: cyber cover in place, certificate attached.\n\nREVIEWER NOTES ON ATTACHMENTS (Jonas Weber)\n- SecureSeal certificate in the pack expired on 30 June.\n- Draft contract schedule lists a support team in Singapore with read access to customer records.\n- Latest penetration test summary is dated two years ago.\n- No subprocessor list was attached. No insurance certificate was attached.\n- Encryption and 24x7 desk: nothing in the attachments either way.","rules":[{"type":"plainText"},{"type":"maxWords","max":200}],"promptHints":[{"label":"Names the sections","patterns":["stated:","contradicted:","missing:"]},{"label":"Defines contradicted","patterns":["disagree","contradict"]},{"label":"Sets final line","patterns":["next step for the risk owner","last line"]},{"label":"No decision","patterns":["approve","reject"]},{"label":"Caps words","patterns":["under \\d+","\\d+\\s*words"]}],"mistakes":[{"title":"Sections merged","why":"AI blends stated and contradicted items into one list.","fix":"List the three section labels in order and define each.","checks":["r0"]},{"title":"Contradictions without the facts","why":"AI says 'certificate issue' without the date or the clause.","fix":"Say: \"One line per contradiction: the answer, then the attachment fact with dates.\"","checks":["r1"]},{"title":"Approving or rejecting","why":"AI ends with a recommendation to proceed or decline.","fix":"Say: \"Last line proposes one clarification request; do not approve or reject.\"","checks":["r2"]},{"title":"Getting markdown back","why":"AI adds bold, headings and bullets by default, which show up as stray symbols when pasted.","fix":"Say \"plain text, no bold, no headings, no asterisks\".","checks":["plainText"]},{"title":"Trusting the AI to count words","why":"AI is bad at counting and usually runs long, so a vague \"keep it short\" lands over the limit.","fix":"Cap each part instead of the total, for example \"each line under 15 words\".","checks":["maxWords"]}],"hint":"Define each section and what the final line may and may not do.","mission":"Sort vendor answers into stated, contradicted and missing.","musts":["Three sections plus next step","Contradictions with dates","No approve or reject"],"rubricLabels":["There are sections labeled Stated:, Contradicted:, Missing: in that order, and the reply ends with a line starting \"Next step for the risk owner:\"","Contradicted lists three items: certificate expired 30 June versus \"current\", Singapore support access versus US-only, and a two-year-old test versus annual","Missing names the subprocessor list and the insurance certificate, and the last line proposes asking the vendor to clarify without approving or rejecting the vendor"]}