{"id":"risk-ddq-summary-for-owner","audience":"compliance","category":"legal-compliance","track":"legal","technique":"audience","level":"beginner","title":"Summarize a vendor questionnaire for the procurement lead","free":false,"task":"Hana Ibarra, procurement lead, wants a quick read of a vendor questionnaire before a call. Write a prompt for four plain-text lines starting with these labels: Vendor:, Handles:, Gaps:, Ask next:. Under 90 words in total. Gaps lists only answers that are vague or pending, and the reply must not say whether the vendor is approved, safe or compliant.","materialLabel":"Your material (attached to your prompt automatically)","material":"VENDOR SECURITY QUESTIONNAIRE - Corvane Payroll Services\nQ1 What data will you process? Employee names, bank details and tax IDs for about 3,000 employees.\nQ2 Encryption at rest? Yes, AES-256.\nQ3 Independent security audit? In progress, report expected next quarter.\nQ4 Any breach in the past 3 years? No.\nQ5 Subprocessors? Available on request.\nQ6 Where is data hosted? EU and US data centres.\nQ7 How fast do you notify customers of an incident? Promptly.\nQ8 Business continuity plan tested? Yes, annually. Last test in March.\n\nReviewer remark: Corvane's sales contact says the audit will be \"fine\".","rules":[{"type":"plainText"},{"type":"maxWords","max":90}],"promptHints":[{"label":"Names the reader","patterns":["hana","procurement"]},{"label":"Gives labels","patterns":["vendor:","gaps:","ask next"]},{"label":"Defines gaps","patterns":["vague","pending"]},{"label":"No verdict","patterns":["approved","safe","compliant"]},{"label":"Plain text","patterns":["plain","no markdown","no bold"]}],"mistakes":[{"title":"Missing labels","why":"AI writes a paragraph or its own headings.","fix":"List the four labels in order and say \"exactly four lines\".","checks":["r0"]},{"title":"Gaps miss the vague answers","why":"AI treats 'promptly' and 'on request' as fine answers.","fix":"Say: \"Gaps lists only answers that are vague or pending.\"","checks":["r1"]},{"title":"Giving a verdict","why":"AI says the vendor looks secure or recommends approval.","fix":"Say: \"Do not say whether the vendor is approved, safe or compliant.\"","checks":["r2"]},{"title":"Getting markdown back","why":"AI adds bold, headings and bullets by default, which show up as stray symbols when pasted.","fix":"Say \"plain text, no bold, no headings, no asterisks\".","checks":["plainText"]},{"title":"Trusting the AI to count words","why":"AI is bad at counting and usually runs long, so a vague \"keep it short\" lands over the limit.","fix":"Cap each part instead of the total, for example \"each line under 15 words\".","checks":["maxWords"]}],"hint":"Give the four labels, what counts as a gap and what not to conclude.","mission":"Give the procurement lead a four-line read.","musts":["Four labeled lines","Gaps from vague answers","No approval verdict"],"rubricLabels":["There are four lines starting with Vendor:, Handles:, Gaps: and Ask next:, in that order, and Vendor: names Corvane Payroll Services","Gaps names the audit still in progress, the subprocessor list only on request, and the notification time given as \"promptly\" with no timeframe","The reply does not say the vendor is approved, safe, secure or compliant, and does not repeat the sales contact's view that the audit will be fine"]}