{"id":"sec-fin-vendor-bank-change-log-review","audience":"finance","category":"security","track":"security","technique":"constraints","title":"Find vendor bank changes that skipped the process","free":false,"task":"Review this month's vendor bank detail changes. Your process requires a call-back recorded to a number already on file and a second approver who is not the person who entered the change. List only the changes that break the process, numbered, as 'change ID - vendor - what's missing'. Plain text, under 70 words.","materialLabel":"Change log export (attached to your prompt automatically)","material":"Vendor master - bank detail changes, October 2026 (Northpeak AP)\n\nID   | Vendor               | Entered by | Approved by | Call-back recorded\nVC-31 | Alder Office Supply | M. Reyes   | J. Chen     | Yes - (555) 014-2000, number on file\nVC-32 | Brightline Freight  | J. Chen    | J. Chen     | Yes - number on file\nVC-33 | Corvid Cleaning     | M. Reyes   | S. Patel    | Yes - (555) 019-8812, number from the change request email\nVC-34 | Delta Print Co.     | S. Patel   | M. Reyes    | Yes - number on file\nVC-35 | Evergreen Catering  | M. Reyes   | S. Patel    | No\nVC-36 | Fable Logistics     | S. Patel   | J. Chen     | Yes - number on file\n\nNotes:\n- VC-32: J. Chen says the vendor is \"a long-time partner, low risk\".\n- VC-35: Evergreen's payment of $6,200 is scheduled for Nov 10.\n- All changes were requested by email.","rules":[{"type":"numberedItems","count":3},{"type":"plainText"},{"type":"maxWords","max":70}],"mistakes":[{"title":"Not giving the process","why":"The AI only catches the missing call-back and misses the self-approval.","fix":"Spell it out: \"Call-back to a number on file, and a second approver who didn't enter it.\"","checks":["r0","r1"]},{"title":"Trusting the 'yes'","why":"The AI sees 'Call-back recorded: Yes' and passes VC-33, even though the number came from the email.","fix":"Add: \"A call-back only counts if the number was already on file.\"","checks":["r1"]},{"title":"Reviewing every row","why":"The AI comments on all 6 changes.","fix":"Say: \"List only changes that break the process.\"","checks":["numberedItems","r2"]},{"title":"Trusting the AI to count words","why":"AI is bad at counting. Ask for \"under 70 words\" and it often lands well over.","fix":"Ask for less than the limit and cap each line: \"each line under 15 words, under 50 words total.\"","checks":["maxWords"]},{"title":"Letting markdown in","why":"AI adds bold and headings by default, and in the audit file they show up as stray symbols.","fix":"Add: \"Plain text only, no bold, no headings.\"","checks":["plainText"]}],"promptHints":[{"label":"Gives the process","patterns":["second approver","on file","call-?back","process"]},{"label":"Lists only exceptions","patterns":["only (the )?changes","break","exception","fail"]},{"label":"Shows the line shape","patterns":["change id","what'?s missing","vendor -"]},{"label":"Sets a word limit","patterns":["\\d+\\s*words","word (limit|count)"]},{"label":"Asks for plain text","patterns":["plain","no bold","no markdown","no formatting","no headings"]}],"hint":"A 'Yes' in a log doesn't mean the control worked. Give the AI both rules exactly, including where the call-back number must come from.","rubricLabels":["Lists exactly VC-32, VC-33 and VC-35, and not VC-31, VC-34 or VC-36","VC-32 is flagged for the same person entering and approving (despite the 'low risk' note), VC-33 for calling a number from the request email rather than one on file, VC-35 for no call-back","Each line follows 'change ID - vendor - what's missing'"]}