The session slide by slide, from Scott Grow, CRCM, at the Utah Bankers Association Fall Compliance Conference, October 20, 2026.
Executive summary
Generative AI is rapidly becoming a daily staple in compliance workflows. Professionals who master effective prompting will significantly elevate their value and drive higher-impact work alongside these tools. System reliability is maximized when these tools are given specific prompt instructions: when source material is supplied, the AI can work with specific data rather than recalling it from memory, the evaluation standard already exists in writing, and a human professional can directly verify the results.
A prompt is the written instruction a person supplies to a generative system, and seven components dictate the quality of its output. Supplying source material ranks first; giving the AI a persona, which many published guides prioritize, ranks last. Naming source material is not the same as supplying it, and the system’s answers will look complete and confident even when it read only a fraction of the document. A reviewer who cannot independently restate the content produced by the AI should not approve it.
Slide 2: How are Compliance teams using AI?
This session concerns generative AI, not the machine learning models used in credit underwriting, transaction monitoring or fraud detection, which remain subject to existing model risk management frameworks. To govern AI use, focus on the primary point of human intervention: the prompt. It is the single element of the AI lifecycle that an institution controls completely.
Field research with compliance leaders at banks, credit unions, fintechs and audit firms shows adoption has concentrated in a small number of recurring, high-volume tasks, consistently across asset sizes and charters. The four complaints practitioners report concern scope, proportionality and applied context. Your success with AI depends on how well you write prompts, meaning instructions.
Slide 3: Reliability follows one pattern
Every reliable category shares one distinction: the system is performing an operation on material rather than supplying independent knowledge. “Restructure the attached policy into a three bullet executive summary” is operational prompting, and reliable. “State what Regulation Z requires for this lending scenario” is knowledge prompting, and introduces immediate risk.
In the 60 percent case, four to five full source documents were supplied at once, a reusable prompt specified the format and order of priority, and the compliance officer read and verified the output. The institution licensed a standard general-purpose assistant. The success was driven by prompting, not by a specialized product. If a task satisfies all three conditions, it is fit for use. If it fails even one, restructure it before assigning it.
Slide 4: Nine limits, stated precisely
These nine limitations are structural rather than temporary. They are properties of how these systems work rather than defects awaiting a fix, so a subsequent software release will not eliminate them. Inability to calibrate to significance accounts for more professional disappointment than any other: determining whether an issue rises to the level of board reporting requires human contextual judgment.
Counting is the one limit with a workaround. Enterprise assistants can write and run a short program against the material supplied, but they will still fail silently if the extraction step misses items before passing them to the script. Because these limits are poorly understood, teams fall into predictable traps: treating AI as a database or a spreadsheet, accepting citations because they look well structured, and delegating final decisions to the tool.
Slide 5: Why smart people still get burned
Instructional failures live in the prompt and are fixed by rewriting it. Behavioral failures live in how the user works with the tool, and better prompt text will not fix them. Many failures in both classes happen because professionals mistake a prompt for a search query instead of a work order. A query names a subject; a work order states the task, identifies the source data and defines the form the finished output must take.
The AI also concedes under pushback whether or not your correction was accurate, so “I corrected it and it accepted my change” is weak evidence in both directions. Catching an error inside your own specialty does not make you better at catching one outside it. When an examiner requests a rubber-stamped document, the institution holds an official record certifying that a person signed off on unverified machine logic.
Slide 6: Weak prompts are incomplete, not wrong
When a prompt produces unusable output, it is rarely because an instruction was wrong. It is almost always because the prompt omitted a mandatory element. That distinction sets the troubleshooting approach: an omission is corrected by supplying the missing variable, while an incorrect instruction must be diagnosed first.
Missing success criteria is the omission made almost universally and recognized least often. Without a stated standard, the system defaults to what is statistically typical, which is why outputs arrive polished yet generic. The silent failure is the most dangerous. The output will give no indication that a file was truncated, a document skipped or a connection dropped, so force the system to state exactly what it could not find or read.
Slide 7: Complete text, impossible operation
This category is often more dangerous than an incomplete prompt, because the result arrives fully formed, polished, and stripped of any sign that the operation was unsuitable. These seven request types fail regardless of how well the prompt is drafted.
The wording difference can be small and the reliability difference massive. “Explain why this practice complies” manufactures that explanation; “Assess whether this practice complies against the attached criteria” produces an assessment. Negative-only prompting fails too: prohibitions remove recognizable flaws but leave the output hollow without positive direction. And a question larger than its source will always be answered in full, blending your data with training memory. Scope the question to the document, not the subject.
Slide 8: Seven components, ranked by what moves quality
A complete prompt specifies what a written operating procedure specifies: who receives the work, what material governs, what the finished product contains, what falls outside the scope, and how the result gets checked. This ranking inverts most generalized internet advice. Source material is the single largest determinant of quality, costs nothing, and is omitted more often than anything else.
A casual chat persona does little, but the platform’s background system instructions are a different matter. A standing domain frame changes how the system resolves ambiguous terms, so words like validation, audit and material are read in their banking sense. The completeness test: a prompt is complete when a competent colleague with no prior context could execute it without asking a single follow-up question.
Slide 9: Naming a source is not supplying one
From a compliance perspective, the critical metric is the ability to verify the AI’s response against the source. A fragment is a small portion of a document, and when the system ingests only a fragment, the output will not show the difference. This hits hardest on negative findings.
Capability is not action. A system able to search the internet may not have searched it, and a system handed a document may have read a fragment of it. Neither is disclosed. The fifteen-second test exposes it: if the quote exists word for word in your document, the file was read. If the system paraphrases, or the quote cannot be found, it was not. For official work product, paste the raw text. The distinction is a matter of evidentiary control, not convenience.
Slide 10: Define both halves
Gap analysis is the single most common review task in a compliance department. The ineffective prompt will produce output that is fluent and useless: nothing says what a finished answer contains, so the system supplies a readable list of observations with no citations and no way to tell a real gap from a paraphrase. It also names the regulation rather than supplying it.
Using only the Regulation E excerpt and the deposit account agreement pasted below, list each Regulation E requirement the agreement does not address.
A complete result cites the section of each requirement and states what the agreement would need to provide. An incomplete result restates the regulation, describes the agreement in general terms, or identifies a gap without citing where the requirement appears.
Write for a compliance committee that has read neither document.
Return a table: requirement, section, what the agreement says today, what it would need to add.
Ignore anything in either document outside Regulation E. Do not state a legal conclusion about whether the agreement complies. If the agreement is silent on a point, say the information is missing from the source rather than supplying it from general knowledge.
Cite every assertion to a location in the pasted text, mark anything that did not come from it, flag anything ambiguous, list anything you could not locate, and ask any questions before you begin.
The second paragraph is the quality standard, and it is the only part that changes when the task changes. Describing the deficient result is the half most users omit. It prevents text that obeys the letter of your prompt while remaining unusable in practice.
Slide 11: Three guardrails, appended by default
The temptation is to ask whether the pricing exception process complies. That asks for a legal conclusion and sets no scope. The system will answer, because it answers everything, and the answer will read as an opinion the institution did not authorize anyone to give.
Ignore any policy material outside pricing exceptions and do not use it to infer context. Do not state a legal conclusion or an opinion on whether the process complies. If the policy does not address a point, state that it is missing from the source rather than supplying it from your general training knowledge.
That paragraph carries all three guardrails: drift, liability and hallucination. The third converts a silent failure into a visible, auditable gap. The liability guardrail turns the prompt into a defensible one. The question was never whether the process complies. It was what the policy actually requires, which a person then uses to measure the process. Defining what counts as a control also closes the undefined-terms gap from Slide 6.
Slide 12: The five sentences
Summarizing is reliable work, so the ineffective prompt asks for nothing the technology cannot do. It still produces an unusable board document, because nothing requires the summary to be traceable. A director cannot tell which sentences came from the examiners and which came from the model, and neither can you.
Cite every assertion to a specific location in the material supplied; mark clearly anything that did not originate from that material; flag anything uncertain or ambiguous rather than smoothing over it; at the end, list anything that could not be located or accessed; and do you have any questions before you begin?
These five sentences close every prompt intended to produce compliance work product, and they never change. Sentence two does the heaviest lifting because it guards against failures you did not anticipate. Requiring citations changes what the machine writes in the first place, forcing it to unpack its reasoning instead of compressing it.
Slide 13: Two failures, two repairs
Much unusable AI output is not factually incorrect. It is either incomprehensible to the person who must sign off, or fluent and hollow. When output is packed with jargon, professionals often approve it anyway rather than admit they did not understand it. Reject the opacity and ask for a rewrite. The greater risk is familiar words with different meanings: validation, audit and material mean one thing in banking and another in technology.
Hollow output creates zero discomfort for the reader, which is why it slips past review. To block it, append: “Follow every general statement with the exact reason it is accurate and specify what the reader must do differently.” Material that cannot be explained to a regulatory examiner was not reviewed. It was merely forwarded.
Slide 14: Working over a long session
The system does not tire. Given identical isolated material, it produces the same quality at any hour. A vital instruction issued at the outset simply carries less weight after two hours of accumulated conversation. Nothing was deleted; it matters less to the algorithm than it did. When a session fills, the platform may discard early exchanges, condense them into a summary, or halt.
An automatic summary works like meeting minutes. It keeps the assignment and the decisions, and drops the exact wordings, the rationale behind a correction and the original constraints. Nothing alerts you. A deliberate restart beats an automatic summary in every respect except convenience: ask the AI to summarize what was decided and what remains open, copy it out, and start fresh.
Slide 15: A saved prompt is a procedure
A prompt that produces reliable output, documented and stored where colleagues can reach it, becomes a standard operating procedure. That moves the department from individual skill to predictable institutional results. Standing rules on audience, vocabulary, layout and exclusions belong in the platform’s custom or system instruction settings, where they apply to every session. On an enterprise tier, ask IT what configuration is available.
Templates require no system access, run no code and introduce no data governance liabilities, which makes them a low-friction starting point for an AI strategy. But saved prompts go stale. Regulations and conventions change, so reusable prompts belong in whatever review loop already keeps your procedures current.
Slide 16: One assignment, every quarter
The regulatory developments summary for the compliance committee is the single most common use case in the industry, and it recurs every quarter, which is exactly why it belongs in a procedure rather than a fresh prompt each time. The procedure is what you start the session with, and the session is what teaches the procedure its next revision.
Whatever you had to explain mid-session is the thing the procedure did not say. If you found yourself clarifying what counts as a product the institution actively offers, that clarification belongs in the saved prompt rather than in your memory of this quarter. The compliance officer who used this method eliminated roughly 60 percent of the time spent building board summaries. The gain did not come from the model. It came from a prompt written once, saved as a procedure, and reused every quarter.
Slide 17: Prompting is the first rung
Everything in this session runs on a general-purpose assistant that everyone already has. That is the honest starting point, not the end of the road. Prompting makes one person reliable. It does not make the institution reliable. Consistency is free: writing the prompt down and reusing it costs nothing and is the first thing an examiner can actually test.
Each rung raises what you can rely on, and each raises what governance has to cover. Rungs three and four are a buying decision and a governance decision rather than a prompting technique. Anyone who saved a procedure from the previous example is already on the second rung, which means the next step is not a purchase. It is a habit.
Slide 18: How to operationalize AI through effective prompting
When an assignment seems outside AI’s capabilities, it usually contains a sub-task the system can perform well. “Determine how many adverse action notices in a quarterly sample failed to include each required disclosure element” fails as written, because it asks the system to count and to judge compliance. Split it, and nothing is sacrificed: the counting moves to a tool that counts, and the extraction stays with the AI.
Expect the first draft to be incomplete. Extraction and transformation improve instantly; risk calibration and judgment will stall, because those limits are structural. For any regular task your team assigns to AI, ask what the person performing it needs to know before they start. The answer is the prompt worth writing, because it is the tribal knowledge that is hardest to pass along to a new colleague.
The full speaker script, with every table and worked example, is in the PDF above.
