AI prompt engineering for risk managers: A practical field guide with @RISK Agent

A vague prompt returns a confident answer you cannot defend. A well-built prompt returns one you can take into the boardroom and trace, line by line—and the difference is never the model. It is the brief.

Most risk managers meeting AI for the first time treat it like a search box. Type a question, read the reply, move on. That works for trivia. It fails for quantitative risk analysis, where every question carries assumptions, constraints, and a specific output the analyst will be held accountable for. @RISK Agent puts the intelligence right inside the workbook—but embedding it is only half the job. The other half is learning to ask it the right way. This article is about that second half.

There is a temptation to treat prompting as a clerical step: the thing you do quickly before the real work begins. That is backwards. The prompt is the analysis brief. It encodes what you want examined, what you already know, what the model must not assume, and what a usable answer looks like. Get the brief right and the model behaves like a competent junior analyst. Get it wrong and it behaves like a confident one with no supervision.

Consider one ordinary request.

“What distribution should I use for drilling duration?” returns an answer—probably a PERT or a triangular, with a sentence of justification. It is not wrong. It is just not anchored to your problem.

 Now compare:

 “You are a cost engineer for offshore drilling. Duration on comparable wells has ranged 18–34 days, clustering near 24. Propose a distribution for @RISK, justify the shape against the skew this kind of operation typically shows, and tell me what would make you revise it.”

The second prompt does not retrieve a default. It puts the model to work on your well, with your data, against your judgment—and it tells you what would change its mind. That is the shift this guide asks you to make: from asking questions to writing briefs.

The five building blocks of a risk-analysis prompt

Every strong prompt for quantitative risk work contains the same five components. Leave one out and the answer drifts.

• A role. Give the model a perspective. “You are a senior project risk analyst specialized in EPC contracts in the [location] renewables sector” focuses its knowledge far more sharply than “you are a helpful assistant.” The role is not decoration—it narrows the universe of plausible answers before the model writes a word.
• A step-by-step task. State precisely what you want done, in the correct order, in as much detail as you can give, with an example of the output where one helps. Ambiguity here is the single largest source of unusable answers. You can upload documentation such as industry standards, sample data, specific information relevant to the project or constraints.
• Boundaries. Define the scope and the limits—what the model may use, what it must not invent, what it should leave untouched. “Work only with the attached register; do not introduce outside risk values without saying so and citing a verifiable source” is the kind of fence that keeps an answer auditable. You need to indicate specifically that @RISK use the @RISK Agent MCPconnector available in Claude for Excel.
• An output definition. Specify the shape of the deliverables—a table, a ranked shortlist, one paragraph of commentary per item—and how you will judge it. The model cannot produce a defensible format if you have not described one. Indicate that you want to separate sections: input parameter section, calculations, and output results. You may be specific requesting that the choice of distributions are reasoned, grounded in existing formats, and amply documented.
• A request for a summary and clarifying questions. End by asking the model to summarize its reasoning, explain the assumptions, and ask before proceeding if anything is missing. That one line converts a black box into a partner who checks before guessing. For example, ask the model to propose alternative distributions or defend modelling decisions.

A practical note on sequence: write the role and the boundaries first, the task and the output second. Analysts who start with the task tend to forget the fences—and the fences are what make the output safe to use.

Putting it to work: The five things @RISK Agent does

@RISK Agent is built around five capabilities, and each rewards a different kind of prompt. The sections below walk through all five with a worked example you can adapt directly. The running scenario is deliberately ordinary—a capital-project risk register and the simulation built on it—because the technique matters most on everyday work, not the showpiece.

1. Model review and AI suggestions

The most expensive mistakes in Monte Carlo modelling are the silent ones: a correlation left out, a distribution truncated at the wrong bound, a triangular left in for a fixed input, a units mismatch buried three columns deep. They do not announce themselves. They simply shift the answer. @RISK Agent can review the model before you run it—but only if you tell it what “review” means.

A weak prompt—“Check my model for errors”—will find some, miss others, and leave you unsure which. A strong prompt names the checks, the order, and the form of each finding:

Notice what the structure gets you. The ordered task means nothing is skipped. The output definition—cell, problem, consequence, fix—makes every finding actionable. And the closing boundary stops the model inventing a correlation it cannot actually see. This is the prompt that catches the independent-variables error that would otherwise survive all the way to the tornado chart.

2. Natural-language Q&A

Once a model is built, the analyst’s questions come faster than any menu can serve them. What is driving the downside? Which input would I most want better data on? If I halve the variance on labor cost, what happens to P10?

@RISK Agent answers these in plain language, grounded in the actual model through the MCP layer. The skill is asking questions answerable from the data rather than from the model’s general knowledge.

The trap is subtle. Ask “Is this project risky?” and you get an essay on sector risk drawn from training data—fluent, plausible, disconnected from your numbers. Ask instead:

The phrase “using only this model’s simulation results” does the heavy lifting: it forces the answer back onto your data and away from generic commentary. The instruction to name the figures used gives you a traceable answer rather than an opinion. That traceability is the whole point—an answer you cannot trace is an answer you cannot defend to a credit committee or a regulator.

3. Simulation interpretation

This is the capability that addresses Monte Carlo’s oldest problem: it has always struggled to tell a story. A simulation produces a distribution, a set of percentiles, a tornado chart with eight regression coefficients—and the people who must decide often cannot read any of it.

The result is the familiar waste of a hundred-page analysis compressed into one P50 number for the board paper. The analyst’s job has always included translation. @RISK Agent accelerates it, provided the prompt names the audience.

The same results need different stories for different rooms. So specify the room:

The audience definition changes everything about the answer. The boundary “do not recommend a decision” matters more than it looks: it keeps the analyst, not the AI, as the author of the recommendation. The model interprets; the human decides. That line is not a stylistic preference. It is where professional accountability lives.

4. Iterative model refinement

Good models are not built; they are revised. The value of an embedded AI is that the cost of a revision cycle collapses—test an assumption, reread the result, adjust, rerun. What used to come back at the next meeting now comes back in minutes. But iteration only compounds if each prompt builds on the last rather than starting over. Treat the @RISK Agent as a collaborator with memory of the thread, and feed it the result of the previous change:

This is conversational, not transactional, and that is deliberate. “Suggest the single next assumption most worth testing” turns the model into a guide through the revision space rather than a calculator you re-query from scratch each time. One change, one consequence, one recommended next step. That rhythm is how a model gets genuinely better instead of merely different.

5. Executive report generation

The last mile of risk work is the report, and it is where hours quietly disappear. @RISK Agent can pull clear, decision-ready language straight from the results—but “write me a report” is an invitation to generic filler. Tell it the structure, the length, and the source:

The [INSERT] instruction is a small trick worth keeping: it tells you exactly where the model lacks data, instead of letting it paper over the gap with a plausible-sounding figure. The word limit forces economy. And “use only figures present in the output” is, once again, the line that ties the report to the model rather than to the model’s imagination.

The caveat that applies to all five

Every prompt in this guide ends, in spirit, the same way: verify. An LLM can and does produce confident, well-formatted, entirely incorrect statements—including about @RISK’s own capabilities. In a documented case during a live session, a model insisted @RISK does not support a distribution that it does, in fact, support. The output looked authoritative. It was wrong.

This is not a reason to distrust the tool. It is the reason to keep the analyst in the loop on every cycle. The prompt gets you a fast, well-shaped draft. Your expertise—and the @RISK simulation engine itself—is what confirms it. AI for speed, the engine for certainty, the analyst for judgment. Treat any AI output as a knowledgeable colleague’s first draft, never the final word. A few standing rules belong beside every prompt:

• Check your organization's AI policy before putting any model data through an LLM.
• Anonymize sensitive inputs—assume anything you send may be stored.
• Verify every cited source the model offers; if it cannot cite, treat the claim as unconfirmed.
• Watch for confident wrongness about tool capabilities specifically—it is the most common failure mode.

The AI prompt workflow for risk managers in five steps

If you take five habits from this guide on AI prompts for risk managers, take these.

1. Brief, do not ask. Build every prompt from the five blocks—role, task, boundaries, output, summary. A question retrieves a default; a brief commissions an analysis.
2. Do not propose a working solution to the model in the prompt because it may be tempted to agree, this is called the syncophathy problem. Ask the model to evaluate pros and cons and alternatives and to explain why one may be a better choice than others. Do not advance or hint  your preferred choice if you have one.
3. Ground every answer in the model. Use phrases like “using only these simulation results” and “name the figures you used.” An answer grounded in your data is an answer you can trace; an answer you can trace is an answer you can defend.
4. Verify, then iterate. Treat each output as a first draft, confirm it against the engine and your judgment, then feed the result back for the next cycle. The speed is the AI’s contribution. The correctness is yours.
5. Always ensure that the information used to build responses is grounded in the @RISK AI Agent. You may also request that Claude explicitly confirm that the @RISK Agent has been used in compiling its outputs.

The five capabilities change what an analyst can do in an afternoon. The five building blocks change whether the output is worth defending. Master the prompt, and @RISK Agent stops being a faster way to get an answer—and becomes a faster way to get an answer you can stand behind.

Brief with structure. Ground in the model. Verify with @RISK.

The next article in the series moves from technique to terrain—the first of three industry studies, beginning with energy and utilities, where the distributions get harder and the stakes get higher.

Ready to remove the bottlenecks in your risk workflow? Learn more about @RISK Agent today or buy @RISK to get started.