Copilot for Risk — ONB Hands-On Exercises

Hands-on materials for the Microsoft 365 Copilot for Risk session (Old National Bank, Enterprise Risk Management). The session sets the foundations first — Copilot as a day-to-day assistant, prompting and iteration, where internal data must reside, how external/regulatory sources come in, AI limitations and hallucinations, and the rule that human judgment and review stay in charge — then applies them to the highest-value ERM starting points.

Primary tools: Microsoft 365 Copilot Chat (document + web grounding), Word, Excel, and Outlook.

Start here

• Pre-Work — Set up and upload your practice materials — complete before the session.

Exercises

1. Everyday Productivity — Outlook / Word / Excel
2. Document Analysis — SOC & TPRM — Copilot Chat (document grounding)
3. Governance & Gap Analysis — Copilot Chat / Word
4. Risk Data Analysis — Excel
5. Agents & Automation Opportunities — Copilot Chat / agents

Sample materials (assets/)

• SOC2-Report-Excerpt.md — synthetic SOC 2 Type II excerpt with controls, sections, pages, CUECs, and exceptions
• Internal-Control-Standards.md — ONB internal control standards to map SOC controls against
• Vendor-Data-Protection-Policy.md — synthetic internal policy for gap analysis
• Regulatory-Expectations-Excerpt.md — synthetic regulatory/framework expectations to compare against
• Risk-Register.xlsx — synthetic risk register + KRI workbook for data analysis
• Governance-Knowledge-Base.md + AI-COE-Review-Template.md — for the agents/automation exercise
• Practice-Inbox-Pack.md — four synthetic Risk email threads you email to yourself in pre-work

How to use

Each exercise is self-contained: objective, prerequisites, step-by-step prompts, a deliverable, and a verification checklist. All prompts are copy-paste ready. Work in Copilot Chat and the Office apps for the web with the sample materials in OneDrive.

Ground rules

Copilot accelerates the mechanics; the risk professional decides. Ground accuracy-critical review in the document — upload the file and prompt "use only the attached document." Copilot only sees what you give it — the open file, uploaded documents, OneDrive/SharePoint content you can access, and mail you can open; internal data must reside where Copilot can reach it. Hallucinations are the headline risk — verify every control ID, page reference, citation, mapping, and figure. Nothing files, sends, or concludes until a person does it — Copilot drafts; a risk professional verifies and owns the conclusion. Use only synthetic sample data inside ONB's Microsoft 365 tenant — never live vendor, customer, model, or confidential supervisory information.