How to build an AI-powered control self-assessment (CSA) program in Formaloo

A recurring self-assessment form that every department fills out each review period, rating itself against the same set of controls. Formaloo turns those ratings into a composite risk score behind the scenes, writes a plain-English risk narrative with AI, and automatically escalates anything that crosses your threshold to central risk. Every submission stays on file, so a Reports page can show how each department's risk score has trended over time using an AI-generated report.

This is the form every department fills out each period. Rather than adding fields one by one, describe the whole form to Formaloo's AI and let it build the structure for you.

1. Open Magic Create: From your Formaloo homepage, click Magic Create.

2. Describe the form: Paste the following prompt and click Create.

Build a control self-assessment form for a regulated team. Ask which department or team is self-assessing (dropdown: Retail banking, Commercial lending, Compliance, IT & security, Operations, Human resources), which review period this is for (dropdown: Q1 2026, Q2 2026, Q3 2026, Q4 2026), the submitter's name, and the submitter's work email. Then ask six single-choice questions rating compliance with access control management, data encryption and protection, change management, incident response readiness, third-party and vendor risk management, and segregation of duties, each with the options Fully compliant, Partially compliant, Non-compliant, and Not applicable. Add a long text question asking for evidence supporting the ratings above, and an optional file upload for supporting evidence. Add a hidden long text question for a remediation plan and target date. Add these as admin-only fields: a Review status dropdown (Not started, In review, Escalated, Closed), an Assignee field, an Internal notes long text field, and an AI risk narrative long text field.

3. Verify your fields: Your form should look like this. Magic Create will have generated most of it, so just verify each field and field ID matches exactly.

4. Swap in your real departments: The department options above are placeholders. Open that field and replace them with your organization's actual department or team list.

5. Save your form: Save your changes in the island bar at the top of the editor.

This is where the self-assessment stops being a plain form and starts being a scoring engine. Each rating feeds a hidden composite risk score, and once that score crosses your threshold, the submission auto-escalates.

1. Open Magic Logic: In the form settings panel on the right side of the editor, open Advanced logic, go to the Logic tab, and click Magic Logic in the top right corner.

2. Describe your rules: Paste the following prompt and click Generate Rules.

Hide the remediation plan question by default, and show it and make it required if any of the six control rating questions is answered Non-compliant. Create a hidden number variable called composite risk score, starting at 0. For each of the six control rating questions, add 0 points if the answer is Fully compliant, 1 point if Partially compliant, 3 points if Non-compliant, and 0 points if Not applicable, and add all six results together into composite risk score. If composite risk score reaches 5 or higher, set Review status to Escalated.

3. Review and approve: Approve, redo, or cancel each rule the AI previews. Once approved, make any manual adjustments if needed.

4. Save your logic: Click Save in the top right corner of the Logic panel.

Note: A Non-compliant answer on any one control is enough to trigger the remediation field, but it takes a mix of Partially compliant and Non-compliant answers across several controls (or two Non-compliant answers) to reach the escalation threshold of 5. Adjust the point values or threshold in the rule above to match how strict your organization wants escalation to be.

This is the AI layer that replaces someone manually summarizing a submission's risk profile. Formaloo's AI Smart Content reads each submission's ratings and evidence the moment it's submitted, then writes a short risk interpretation straight into the AI risk narrative field.

1. Open the ending page: In the form editor, go to the form's Ending page.

2. Add an AI Smart Content block: Add an AI Smart Content box to the ending page, and write a prompt telling it to read the six control ratings and the evidence summary, then write a two- to three-sentence plain-English risk interpretation explaining what's driving the composite risk score.

3. Save the output to a field: Turn on the setting to save the AI-generated output from this block, and point it at the AI risk narrative field you created in Part 1.

Three emails carry this workflow: a confirmation when a department submits, an escalation alert to central risk when the threshold is crossed, and a closing note once central risk has reviewed it.

1. Create the confirmation email: Click your profile icon, go to Apps and integrations, open Custom email templates, and click Add new template. Name it "Self-assessment received," set the subject to Your @department self-assessment for @review_period has been received, add an AI block, and paste this prompt:

Write a short, professional confirmation to @submitter_name confirming their control self-assessment for @department, period @review_period, was received. Mention that risk will review it and follow up only if needed. Do not reveal the calculated risk score. 3-4 sentences, formal compliance tone, not casual. Design: white background, single centered column max-width 560px, Inter or system-ui font, a thin top accent bar, muted footer in #999.

Save the template.

2. Create the escalation email: Add another template named "Escalation to central risk," subject Escalation: @department scored @composite_risk_score for @review_period, and paste this prompt:

Write a direct, factual alert to the central risk team: @department's @review_period self-assessment crossed the escalation threshold with a composite risk score of @composite_risk_score. Lead with the AI-generated risk narrative (@ai_risk_narrative) as the core explanation. Name the submitter (@submitter_name, @submitter_email) and prompt the reader to open the row and assign a reviewer. Under 120 words, compliance-report tone, no fluff. Design: white background, 560px column, Inter font, a red or orange "ESCALATED" status badge at top, the AI narrative rendered inside a bordered callout box, muted footer.

Save the template.

3. Create the reviewed email: Add a third template named "Self-assessment reviewed," subject Your @department self-assessment for @review_period has been reviewed, and paste this prompt:

Write a brief closing-the-loop note to @submitter_name: central risk finished reviewing their @review_period self-assessment for @department. If a remediation plan was submitted, acknowledge it was received. Appreciative, forward-looking tone, 3-4 sentences. Same design as the confirmation email.

Save the template.

Now wire each template to the moment it should fire.

4. Trigger the confirmation email: In Advanced logic, under On Submit, add a rule: when the form is submitted, send the "Self-assessment received" email to @submitter_email.

5. Trigger the escalation email: Under On Update, add a rule: when Review status equals Escalated, send the "Escalation to central risk" email to your central risk distribution address.

6. Trigger the reviewed email: Under On Update, add a rule: when Review status equals Closed, send the "Self-assessment reviewed" email to @submitter_email.

Every submission gets turned into a clean, printable record: the ratings, the composite score, the AI risk narrative, and any remediation plan, all in one document.

1. Open the PDF template builder: Click your profile icon, go to Apps and integrations, open Custom PDF template, and click Add new template.

2. Switch to HTML view: Switch the editor to the HTML view and paste the code below.

3. Name and save: Give the template a name like "CSA report" and click Save.

4. Attach it to the escalation email: Open the "Escalation to central risk" email template you built in Part 4, and attach the CSA report PDF template to it, so every escalation email arrives with the full record attached.

Since every submitter here is internal staff, not an external client, you don't need to activate a public-facing portal with sign-up. Instead, build a Project around your form and restrict each page to the right internal team.

1. Add the pages: In your project, add a Kanban board grouped by Review status ("All self-assessments"), a table filtered to Review status equals Escalated ("Escalated queue"), a table grouped by Department ("By department"), and a table filtered to Remediation plan is not empty ("Needs remediation").

2. Restrict access to central risk: On each of those pages, open the three-dot menu, click Access, and under workspace team members, select your central risk team.

3. Add the AI-powered trend report: Add a new page, add an AI Analyze block to it, and point it at your self-assessment form's full submission history. This is your AI Analyst: it reads every historical submission and writes a report, narrative plus charts, on how each department's composite risk score has moved period over period, replacing a manually built trend chart.

4. Share the link with control owners: Departments only need the form itself. Find and share your self-assessment form's public URL with each department so they can submit each period, no login required.

A single self-assessment form that every department fills out each review period, scoring itself against the same controls. Formaloo calculates a composite risk score behind the scenes, writes a plain-English risk narrative with AI the moment a submission comes in, and automatically escalates anything above your threshold, with a full PDF record attached. Central risk works from a Kanban board and a set of filtered views instead of a shared spreadsheet, and an AI-generated report shows how each department's risk score has trended over every period on file, without anyone charting it by hand.

A compliance manager at a mid-size bank told us her team used to spend two full days every quarter chasing department heads for self-assessment spreadsheets and manually flagging anything that looked risky. Now the escalations land in her inbox automatically, with an AI-written risk summary already attached.

Don't build this from scratch — we've already put it together for you.