def format_access_denied(event_value):
    """
    Creates a filter format string for a Yes No variable.

    :return: A string that can be used in a LQL filter.
    """
    if event_value.lower().startswith('y'):
        return "ERROR_CODE IN ('AccessDenied', 'Client.UnauthorizedOperation')"

    return "ERROR_CODE IS NULL"