What Is an AI Audit? What a Readiness Assessment Should Include

Two different jobs go by the name "AI audit." It is worth knowing which one you are buying.

The first is a readiness audit, also called an opportunity audit. It reviews how your business runs, before you build anything. It answers three questions. Where will AI pay? What has to change first? And what is not an AI problem at all? It reads your systems and talks to the people who do the work. It ends by naming the constraint. That is the one thing that most limits your growth. You get its monthly cost and a short plan of the systems worth building. Each one is scoped, priced and dated.

The second is a governance audit. Governance means the rules and checks that keep a system under control. This audit tests the AI you run now against a framework. That is a public set of standards. Can you show who owns each system and what data it uses? Can you show who approves its decisions, and how it is watched? Most businesses that ask for an AI audit mean the first kind. This guide covers both, mostly the first.

What is an AI audit, exactly?

Here are the two side by side.

"AI readiness assessment" most often means the first column. "AI audit" can mean either one, so ask.

What should an AI readiness assessment include?

Six parts. Skip one, and the plan will break on it later.

1. The constraint and the process. What is capping growth? Is it too little demand, or too little capacity to serve it? Where does work wait, and how many hours a week go to it? Some assessments start with "where can we use AI." They should start with "what is costing us the most." If not, they answer the wrong question well.
2. The data. Where it lives. Whether the fields everyone thinks are full really are. Who owns it. Whether you may use it the way the plan needs. Consent, contracts and privacy rules all count.
3. The systems. Which systems the work runs through. Whether each one has a way in for software. Who can grant access.
4. The people. Who runs the work today. Who will own the system once it exists. Who approves its decisions.
5. The risk. What the system would touch, such as health records, payments or personal data. It might touch a system of record, the main record your business trusts. And where a person must approve before anything that can't be undone.
6. The money. What the constraint costs each month. What each system on the list would cost to build and to run. How fast it pays back.

In 2024, RAND studied why AI projects fail. It spoke with 65 experienced data scientists and engineers. The most common root cause? Leaders who misunderstand the problem AI should solve, or explain it badly. The first part exists for just that reason.

Gartner predicts that over 40% of agentic AI projects will be canceled by the end of 2027. Agentic AI means agents, AI that takes steps on its own. Gartner names rising costs, unclear business value or weak risk controls. Parts five and six are where those three show up early. They show up on paper, while they are still cheap.

What should you get at the end?

Call it the Audit Stack. It is what you should hold when the audit is over, layer by layer.

1. The constraint, named, with evidence from your own systems. Not "insights." One thing, with the rows that prove it.
2. The number: what it costs each month, in revenue lost, hours burned or costs carried.
3. A ranked plan: three to five systems that remove the constraint, in order of payback. Each is scoped, priced and dated. Only systems that clear a stated payback bar belong on it. One such bar is three to four times what a system costs to build and run.
4. The no list: the ideas that didn't make it, and why. The answer might be a process fix, a price change, a hire, or no AI at all.
5. The gaps to close first: missing data, missing access, missing owners.
6. A report that stands on its own. Someone who wasn't in the room should be able to read it. They should be able to defend the spend to the people above them.

Here is what that looks like on paper, in a made-up case. The evidence puts the constraint at $41,500 a month. That is $498,000 a year. Four systems were weighed. Three clear the bar and make the plan, ranked, with a date on each. The fourth was the idea the owner walked in with. It is on the no list, with the math beside it.

That last line is the most useful one in the report. It is also the one a weak audit never writes. You can do the first two layers yourself. How to find AI use cases in your business shows how. How to calculate AI ROI covers the bar in layer three.

How does an AI audit work?

In three steps, whoever runs it.

Discovery. The auditor gets read-only access to the systems where the work happens. That means they can look but not change. Think of the CRM, where your customer and lead records live. Add the support desk, billing and the data. Then come short talks with the people who run the work. They know where it waits. An NDA comes first, if you want one. That is a contract that keeps what the auditor sees private.

Analysis. Work out the constraint in numbers, and price it. Then design the systems that would remove it, and rank them by payback. This is where most ideas get cut.

The readout. A working session with your leaders. You walk through the findings and the plan. You keep the report.

The share of your own time should be small. The auditor does the interviews and writes the report. Your job is access and a few hours of your attention.

How much does an AI audit cost?

It depends on scope. That means how many business units and systems it covers. It means how many people it talks to. It also turns on whether it touches data the law protects, like health records. Ours, the Diagnostic, runs two weeks for $5,000. It takes about two hours of the owner's time.

A better question than "how much" is "against what." An audit should cost a small share of the constraint it prices. It should cost much less than the wrong build it prevents. Say the constraint costs $41,500 a month. One month of it pays for a thorough review many times over.

Be careful with an assessment that costs nothing. It is paid for by the build that follows it. That tells you in advance what its plan will recommend.

How do you tell a real audit from a sales exercise?

Watch for these:

• Every idea you walked in with is approved.
• No one opened a system. The findings come from interviews alone.
• The output is a maturity score or a traffic-light chart, with no dollar figures. (A maturity score grades how "ready" you are.)
• Nothing in the plan is priced or dated.
• The plan calls for the auditor's own product, and only they could build it.
• There is no "don't build this" anywhere in the report.

And the marks of a real one? A number with the proof attached. A no list. And a plan another team could pick up and build from.

What to ask before you hire someone to run one

• What access do you need, and is it read-only?
• Who will you interview, and how much of my team's time will it take?
• What exactly will I hold at the end?
• Will it tell me if the answer isn't AI?
• Can another team build from the plan?
• How is each system on the plan priced and dated?
• Will you sign an NDA first?

What to have ready before it starts

Five things make the first week go faster:

1. Your own guess at the constraint, and what you think it costs each month. Write it down and date it. At the readout, set it next to theirs. The gap between your guess and the proof is a finding in itself. You can only see it if you wrote the guess down first.
2. The name of the person who can grant read-only access. That covers the CRM, support desk, billing and data.
3. Three to five people who run the work, for short interviews.
4. Your answer on the NDA, and whose form you will use.
5. Who from leadership will sit in the readout, and who holds the budget.

When not to commission an AI audit

You already know the constraint, its cost and the fix. If the fix is small and plain to see, build it.

The job is a landing page or a basic CRM setup. A good freelancer does either well, without an audit.

Nothing is capping growth that you can name. An audit prices a constraint. With nothing to price, there is nothing to find.

You need the other kind. Say a board, an auditor or a big customer asks how you control your AI. Then you need a governance audit, below.

What about auditing the AI you already run?

That is a governance audit. It has a public yardstick. NIST is a U.S. agency that sets standards. It publishes the AI Risk Management Framework, or AI RMF. Version 1.0 came out on January 26, 2023. It is meant for voluntary use. It sorts the work into four functions: Govern, Map, Measure and Manage. NIST added a Generative AI Profile (NIST-AI-600-1) on July 26, 2024.

In practice, a governance audit asks you to show proof:

• A list of every AI system and use, each with a named owner.
• A risk level for each one.
• Where each system's data comes from, and where every value it pulled out came from.
• Traces of model calls and decisions, kept where an auditor can read them.
• Records of who approved what, where a person is in the loop.
• Monitoring that shows the system still does what it did at launch.
• The vendor contracts. That includes a business associate agreement where health data is involved. It is the contract a vendor signs to protect patient data.

Most of that is far cheaper to build in than to piece together later. How to write an AI governance policy covers the board's side. HIPAA compliant AI covers what health data adds.