02 · See the position · AI
AI Exposure Audit
Establish a clear view of AI use, exposure and priorities.
The AI Exposure Audit establishes what AI is in use across the organisation, including unapproved use, and assesses relevant governance considerations by system. It identifies gaps between existing controls and the exposure found, then produces prioritised actions and a board-ready summary. Legal and regulatory questions are identified for appropriate specialist review rather than decided within the audit.
The outcome
Within four weeks, your executive team and board receive an AI-use inventory, governance risk assessment and prioritised actions.
What happens
- Establish an inventory of AI systems and relevant use
- Classify systems and identify relevant governance considerations
- Assess the gap between existing governance controls and the exposure identified
- Prioritise actions and prepare the executive and board view
What you get
- Inventory of the AI in use across the organisation, including Shadow AI
- Risk classification per system and relevant governance considerations
- Governance gap analysis, with legal and regulatory questions identified for appropriate review
- Prioritised action plan
- Board-ready summary report with risk ratings and recommended next steps
Boundary. Questions requiring legal or specialist assessment are identified, not decided within the audit.
Next step. May follow the AI Governance Decision Brief. Typically leads to the AI Accountability Programme. Where supplier exposure is material, the Supplier AI Risk Audit may run first.