AI Readiness Audit: How to Know If Your Organization Is Actually Ready for AI
Read Time 20 mins | Written by: Eric Fouarge
Updated October 30, 2026
Ask a leadership team whether the company is ready for AI and most will say "mostly." The data is "pretty clean," someone "owns" AI, and the last pilot "went well." An AI readiness audit is how you find out whether those answers hold up once someone asks to see the evidence behind them.
This guide is for the CIO, COO or operating partner who needs a straight answer before the next round of AI spending. It is a self-check your own team can run, and repeat, rather than a one-time consulting exercise.
An AI readiness audit tests five claims leaders usually make about AI, and passes each one only when someone can show the evidence. We call them the Five Show-Me Tests. A claim nobody can show is a gap, however confident the room is.
How do you know if your organization is ready for AI?
Run an AI readiness audit: write down the claims your leaders make about AI, then ask to see the evidence behind each one. You are ready when you can show a named executive who owns an AI outcome, a real data extract for a live use case, a written description of the process AI would change, written rules for AI use that people actually follow, and the people who will run and fix it. Score each test Shown, Partly shown or Not shown, and close the gaps before you fund the next project.
What an AI Readiness Audit Is, and Which Readiness Tool You Need
An AI readiness audit checks whether the conditions for AI already exist in your organization, using evidence rather than opinion. It is short, repeatable and run mostly by your own people. That makes it different from the other readiness tools you will come across, each of which answers a different question:
| The question you are asking | The tool | Best for |
|---|---|---|
| Do the basics exist, and can we prove it? | AI readiness audit (this guide) | A recurring self-check before each planning cycle |
| How mature are we across the whole organization? | Seven-dimension readiness framework | A scored baseline and a 90-day plan |
| Should we fund this one project? | AI readiness checklist | The go or no-go decision on a specific project |
| Can our data support these use cases? | Data readiness assessment | A deep look at the data behind named use cases |
| Should someone independent do this for us? | AI readiness assessment service | An outside 20-point audit and a roadmap |
Start with the audit. It costs the least of the five, and its result tells you which of the others you need next.
The Five Show-Me Tests
Each test starts with something leaders commonly say and turns it into something you can ask to see. Use the table to run the audit in one sitting; the detail below explains what counts as evidence.
| Test | The claim | Ask to see | Warning sign |
|---|---|---|---|
| 1. The owner | "Someone owns AI." | A named executive, the outcome they own and a decision they have made | The owner is a committee, or "IT" |
| 2. The data | "Our data is in decent shape." | A real extract for one live use case, pulled during the audit | Only one person knows how to pull it |
| 3. The process | "We know where AI would help." | A current, written description of the workflow, exceptions included | The process lives in someone's head |
| 4. The rules | "People use AI responsibly." | Written rules on tools and data, and who reviews AI output | Nobody knows which AI tools staff already use |
| 5. The people | "We have the skills." | Named people who will run, maintain and fix it, with time set aside | Every name already has a full-time job |
Test 1: The owner — who answers for the outcome
AI work without an owner drifts. The audit should find one named executive per AI outcome, not per tool, with a measure they have agreed to and at least one decision they have already made: something funded, stopped or reprioritized. Ownership that has never produced a decision is a title, not ownership.
Evidence that passes: the name, the outcome in one sentence, the measure, and the last decision with its date. If the best answer is "the AI steering group," keep looking. Groups advise; people decide.
Test 2: The data — pulled, not described
Most organizations believe their data is in better shape than it is, usually because nobody has had to use it for something new. Pick one use case you are seriously considering and ask for an extract of the data it would need, pulled during the audit. Then ask the people who run that process to read it. They will spot the duplicates, the blank fields and the values that stopped meaning anything years ago.
Evidence that passes: the extract, who pulled it, how it was pulled (a path that could be repeated, not a one-off favor) and what the process owners found wrong with it. If this test fails, the fixes are covered in our guide to building the data foundation first. If it passes for one use case and you plan several, a full data readiness assessment is the deeper check.
Test 3: The process — written down, exceptions included
AI changes a process, so you need to know the process. Ask for a current description of the workflow you want AI to touch: the steps, the handoffs, the systems and, above all, the exceptions, which is where most of the real work hides. If the team cannot write it down, an AI system will not be able to follow it either. Often the first win is fixing or automating the process itself, before any AI is involved.
Evidence that passes: a description the people who do the work agree is accurate, updated within the current planning cycle, with the exceptions listed and an owner for each handoff.
Test 4: The rules — written, known and followed
Your people are already using AI tools, whether or not anyone approved them. The audit asks three things: which AI tools are in use today (ask the teams, not only IT), what written rules say about which data may go into them, and who checks AI output before it reaches a customer or a decision. The NIST AI Risk Management Framework is a useful free reference for what good rules should cover.
Evidence that passes: the list of tools you found, the written rules, and one real example of an AI output that was reviewed and corrected before it was used. Rules that nobody has read do not pass.
Test 5: The people — named, with time
Someone has to run the system day to day, someone has to maintain the integrations and data feeds, and someone has to notice when the output is wrong. The audit should name each role and confirm the person has time for it, not just the skill. Where a skill is missing, decide whether to hire, train or bring in specialists; our guide to staff augmentation for AI and data projects covers the roles that are hardest to fill.
Evidence that passes: names against roles, time agreed with each person's manager, and a decision for every gap. A list of people who are interested in AI is not a staffing plan.
The AI Readiness Checklist
The audit tells you whether the organization is ready. When it passes and a specific project comes up for funding, this is the next step: 25 tick-box checks across problem, data, workflow, economics and control, a box beside each check for the evidence you were actually shown, and a sign-off page for the owners who approve the spend.
How to Run an AI Readiness Audit in Six Steps
- Set the scope. Pick the business unit and the two or three AI use cases leadership is actually discussing. An audit of "the whole company" produces answers that are true of nothing in particular.
- Collect the claims. Ask each executive in scope to say, in one sentence per test, where the organization stands. Write the answers down before anyone looks for evidence, so nobody can quietly adjust them later.
- Ask to see. For each claim, request the evidence in the table above. Set a deadline and accept nothing secondhand: a description of a document is not the document.
- Score each test. Shown means the evidence exists and holds up. Partly shown means it exists but is incomplete or out of date. Not shown means there is no evidence, or the evidence contradicts the claim.
- Write the gap list. One line per gap: what is missing, who owns the fix and which use case it blocks. Share it with the same executives who made the claims.
- Set the next date. Re-run the audit before each planning cycle and after any big change: a new executive owner, a failed pilot, a major system replacement or an acquisition.
Give the audit to someone senior enough to ask executives for evidence and independent enough to write "Not shown." An internal audit lead, a PMO head or an outside facilitator all work. If you want a structured scoring session afterwards, our guide to running an AI readiness assessment in one workshop picks up where the audit stops.
How to Read Your AI Readiness Audit
Count only the tests marked Shown. Partly shown is a gap with a head start, not a pass.
| Tests shown | What it means | What to do next |
|---|---|---|
| All five | Ready for a project decision | Take your strongest use case through the AI readiness checklist before you fund it |
| Three or four | Ready in parts | Close the gaps that block your top use case first, then re-run the failed tests |
| Two or fewer | Not ready yet | Hold new AI spending and build the basics, starting with the owner and the data |
Fix the owner and the data first whatever your count. The other three tests depend on them: rules without an owner are not enforced, and processes and people cannot be planned around data nobody has looked at.
Signs You Are Not Ready for AI Yet, and the Test Each One Fails
You can often predict the audit result from the symptoms. If any of these sound familiar, start with the matching test:
- Teams export data by hand between systems. The data test, and often the process test.
- Customer records live in several CRMs or spreadsheets. The data test.
- Reports from different departments disagree. The data test: the same terms mean different things in different systems.
- Nobody can name the person accountable for AI results. The owner test.
- AI tools are spreading with no written rules. The rules test.
- Pilots end with a demo but no change in how work gets done. The process and owner tests.
- The same few people are on every AI project. The people test.
For practical fixes to the most common of these, see 5 signs your company isn't ready for AI.
Three Ways an AI Readiness Audit Goes Wrong
Grading claims instead of evidence
A confident "yes" from a senior leader is the most common way a test gets passed without evidence. Mark it Not shown until you have seen the evidence yourself. Confidence is not a document.
Running it once
Readiness decays. Owners change jobs, rules go stale and data drifts as systems change. An audit from last year describes a different organization, so put the next date in the calendar before you close this one.
Letting the budget holder grade it
The person who wants the AI budget approved has the strongest reason to see readiness everywhere. Give the audit to someone who is free to say "not yet," and let the budget holder respond to the findings.
When You Can Skip the Audit
- You ran a scored assessment this planning cycle and acted on it. Re-run the audit at the next cycle instead of repeating the work now.
- The decision is small and contained. A writing assistant for one team does not need all five tests; the rules test is usually enough.
- You already know you are not ready. Skip proving it and start the foundation work, beginning with an owner and the data.
For transparency: Ontrac sells AI readiness assessments and AI implementation services. The five tests above are the standard we would want any buyer to apply, to us or to anyone else they are considering.
Want a second pair of eyes on your evidence?
We work with mid-market and private-equity-backed companies on AI readiness. Bring your audit results, or just the claims, to a short call and we will tell you which tests you can already pass and what to fix first. If you would rather have it done for you, our AI readiness assessment covers the full picture and ends with a 90-day plan.
Book a call with usAI Readiness Audit: Frequently Asked Questions
What is an AI readiness audit?
It is an evidence-based check of whether your organization has the basics in place for AI: an accountable owner, usable data, documented processes, written rules for AI use and people with time to run it. Each area passes only when someone can show the evidence, not just describe it.
How is an AI readiness audit different from an AI readiness assessment?
An audit is a short, repeatable self-check that tests whether the basics exist. An assessment goes further: it scores maturity across several dimensions, compares you against a model and produces a roadmap. Many teams run the audit first, then use an assessment to plan the fixes.
How often should you run an AI readiness audit?
Before each planning or budget cycle, and again after any major change: a new executive owner, a failed pilot, a large system replacement or an acquisition. Readiness changes as people, rules and data change, so a single audit goes out of date.
Who should run an AI readiness audit?
Someone senior enough to ask executives for evidence and independent enough to mark a test Not shown. An internal audit lead, a PMO head or an outside facilitator all work. The person asking for the AI budget should not grade their own readiness.
What should you do if the audit shows you are not ready?
Fix the gaps in order, starting with the owner and the data, because the other tests depend on them. Give each gap an owner and a date, then re-run the audit. When all five tests pass, take your strongest use case through a project-level funding check such as the AI readiness checklist.
Keep Reading
→ The AI Readiness Checklist: 25 Checks Before You Fund an AI Project — the funding gate after the audit.
→ The Enterprise AI Readiness Assessment: A 2026 Framework — score maturity across seven dimensions.
→ Your Data Isn't AI-Ready: How to Build the Data Foundation First — what to do when the data test fails.
This article is general information about assessing AI readiness and is not legal advice. Whether a particular use of data is permitted depends on your own contracts and obligations; review those with appropriate advisors.
