AI audit
Three audits that mirror what you already do for AML: what AI is actually in use, whether the outputs are right and evidenced, and whether the control environment works. Each gives you findings with ratings, owners and dates — and an independence statement you can file.
You cannot govern what you have not found, and you cannot evidence what you have not tested
Most firms have a policy, a register with five rows, and no idea that the real number is closer to twenty. The use audit finds the truth; the output audit tests whether the work is actually right and whether the file shows it was checked; the annual audit keeps the whole thing true as the firm changes.
- Undeclared tools are the norm, not the exception
- Accuracy and documentation are separate problems with separate fixes
- Independence matters here for the same reason it matters in AML
Stated in advance, delivered as described.
AI use audit
Discovery across declared and undeclared tools, data-flow assessment per tool, risk tiering with a specific action each, and a register formatted for tender questionnaires.
AI output quality audit
A sample of AI-assisted work products tested for correctness and verification, plus a review of file notes and supervision trails. Failure modes reported by task type.
Annual governance audit
Control testing against your own AI policy and ISO/IEC 42001 ambitions: register, DPIAs, oversight logs, sample matters, findings with ratings and a remediation plan.
Board summary
One page per audit: exposure, what we tested, what we found, what it will take to close — with an independence statement attached.
Register refresh
Your AI register updated and re-tiered, so the next tender questionnaire is a copy-and-paste rather than a panic.
Remediation tracking
Owners and dates, and an optional follow-up check three months later to confirm the fixes landed.
Four steps, no surprises.
Scope
A 30-minute call to choose the right audit, or the combination. Use audit first when nobody knows the inventory; output audit first when AI is already in production work.
Evidence gathering
Interviews, existing policies and registers, work-product samples. We recommend amnesty for undeclared tools, and we mean it — findings are reported by pattern and tool, not by name.
Testing
Documentation review, data-flow verification, accuracy testing on sampled outputs, and control testing against your own policy.
Findings and remediation
Findings with ratings, a plan with owners and dates, and a board page. We can present it to the board or the compliance committee if that helps.
Fixed numbers. The invoice matches the proposal.
| Engagement | Cost | Turnaround | What it covers | |
|---|---|---|---|---|
| AI use audit (shadow AI) | $3,000 – $4,000fixed · 2 weeks | ~2 weeks |
Find out what is actually being used — including the free tiers and browser extensions nobody declared — and what each one does to client confidentiality.
|
Contact us → Estimated range $3,000 – $4,000 · how quotes work |
| AI output quality audit | $2,300 – $3,000fixed · 2 weeks | ~2 weeks |
A sample of AI-assisted work products reviewed against the standard you would defend to a client or a court: correctness, verification, and whether the file shows what was checked.
|
Contact us → Estimated range $2,300 – $3,000 · how quotes work |
| Annual AI governance audit | $4,500 – $6,000annual · fixed | 3 weeks |
The independent check on your AI control environment, mirroring what you already do for AML — so 'we review it annually' is something you can evidence.
|
Contact us → Estimated range $4,500 – $6,000 · how quotes work |
Payment. 50% on booking, 50% on delivery unless the option says otherwise. Card payment through Stripe, or invoice with bank transfer. Card details never touch our servers. Larger deployments are billed to milestones agreed in writing before work starts.
- Firms that have never inventoried AI use
- Firms filling in an enterprise client's AI questionnaire
- Firms whose supervision model assumes humans catch everything
- Firms wanting an annual AI assurance cycle to mirror their AML one