What an AI audit should give you (and what to refuse to pay for)

Two different things share the name "AI audit", and mixing them up costs people money. One is a formal governance exercise, assessed against a published standard such as ISO/IEC 42001, the first international standard for managing an AI system responsibly: it covers how an organisation sources data, trains and evaluates models, and monitors AI systems once they're live. It matters mostly to businesses that build or sell AI products themselves. The other is what most consultancies mean when they sell "an AI audit" to an ordinary operating business: a paid look at where automation would pay inside your operation. This is about the second kind, the one most owners of a business turning over a few million pounds are actually being pitched.

What should an AI audit deliverable contain?

Strip away the branding and a genuine audit produces four things, in this order.

• A process map. How work actually moves through the business, traced from real examples, not the org-chart version. If nobody followed an actual order, invoice or enquiry through your systems, they haven't audited anything.
• A priced list of where time and money leak. Each opportunity should carry a number: hours a week, cost a year, and where relevant an error cost. "This process is inefficient" is an opinion. "This process costs £9,000 a year in re-keying" is an audit finding.
• Opportunities ranked by return. Not by what's technically interesting, by what pays back fastest against the effort to build it. A good audit tells you which ideas fail the test and should be left alone.
• A costed recommendation you own. The document, the numbers and the plan belong to you at the end, whether or not you hire the same firm to build anything. If the audit only makes sense alongside a build contract from the same supplier, it wasn't independent.

How long it takes depends on the size of the operation being looked at; there's no honest fixed length for this, and any firm quoting a set number of weeks before seeing your business is guessing. What should be fixed up front is the fee and the deliverable.

What should you refuse to pay for in an AI audit?

• A report with no numbers. If every finding is an adjective ("significant opportunity", "streamlined workflow") rather than a figure with a unit, you've bought marketing copy.
• An audit that only recommends one vendor's product. A genuine diagnostic can conclude the answer is off-the-shelf software, a competitor's tool, or nothing at all. If the findings always point at the same product the auditor happens to sell, the diagnosis was decided before it started.
• Open-ended workshops with no fixed output. A day of "AI strategy discovery" that produces a slide deck and no priced list isn't an audit, whatever it's called on the invoice.
• A quote before anyone has looked at your operation. Real scoping requires seeing the business first. A price given over email before any conversation about your processes is a guess dressed up as a fee.

What does a real AI audit finding look like?

Two write-ups of the same problem show the difference. Vague: "Your finance team spends considerable time on manual data entry, which AI could streamline." That sentence survives contact with nothing; it doesn't say who, how often, or what it's worth fixing. Specific: "Two people spend roughly three hours a week re-keying supplier invoices from email into the accounting system, at a fully loaded cost of around £30 an hour; that's about £9,300 a year, before the cost of the mismatches it causes." The second version tells you exactly what you'd be paying to fix and roughly what fixing it is worth, which is the only basis on which "yes, build it" or "no, leave it" is a decision rather than a guess. If a report you're handed reads like the first version anywhere in it, ask for the numbers behind that line before you pay the invoice.

What should you ask before paying for an AI audit?

• "What will I own at the end, if I never hire you again?"
• "Will every finding have a number attached to it?"
• "Could the recommendation be 'don't build anything'?"
• "What's the fee, fixed, before you start?"

An honest answer to all four is the difference between paying for a diagnosis and paying for a pitch deck with your company name on the cover. M22 has written up the fuller framework for running this kind of trace yourself in how to run an AI audit on your own business, and the going rates for a properly scoped one in AI consultancy cost in the UK. For the short, direct version of what the term means, see what is an AI audit? If you'd rather have someone run the trace for you, that's what the audit is, and the same rules above apply to us.

How does M22 help with this?

M22 Consultancy's own AI Audit is built to pass every test in this article: a process map from real work, a priced list of what leaks, opportunities ranked by return, and a costed build plan the client keeps whether or not M22 builds anything afterwards. There is no fixed length, because M22 sizes the audit to the business rather than to a set number of weeks, and the fee is fixed and agreed before day one. The AI Audit starts at £1,500. Book a thirty-minute call, or see how UK AI audit prices compare.