What an AI operations audit actually looks at.

The question has changed

A few years ago the open question for a small or mid-sized business was whether to use AI at all. That question has mostly answered itself. According to the Census Bureau’s Business Trends and Outlook Survey, as summarized by the Minneapolis Fed, about 20 percent of businesses reported using AI in the first months of 2026.

One caution about that number. In November 2025 the Census Bureau widened the survey question from AI used in producing goods or services to AI used in any business function. The jump from roughly 10 percent to 20 percent therefore reflects a broader question as much as faster adoption, and it should not be read as a doubling of use.

So most owners are past “should we” and into “where do we start, and how do we avoid the 80 percent.” That is what an audit is for.

Why projects fail, in RAND’s words and ours

RAND’s 2024 report, The Root Causes of Failure for Artificial Intelligence Projects and How They Can Succeed, interviewed 65 experienced data scientists and engineers and reached five root causes. Paraphrased: stakeholders misunderstand or miscommunicate the problem to be solved; the organization lacks the data needed; teams chase the newest technology instead of solving a real user problem; weak infrastructure for managing data and deploying models; and the technology is pointed at problems too difficult for AI.

Notice what is missing from that list. Picking the wrong model is not on it. The causes are about the problem, the data and the groundwork around the technology, which is why we start an engagement with questions rather than tools.

Lens 1: the problem

Before any tool comes up, we want one sentence that a person in the business would recognise: this task, done this often, costs this much, and here is how we will know it improved. Vague goals such as “use AI in sales” are how teams end up building something impressive that nobody asked for.

In practice we walk through a normal week with the people doing the work. Where do hours go? Which handoffs get dropped? Which tasks are repetitive and rule-bound, and which depend on judgment? The first group is where automation earns its keep. The second is where people should stay in charge.

Lens 2: the data

RAND’s data finding is about organizations lacking the data to train a model. Most small businesses are not training models, so we translate it into a practical form: is the information the AI needs written down, current and reachable? If pricing lives in one person’s head, customer history is split across an inbox and two spreadsheets, and nobody trusts the CRM, then an assistant has nothing reliable to work from, however good the model is.

The audit inventories where the relevant information lives, who maintains it, and what would have to be tidied before automation makes sense. Sometimes the most valuable recommendation is to fix the source of truth first.

Lens 3: ownership

Every system needs a named person who runs it after launch, understands what it does, and can turn it off. We also look at how tightly a design depends on one vendor or one model. A workflow that can swap its underlying model without a rebuild is easier to keep alive than one welded to a single product.

RAND also argues for investing early in the unglamorous groundwork of data governance and deployment, because it shortens later projects. For a small business that mostly means documentation, access control and a record of what is connected to what.

Lens 4: risk

For risk we borrow structure from the NIST AI Risk Management Framework. NIST released it as voluntary guidance in January 2023, built around four functions: govern, map, measure and manage. The framework itself says organizations may select the parts that fit their resources, and a ten-person company should not try to implement all of it.

The questions are still useful at any size. What is this system used for? What could it get wrong, and how badly? How will we notice? Who is accountable for the decision to keep it running? In practice that becomes a short written risk note, plus a rule we hold to in every build: a person approves the consequential actions, such as sending money, deleting records or messaging a customer for the first time.

What you get at the end

Lens	What we ask	What you get
Problem	Where do hours go, and what would “better” measure?	A ranked list of opportunities by effort and payoff
Data	Is the needed information written down and reachable?	A map of sources, and what to clean up first
Ownership	Who runs it, and how portable is the design?	An owner, a runbook and a vendor-risk note
Risk	What can go wrong, and who approves what?	A short risk note and clear human checkpoints

Two outputs matter more than the rest. The first is a “not yet” list: ideas that are too hard, too early or too thin on data, which RAND’s last root cause is the reason to name. The second is one pilot with a success measure agreed before anything is built, so that a working result beats a presentation.

Where to start

If you want a quick read before committing to anything, the free AI Opportunity Snapshot takes about two minutes and points at the likeliest starting places. If you are ready for the full treatment, the AI audit is described on our pricing page.