AI assurance
Is the AI you use governed, secure, private and doing what you bought it for?
We come in from the outside and look at every place AI touches your business: the tools staff use, the systems you have built or bought, the data that flows into them and the answers that come out. Then we tell you, in plain English, what is under control and what is not.
Who needs AI assurance
- Boards and executives who need to know AI use is governed, not just encouraged.
- Organisations whose staff already use AI tools, approved or not.
- Teams that have built or bought an AI system and want to know it does what was promised.
- Anyone facing a client, regulator or insurer who asks how AI is controlled.
What we check
Inventory of AI use
Which AI tools and features are in use, by whom and for what, including the ones nobody approved.
Data flows and privacy
What information goes into each tool, where it is stored and processed, and whether that fits your privacy obligations.
Access and secrets
Who can use each system, how API keys and connectors are stored, and what an AI agent is allowed to reach.
Governance and policy
Whether there is an AI policy, whether staff know it, and who is accountable when something goes wrong.
Vendor terms
What your AI suppliers may do with your data: training, retention, location and subprocessors.
Output quality and efficacy
We test each in-scope system against cases with known answers. Does it do what you bought it for, and how often is it wrong?
Staff practice
How people actually use AI day to day, and whether they check what it produces before they rely on it.
Incident readiness
What happens when AI gets something wrong or data leaks: who notices, who decides and who tells whom.
How it works
Scope call
We agree which tools, systems and teams are in scope, and fix the fee before we start.
Look and ask
Read-only access to settings and policy documents, plus short conversations with the people who use and run the tools.
Test
We run each in-scope AI system against prepared cases with known answers and record what it gets right and wrong.
Review and report
We read every finding, rank it by risk and write a plain-English report that says what to fix first.
What you get
- A register of the AI in use across your organisation.
- Findings ranked by risk, each with the evidence behind it.
- Test results for each in-scope AI system: what it got right and what it got wrong.
- A short, practical fix list, and a draft AI policy if you need one.
- A walkthrough call with both of us.
Talk to us about an audit
A short call to scope it. A fixed fee before we start. Big Four experience, without the junior team or the Big Four fee, in days not months.