AI Risk Audit
An independent review of how your organisation uses AI, from shadow AI and data exposure to governance, identity and vendor risk. You get a clear picture and a prioritised plan.
The questions boards are asking
Which AI tools are our people using? What data are they putting into them? Could Copilot surface the salary file to the whole company? Who approved this agent, and who is watching it?
An AI Risk Audit answers those questions with evidence, then gives you a practical plan to close the gaps without stopping the business from using AI.
What we review
- AI inventory and shadow AI: sanctioned tools, browser extensions, embedded AI features and the agents your makers have built.
- Data readiness and oversharing: SharePoint, OneDrive and Teams permissions, sensitivity labels and data loss prevention. These are the controls that decide what Copilot can see.
- Identity and access: who can build, publish and use AI agents, and with what permissions.
- Security foundations: the baseline controls AI depends on, assessed against the ASD Essential Eight.
- Governance and policy: acceptable use, approvals, human oversight, logging and incident response for AI.
- Vendor and model risk: where data goes, how it is retained and what the contracts actually say.
- Privacy: handling of personal information in line with the Australian Privacy Principles.
Frameworks we align to
Findings map to recognised frameworks so they stand up to scrutiny: the NIST AI Risk Management Framework, ISO/IEC 42001 (AI management systems), the ASD Essential Eight and the OWASP Top 10 for LLM Applications. This is an advisory audit, not a certification, but it puts you in a strong position if you pursue one.
How it works
- Kick-off: goals, scope and stakeholders agreed.
- Discovery: interviews, a configuration review of your Microsoft 365 tenant and a document review.
- Analysis: risks rated by likelihood and impact, with the evidence behind each.
- Readout: findings presented to leadership and IT, with a roadmap you can act on straight away.
What you receive
- AI risk register and heat map
- Microsoft 365 data exposure findings, including oversharing hotspots
- Prioritised remediation roadmap (30 / 60 / 90 days)
- Draft AI acceptable use policy and governance model
- Executive readout session
Ready to talk about ai risk audit?
Tell us where you are on your AI journey. We'll come back with practical next steps, not a sales pitch.