What a proper AI audit of a small business looks like
A proper AI audit is process archaeology, not a shopping list. It digs through how work actually moves through your business: where information enters, where somebody retypes it into a second system, where a job sits waiting for a person to notice it, and what would break if a machine did the step instead. A list of tools with your logo on the cover is not an audit. It is a brochure.
The distinction matters because the market sells both under the same name. Some audits are free, because they are the opening move of a software sale. Others are paid diagnostic work whose findings you could hand to any competent builder. Price is not what separates them. The deliverables are, and they are checkable.
What is the audit actually looking for?
Four questions, asked of every process that matters:
- Where does information enter the business? Email, phone, WhatsApp, a web form, a site visit. Most small firms have five or six front doors and no written list of them.
- Where does a human retype it? Retyping is the signature of a missing connection: the enquiry copied into the quoting spreadsheet, the delivery note keyed into the accounts package. Every retype is a delay, an error opportunity and an automation candidate.
- Where does work wait? Not where it is slow, where it is stationary: the quote waiting on a price check, the approval sitting in a director's inbox since Tuesday. The waiting usually dwarfs the work.
- What would break if this step were automated? The retype that quietly catches pricing errors, the phone call that keeps a customer warm. Some friction is load-bearing, and a good auditor goes looking for it.
Method matters as much as the questions. An auditor who only interviews the owner maps the organisation the owner believes in. The real process lives with whoever does the step on a wet Thursday, so a proper audit watches work happen and asks to see the actual inbox, the actual spreadsheet, the actual group chat.
Which deliverables separate an audit from a sales pitch?
| Deliverable | What it contains | The test that it is real |
|---|---|---|
| Ranked automation list | Each candidate step with effort, payback logic and dependencies | You could hand it to any builder, not only the firm that wrote it |
| Data map | What personal data you hold, where it lives, where it flows | It would genuinely help you answer a data question tomorrow |
| Do-not-automate list | Steps that should stay human, with reasons | It names work the auditor could have sold you |
| Quick wins | Changes needing no new software at all | Some of them cost nothing |
The do-not-automate list is the tell. Automating everything is never the right answer, so an audit that finds nothing worth leaving manual was written backwards, from the product to the findings.
The data map earns its keep twice. It drives the automation design, and under UK GDPR most firms need a record of what personal data they process anyway; the ICO's guidance for organisations sets out what that involves. If the audit leaves you better placed on both fronts, it was real work.
What are the red flags in a cheap audit?
- Tool names appear before process names. If a product is recommended in the first three pages, you are reading marketing.
- Nobody watched anyone work. An audit assembled from one meeting with the owner has mapped a business that does not exist.
- Every finding is solved by the auditor's own product. That road ends with licences installed and nobody using them.
- Confident numbers with no assumptions. A real audit shows its arithmetic: call it five quotes a week with forty minutes of retyping each, and you can check both figures against your own diary. A fake one promises a large round percentage sourced from nowhere.
- Security never comes up. Automation moves data between systems. If the report says nothing about access, passwords and backups, the basics covered in the NCSC small business guide, it has ignored half the job.
What should an AI audit cost?
Anything from nothing to a serious fee, honestly, because the word covers everything from a disguised sales call to weeks of diagnostic work. The useful question is not the price but the independence of the output. If the findings only make sense if you buy from the people who wrote them, you paid for a pitch, whatever the invoice said. If you could take the report to three builders and get competing quotes against it, you bought an audit.
What happens after the audit?
Pick the top item on the ranked list and pilot it properly: one process, one named owner, a start date, an end date, and a decision at the end. Resist commissioning the whole list at once. It is a sequence, not a shopping trip, and the second item gets cheaper once the first has taught everyone how this goes.
Keep the frame honest throughout. The point was never to acquire software; it was to remove retyping, waiting and chasing from processes you already run, which is automation, not software. AI Metric runs audits of exactly this shape, but nothing above depends on taking our word for it. The table is the test, and it works on anyone, including us.