The 30-Day Department AI Audit

Every department in your company has a different AI story, and you only know one of them — the one from the team that's already talking about it.

The teams that adopted AI quietly are the ones you're guessing about. The team that's using it well doesn't need to tell you. The team that's using it badly doesn't want to. And the team that's not using it at all is embarrassed to admit it. You have no idea what's actually happening, and neither does anyone else in leadership.

The fix is a thirty-day audit any department can run without consultants, without new tools, and without waiting for permission. Four questions, four weeks, one honest picture.

The four questions

Week one: where is AI being used? This is the inventory. Not the approved list — the real list. Walk the team, look at the browsers, the tools, the shared drives, the workflows. Find the places AI actually shows up: the drafts, the summaries, the translation, the spreadsheets with formulas someone didn't write. Most of it will be unsanctioned. Write it down anyway.

Week two: where is it NOT being used? This is the gap question, and it's the one most audits skip. Look at the repetitive, high-volume, low-judgment work that's still being done by hand. The status reports assembled every Monday. The data re-entered between systems. The first-draft writing that gets rewritten from scratch. Every one of those is a candidate that nobody has claimed yet.

Week three: what breaks? This is the damage assessment, and it's where the audit earns its keep. Find the AI outputs that went wrong: the wrong answer that went to a customer, the summary that missed the critical detail, the decision made on a confidently wrong number. Not to assign blame. To find the pattern. If the same kind of error keeps showing up, that's a fix with a name on it.

Week four: what's next? This is the plan. Three items, ranked. One thing to make safe (the unsanctioned use that's actually risky). One thing to scale (the use that's working and should reach the whole team). One thing to fix (the failure pattern from week three). That's the entire output of the audit — three actions, ranked, with owners.

The audit's job isn't to find violations. It's to find the three things that matter: what to make safe, what to scale, and what to fix.

Running it without consultants

The audit has no prerequisites, and that's the point. A department lead runs it with the team, an hour a week for four weeks. No new software, no external firm, no survey tool. Just the four questions and the discipline to answer them honestly.

The honesty is the hard part, and it's the part that needs the lead's attention. People will hide unsanctioned use if they think they'll be punished for it. The framing has to be explicit from week one: this audit finds what's working so we can make it safe, not what's wrong so we can police it. If the audit becomes a trap, the inventory comes back empty and the whole exercise is theater.

The other prerequisite is a no-blame rule on week three. The failures are the most useful data the audit collects, and they only surface if people can name them without fear. The team that found the wrong answer that went to a customer is the team that's about to save you from the next one. Reward the reporting. That's how the audit compounds.

What the audit produces

Thirty days in, you have a picture nobody else has: the real usage map, the real gaps, the real failure patterns, and three ranked actions. That's more than most companies have after a year of AI committees.

The audit also produces the second-order effects that don't show up in the report. The team that ran it now knows what its own AI usage looks like, and that's capability. The lead who ran it has a concrete plan to execute, and that's ownership. And the organization has a repeatable instrument it can run again in six months to measure whether anything changed, and that's the difference between an audit and a one-time exercise.

The trap to avoid

The most common failure of the department audit is turning it into a PowerPoint. Thirty days of work becomes thirty slides, and the three actions become “further analysis needed.” That's the audit failing at its only job.

The audit is done when the three actions have owners and dates. Not when the report is filed. If the department lead can't name who's making the risky use safe, who's scaling the working use, and who's fixing the failure pattern — by when — the audit didn't happen. It just looked like it.

One hour a week, four weeks, four questions. That's the whole instrument. Run it, act on the three answers, and run it again in six months. The teams that know what they're doing with AI aren't the ones with the biggest budgets. They're the ones that took a month to look honestly at what was already happening — and then did something about it.

Think this argument fits your event? Tell me about the room — the calendar is selective.