An AI readiness audit is a structured check of your data, permissions, security and compliance, run before you switch on AI tools like Microsoft Copilot. We treat it like a cyber security audit: methodical, evidence-based, and mapped against ISO 27001 and ISO 42001, both of which OxygenIT holds. Here is what it covers and why it matters.
What an AI Readiness Audit Checks
We check your business before you switch on any AI tools. This is not a sales pitch. We treat it like a cyber security audit, methodically, with real evidence. No guesswork here.
Most Christchurch business owners think it is about finding the right software. It is not. The true work is under the surface. It involves your data, your permissions, and how your staff operate. What does an audit look at?
- Data quality and structure. Is your data tidy? Is it labelled? Stored somewhere logical? Bad data from messy spreadsheets or duplicate files leads to bad AI results.
- Access controls and permissions. Who can see what information? We check if staff can get to files they should not. Copilot and other AI tools show users anything they already have access to.
- Security posture. We look at multi-factor authentication, endpoint protection, and email filtering. AI security begins with the basics. Not expensive extras.
- Compliance alignment. We check your position against ISO 27001 and ISO 42001. We find any gaps for regulatory compliance too.
- Staff awareness and process. Do your staff understand what to feed into an AI tool? And what not to? Many businesses struggle here.
Here is a situation we see often. A Christchurch professional services firm with 40 staff aimed to use Microsoft 365 Copilot. The licences looked fine on paper. But our audit found active old staff accounts, shared folders with no permission setup. And no policy on what staff could type into a prompt. After three months of cleanup, their setup was clean, audit ready. That shows the difference between buying a tool and being truly ready for it.
The Process, Step by Step
A proper audit follows specific steps. We do not skip any. Skipping steps leads to costly rework down the line.
- Review current IT infrastructure and cloud environment.
- Map data storage locations and access permissions.
- Run a security assessment covering endpoints, email, and network.
- Check compliance status against relevant standards.
- Interview key staff about current tools and workflows.
- Document gaps and prioritise them by risk and effort.
- Deliver a plain-English report with a remediation plan.
That last step matters. More than most people think. An audit that delivers a 40-page technical document nobody reads has little value. We’ve seen businesses act on findings when they get a short, prioritised list. Not a wall of jargon.
And here is the plain truth: an AI readiness audit is not a one-off job. AI tools change constantly. Your data environment shifts as staff come and go, or change roles. We reviewed a business in Riccarton recently. They had an audit a year ago. It looked good then. But new integrations created gaps nobody saw. Readiness is not a final state. It is something you check, then adjust, then check again.
Cyber Security Audit vs AI Readiness Audit: What’s the Difference
People often confuse these two. We get calls from Christchurch business owners monthly. They ask for one, but mean the other. Let’s make it clear.
A cyber security audit inspects your defences. It checks firewalls, network security, and password management. It confirms your systems can handle phishing or a ransomware attack. It protects what you already own. Consider it a health check for your IT setup. This feeds into ISO 27001 compliance or a cyber insurance readiness assessment.
An AI readiness audit asks a separate question. It does not defend your systems. It checks if your business can use AI tools safely. And use them well. Can your staff use Microsoft 365 Copilot without client data leaks? Does your team know what *not* to paste into ChatGPT? Do you even have an AI governance policy? Most businesses we look at do not.
Here’s how the two compare in practice:
- Cyber security audit: Checks firewalls, endpoint protection, backups. Looks at network vulnerability gaps.
- AI readiness audit: Checks data handling. Looks at staff AI use and tool access controls. Covers governance for AI-generated content.
- Cyber security audit: Often needed for cyber insurance. Also for SMB1001 certification.
- AI readiness audit: More and more businesses need this. They adopt AI tools without a plan. This creates new data exposure risks. Nobody expects these.
- Cyber security audit: Guards against attackers.
- AI readiness audit: Protects against your own staff. It stops them from accidentally exposing sensitive information using AI.
They overlap. More than most people think. A weak cyber security setup increases AI adoption risk. Any data your staff feed into an AI tool is only as secure as its surrounding systems. If file permissions are a mess, an AI tool will show information it should not. We’ve seen this. Clients assumed their Microsoft 365 environment was secure, we found shared folders open to everyone in the business.
The order of things matters. Sort your cyber security basics first. Then run the AI readiness check. Doing it the other way around is like adding a fancy lock to an unlocked door. Some Christchurch firms want AI tools rolled out fast. They skip the groundwork. That’s where problems start.
Both audits should be part of one strategy. Not separate one-off tasks. We built our approach around ISO 27001 and ISO 42001 certified processes for this reason. The security side and AI governance side need to connect. They should not work alone.
Not sure which audit your business needs? It is a fair question. Ask it before you spend money. Our team can explain your current position. We can point you towards the right starting place for your setup.
Is Your Business Ready for AI? A Quick Scenario Check
Imagine two Christchurch businesses. Each has about 40 staff. Both use Microsoft 365. One deploys Copilot over a weekend. They see real value in a month. The other turns it on. Staff try it out, then go back to old ways. Same tools, but very different results. The AI itself is rarely the reason. It is about whether the business was ready. Before it started.
Which business would you be? Ask yourself some honest questions first.
- Do your staff know where company data lives? And who can see it?
- Is your Microsoft 365 licensing correct? Or has it become messy over the years? With old accounts and unused add-ons?
- Is multi-factor authentication on for every user? Not just some?
- Would you know if an old file was shared where it should not be? Today?
- Has anyone in your team had proper security awareness training recently?
If you answered “not sure” to two or more questions, you are not alone. We see this often with growing Christchurch businesses. A firm reaches 50 or 60 staff. IT has been patched up for years. Nobody checked permissions or access. Then someone gets keen on Copilot summarising meetings and drafting emails. Suddenly, it reads years of badly organised files. That is when trouble starts.
Here’s a common pattern we see. A Christchurch logistics business wanted to use Copilot for faster quotes. A good idea, on paper. But we looked under the bonnet. Old contractor accounts still had access to client folders. File permissions had not been reviewed for over three years. The AI was not the danger. The mess it was about to reveal, was.
This is precisely what an AI readiness audit checks. Before you switch anything on. It does not slow you down. It makes sure the AI has a solid foundation. You get the productivity. Without the exposure.
A quick gut check for you. Would you feel nervous letting an external auditor see your file permissions and access logs today? That signals you are not quite ready. And that is okay. Most businesses are not. Until they get a real look at things.
We have done this kind of assessment for Christchurch businesses since 2005. We are ISO 27001 and ISO 42001 certified. So we do not guess what “good” means. Want a clear answer on your business’s position? Book a free IT and security review with our team. Call us on 0800242206. Or check out our AI readiness audit page to learn more.
Related reading
- What an AI readiness audit costs in NZ
- AI governance in Christchurch
- Artificial intelligence services
Frequently asked questions
You need one if you plan to use AI tools like Copilot or ChatGPT but haven't checked your data and access setup first. Many Christchurch business owners we talk to jump straight to buying licences. They skip the groundwork on permissions and staff training. If your team already has messy shared folders or no clear AI policy, that's a sign. An audit shows you exactly where the gaps sit before problems start.
A cyber security audit checks your defences against outside attacks, while an AI readiness audit checks how safely your own staff can use AI tools. One guards your firewalls and passwords. The other looks at your data structure, staff habits, and governance policies. Both matter, but they answer different questions. Most Christchurch firms confuse the two, which is why it helps to get clear guidance on AI readiness audit services in Christchurch before choosing one over the other.
Skipping the audit often means staff get access to files they shouldn't see. Copilot and similar tools show users anything they already have permission to open. If your folder permissions are messy, the AI tool will expose that mess faster than your staff ever could. We've seen this happen with Christchurch teams who assumed their Microsoft 365 setup was tidy. It usually wasn't.
You should repeat it at least once a year, or sooner if your team or systems change. Readiness is not a one-time tick box. Staff leave, new integrations get added, and data environments shift constantly. A Riccarton business we reviewed passed its audit a year earlier, then new integrations quietly opened fresh gaps nobody noticed. Regular checks catch these changes before they become bigger problems.
No, having Copilot switched on does not mean your business is ready. Licences only give staff the tool. They don't fix messy data, open permissions, or missing staff guidelines. We saw this with a 40-staff Christchurch firm whose licences looked fine on paper. Their audit found old staff accounts still active and no rules on what staff could type into a prompt. Readiness comes from the setup underneath, not the software itself.
Some basic steps you can handle yourself, like reviewing who has access to shared folders. But a full check needs someone comparing your setup against standards like ISO 27001 and ISO 42001. Most small teams don't have time to interview staff, map data storage, and prioritise risks on top of daily work. That's usually where getting a proper audit done for you saves time and catches things an internal check would miss.
