This is the method in full, so you can judge it before we speak — or run a version yourself. The two-week sprint covers mapping and scoring; the roadmap it leaves takes you to a working release by day 90.
From two-week audit to a 90-day roadmap
Days 1–20: map the work. Pick the five to eight recurring workflows that consume the most skilled time or create the most rework. For each, write five lines: input, decision, output, owner, and what “good” looks like today. In a CA practice this is usually research and first drafts, document extraction, reconciliations, reporting packs and routine client communication. In a finance team it is close, payables, collections and management reporting.
Days 21–45: score and cut. Score each workflow on value (hours, cycle time, error cost, cash timing), feasibility (data availability, system access, process stability) and control risk (confidentiality, regulatory exposure, whether an error reaches a client or a filing). Be ruthless. Anything that needs clean data you do not have goes to the “later” column. Anything that would put an unreviewed answer in front of a client goes to “redesign”.
Days 46–70: design one release. Take the top one — occasionally two — and design the thin version: which team, which data classes the tool may see, where the human approval gate sits, what is logged, and the metric you will review weekly. Write the stop conditions now, while nobody is emotionally invested.
Days 71–90: run it beside the old process. Two to four weeks with one team, reviewed weekly. The output of the audit is not the deck. It is a working release with evidence, or a clean “no” with reasons.
The plan on one page
90-day AI opportunity audit: phases, outputs and decision gates
| Days | Work | Output | Decision gate |
|---|
| 1–20 | Map five to eight recurring workflows: input, decision, output, owner, today’s “good” | Workflow maps and a rough baseline | Do we have owners and data for at least three workflows? |
| 21–45 | Score value, feasibility and control risk; cut weekly | Ranked shortlist, with a “later” and a “redesign” column | Which one workflow (occasionally two) goes forward? |
| 46–70 | Design the thin release: team, data classes, human gate, logging, metric, stop conditions | Release design and pilot charter | Is the control design acceptable to the partner, CFO or risk owner? |
| 71–90 | Run beside the old process with one team; weekly review of the exception log | Evidence against the baseline | Keep, change or stop, in writing |
The scoring rubric
Score each workflow from 1 to 5 on each line. This is a framework for your own data, not benchmark data.
AI opportunity scoring rubric (score your own workflows)
| Dimension | What a 5 looks like | What a 1 looks like |
|---|
| Value: hours | Many skilled hours every week across the team | A few hours a quarter |
| Value: error and cash | Errors are costly, or cash timing improves | Little cost to an error; no cash effect |
| Feasibility: data | Structured data you already hold and can access | Data is on paper, scattered or owned by a third party |
| Feasibility: process | Stable, written-down steps | Changes every month or lives in one person’s head |
| Control risk (reverse-scored) | Errors are caught inside the business before anyone relies on them | An unreviewed error could reach a client, a filing or a regulator |
| Ownership | A named manager wants it fixed and will run the release | Nobody’s job |
How to spot audit theatre early
Three signals tell me an audit is drifting. First, the idea list keeps growing after week three; a healthy audit shrinks its list every week. Second, nobody has asked for a baseline — not a perfect cost model, just rough volume, hours by role and the errors people already complain about. Third, the recommendations name tools before they name owners. If a recommendation cannot say who will be accountable for the metric, it is a brochure, not a plan.
Audit theatre versus a useful audit
| Theatre | Useful |
|---|
| Starting point | Workshops and a long idea list | Five to eight recurring workflows with owners |
| Baseline | None, or a vendor’s benchmark | Rough volume, hours by role and known error patterns from your own data |
| Idea list over time | Grows every week | Shrinks every week |
| Recommendations | Name tools and platforms | Name owners, metrics and controls first |
| Output | A closing deck | One working release with evidence, or a clean “no” with reasons |
Governance anchors to use in India
You do not need a heavy framework, but you should be able to show that the audit considered risk in a recognised way. These are the ones I use, depending on the organisation:
Treat all of them as prompts. Your chart of accounts, staffing and auditor’s expectations are the real constraints.
Deliverables checklist
- Workflow maps (five lines each) for every workflow reviewed.
- Baseline sheet: volume, hours by role, error patterns, with how each was measured.
- Scored and ranked list, including what was cut and why.
- One release design: team, data classes, human approval gate, logging, metric, stop conditions.
- Cost of the next 90 days, including review time and change management, not just licences.
- Control notes: data protection, who reviews what, and for CA firms, which outputs a signing professional must see.
- Evidence from the parallel run and a written keep, change or stop decision.
Monday-morning checklist
- List no more than eight recurring workflows and write the five-line map for each.
- Collect a rough baseline: volume, hours by role, known error patterns.
- Score value, feasibility and control risk; cut the list every week.
- Design one thin release with owner, data classes, human gate and stop conditions.
- Judge the audit by the release it ships, not by the length of the deck.
Frequently asked questions
What is an AI opportunity audit?
A time-boxed review that maps an organisation’s recurring workflows, scores each on value, feasibility and control risk, and ends with one designed release run beside the existing process, rather than a list of ideas.
How long does an AI opportunity audit take?
About 90 days if it includes a real parallel run: roughly 20 days to map workflows, 25 to score and cut, 25 to design one release and 20 to run it beside the old process.
What should an AI audit report contain?
Workflow maps, a baseline, the scored and ranked list with what was cut, one release design with owner, metric and controls, the cost of the next 90 days and, after the parallel run, a written keep, change or stop decision.
Which frameworks should an AI audit in India refer to?
The NIST AI Risk Management Framework as a neutral checklist, MeitY’s India AI Governance Guidelines, the DPDP Rules, 2025 for personal data, the RBI’s FREE-AI report for regulated financial entities and NFRA’s 2026 principles for audit firms.
Is an AI audit worth it for a CA firm?
It is worth it when partners want a defensible answer about where AI pays back. For CA firms the audit should also record which outputs a signing professional must review, because AI does not change who is accountable.
This section replaces my earlier article “The AI Opportunity Audit: A 90-Day Roadmap Without the Theatre”. Sources: NIST AI RMF; PIB on India AI Governance Guidelines; PIB on DPDP Rules, 2025; RBI FREE-AI report; NFRA Staff Series.