Picture a company like yours on an ordinary Wednesday. A large customer sends a procurement questionnaire with a new section on artificial intelligence. It asks which AI tools you use, who is accountable for them, what happens when one fails, and whether an independent party has reviewed your answers. The reply is due in three months. Your CFO forwards it with a one-line note: “Can we answer this?”
Most leaders would like to say yes and are not sure. This article is about why that uncertainty is common, what it will take to turn it into a confident answer, and a 90-day path that a mid-market company can follow without building a bureaucracy.
The Challenge, in One Survey
In early 2026, Grant Thornton surveyed 950 business leaders across ten industries, with fieldwork from February 23 to March 18. It asked, among other things, how confident they were that their organization could pass an independent AI governance audit within 90 days. Seventy-eight percent said they lacked strong confidence. Only 7 percent of organizations still piloting AI were very confident, compared with 74 percent of those that had fully integrated AI.
The governance picture behind those numbers is uneven. About three in four boards had approved major AI investments, yet 48 percent had not set expectations for AI governance and 46 percent had not made AI risk part of their ongoing oversight. Only 20 percent of leaders said they had a tested AI incident response plan. And 46 percent named governance and compliance failures as a leading cause of AI underperformance.
Treat these with care. Grant Thornton sells advisory services in this area, so it has an interest in the finding. The answers are self-reported, “very confident” is a feeling and not a test, and the survey does not tell us whether the integrated companies were better governed or simply had more reason to build governance. We read the pattern as a signal and not a measurement: leaders are spending on AI faster than they are building the evidence that would let them stand behind it.
Why the Questions Are Getting Harder
There is no single AI audit that every company faces, which is part of the difficulty. The questions arrive from several directions at once: customers adding AI sections to their vendor reviews, insurers asking how you govern the tools you use, boards that want to know what happens if something goes wrong, and regulators in some sectors, which we covered in Every Regulator Is Drafting the Same AI Letter. They differ in wording, but they ask for the same thing: evidence that the company knows what AI it relies on, who owns each use, and what it does when one fails.
Two public reference points give those questions a shape. The National Institute of Standards and Technology released its AI Risk Management Framework 1.0 on January 26, 2023; it is voluntary and organized around four functions, Govern, Map, Measure, and Manage. The International Organization for Standardization published ISO/IEC 42001 on December 18, 2023, a standard for building and running an AI management system, applicable to organizations of any size. Neither is a law, and we cannot tell you which one, if either, a particular reviewer will use. We mention them because a reviewer who has read either will ask for records, not intentions.
What an Auditor Actually Asks For
An audit, whatever form it takes, is an independent party comparing what you say you do with what you can show. That changes the work. A written policy that no one follows will not help you, and a modest practice that is documented and operating often will.
The governance page on our site describes a two-page set of decisions that we think covers most of what a mid-market company needs. It has six parts: an inventory of all AI in use, with risk classes; a named owner for each production AI system; a system of record and authority limits, including for agents that write to your ERP or CRM; a one-page incident response plan; disciplined AI investment, through Project Vista; and ready answers for customers, auditors, and boards. This set is ours and not a standard. Our own mapping, which you should treat as a judgment, is that the inventory and risk classes line up with the framework’s Map function, the owners and authority limits with Govern, the investment records and result tracking with Measure, and the incident plan with Manage.
Days 1 to 30: Find It and Name It
The first month is about seeing what you have. Build an inventory of every AI tool in use, including the ones nobody approved and the AI features that arrived inside software you already license. Your people are likely using more than you know; we wrote about why in The Rack of Reinvented Wheels, and about how to bring that use into view without punishing it in The Best of Both Worlds.
Then sort what you find into a few risk classes. A simple version separates assistive tools that help a person draft or summarize from agentic tools that take actions in your systems, with a higher class for anything that touches customers, money, or regulated data. By day 30 you want a single list, a risk class on each line, and a named person next to every system that is in production.
Days 31 to 60: Decide and Write It Down
The second month turns the list into decisions. For each production system, write down who owns it, what it is allowed to see and do, which system holds the record of what it did, and what the fallback is if it stops working. Agents deserve the closest attention: our piece Taming the Agentic AI Genie covers authority limits, and Less than a Third of AI Agents are Governed explains why the gap is wide.
This is also the month to set a gate between experiment and production, so that a tool built informally has to earn an owner, an audit record, pre-release testing, a fallback, and a review date before it touches live work, as described on our Governance Freeway page. And it is the month to start the decision log. Record why each AI investment was funded, what result it was approved to produce, and what you decided when you checked. Our Project Vista scoring method produces exactly that record, and it answers an auditor’s question about how you decide what to run.
Days 61 to 90: Rehearse It
The last month tests whether the paper is real. Run a tabletop exercise on your incident plan: pick a realistic failure, such as an agent sending a wrong figure to a customer, and walk the team through who is told, who decides, and what is shut off. Keep a short record of what happened and what you changed. This is the item that, according to the survey, only about one company in five has done, and it is the one reviewers tend to find most convincing because it cannot be written in an afternoon.
Then take your evidence to the board in one page. Our article on the 9 percent problem describes what boards want to see, and The Control Group Is Gone covers how to show that AI is working. Finish with a mock audit: ask someone outside the team, a colleague from finance or an outside adviser, to request each item on the list and see how long it takes to produce. If the answer is under an hour, you are close. The cadence behind this month, a quarter as the unit of AI work, is described in What 3 Months of Successful Production AI Actually Looks Like; this article is the evidence layer on top of it.
The Evidence Folder
By day 90, you should be able to open one folder and hand over the AI inventory with risk classes, the list of owners, the authority limits and system-of-record notes for each production system, the incident plan and the record of your drill, the decision log showing why projects were funded, stopped, or scaled, the board minutes or packet showing AI risk was reviewed, and your written answers to the questions customers have already asked. That folder, more than any policy, is what passing looks like.
What This Will Not Do
This will not certify you. We are describing readiness for a review, and whether you pass depends on who reviews you and against what standard. Our 90-day timeline is a judgment based on a bounded footprint, a modest number of production systems; we found no published study of how long audit readiness takes, and a company with many systems, regulated data, or heavy agent use will need longer. Documents also prove less than operation: a reviewer may test whether your controls work in practice, and a drill that never happened will show. And the survey evidence has limits we have named: a vendor with an interest, self-reported confidence, and no breakdown by company size in what we saw.
Where to Start
Start with the inventory, because nothing else can be done without it. If you want a hand, our independent assessment begins with exactly that list and tells you where you stand, and our bench of more than 450 former CIOs, CTOs, and CISOs includes people who have prepared companies for this kind of review, available through Contract CIO+ or a virtual CAIO if you need leadership in the seat. The questionnaire will arrive eventually. The only choice you have is whether you answer it from a folder or from memory.
