AI audit for small business: what it actually covers

"AI audit" means three different things, and two of them aren't for you. There's the governance audit — big-company frameworks for checking AI systems, the world of ISACA certifications. There's AI in auditing — accounting firms using AI on financial audits. And then there's the one a small business actually needs: a structured look at what AI is already in the building, what data it's touching, and where it could actually earn money — before you spend real budget on either fear or hype. That third audit is this guide.

What an SMB AI audit covers: four lenses

1. Tool inventory, including the shadow. Every AI tool in use — sanctioned or not, on company or personal accounts. In most SMBs this list is two to three times longer than the owner expects: the free chatbot tabs, the AI features quietly switched on inside the CRM and the email platform, the transcription app someone installed for meetings. You can't set rules for, or get value from, what you haven't listed. (This is also the moment to put an AI use policy in place, if there isn't one — the inventory and the policy are two halves of the same move.)

2. Data exposure paths. For each tool on the list: what goes in, how sensitive it is, under which account and subscription level — because a free consumer tier and a paid business tier have different rules about your data for the very same prompt. The output here is a short table of findings ranked by how serious they are: customers' personal details (PII) in a free chatbot outrank marketing copy in a paid one by a wide margin.

3. Workflow and hours mapping. Where the paid hours actually go, at the level of repeated work: intake, scheduling, quoting, reporting, follow-up, retyping data between systems that don't talk to each other. This is the lens most "AI strategy" skips, and it's the one that makes the audit worth money — AI opportunity lives where hours repeat, not where demos impress.

4. Opportunity ranking with honest ROI. Set the hours map against what today's AI actually does well, and rank by (hours saved × what those hours cost you, all in) minus the realistic cost to build and run — counting the unglamorous parts: connecting it to your systems, handling mistakes, and the human check that never goes away. A real audit says "these two workflows are worth automating this year, these three aren't yet" — anything that recommends everything is a sales document wearing an audit costume.

The DIY checklist

An owner can run the first pass in an afternoon. Ten items:

1. List every AI tool anyone uses for work — ask, don't assume; amnesty gets honest answers.
2. Mark which are on personal accounts and which on company accounts.
3. Note the subscription tier of each — free consumer tiers are the exposure hot spots.
4. Write down, per tool, the most sensitive thing that's gone into it. No judgment; just facts.
5. Flag anything involving customers' personal details, financials, passwords, or NDA material in an unapproved tool.
6. List your five most repetitive workflows and estimate weekly hours on each.
7. For each, note what breaks when it's done wrong — the risk side of automating it.
8. Multiply hours by what an hour really costs you (wages plus overhead): that's the annual prize per workflow.
9. Mark which workflows live in software that other tools can connect to or export from — that's the whole "can it be connected?" question in one line.
10. Rank: biggest defensible prize, smallest data risk, first.

When a formal assessment pays for itself

The DIY pass finds the obvious. A formal assessment earns its fee when the stakes outgrow an afternoon: multiple systems that would need to talk to each other, regulated data in the mix, a real budget waiting on the answer, or a nagging sense that the hours map is wrong because nobody inside can see the shop objectively. A good assessment report reads like a set of findings, not a pitch — findings with evidence, ROI math you can check, and a ranked plan with the "not yet" list included. That's what our AI readiness assessment, Edgerton, produces: an agent joins your team's computers with their consent, measures the real workday for ten business days, and reports where the hours go. There's a live sample report you can read before any call, which is also a useful benchmark for judging anyone else's audit offer.

The regulated-vertical layer

If the business touches regulated data, the audit grows a compliance lens on top: healthcare and dental practices need the practical checklist HIPAA actually implies — signed BAAs, a vendor promise not to train on your data, a log of everything the AI looked at, rules on how long data is kept — which is its own discipline, covered in the HIPAA-compliant AI guide. Law and accounting firms carry confidentiality duties that tighten the data-exposure lens by default. And a precision worth keeping: an audit finds facts and gaps. It doesn't certify compliance — nothing does; compliance lives in how the system is run after the audit.

What happens after the audit

The audit's job is a defensible shortlist. What follows — building the automations that made the cut, connected to your systems and with the human checks that keep them safe — is a different project with its own economics (for us, that's Edgekeeper: a private AI brain on a server we run for your business, fenced around the tools you already use); the rest of this pillar covers what that looks like at small-business scale. The audit's other output is quieter: the shadow-AI inventory usually shrinks on its own once there's a sanctioned path, because most shadow use was employees solving real problems with the only tools nobody had given them.