AI audit for small business: what it actually covers

"AI audit" means three different things, and two of them aren't for you. There's the governance audit — frameworks for auditing AI systems at enterprises, the ISACA-certification world. There's AI in auditing — accounting firms using AI on financial audits. And then there's the one a small business actually needs: a structured look at what AI is already in the building, what data it's touching, and where it could actually earn money — before you spend real budget on either fear or hype. That third audit is this guide.

What an SMB AI audit covers: four lenses

1. Tool inventory, including the shadow. Every AI tool in use — sanctioned or not, on company or personal accounts. In most SMBs this list is two to three times longer than the owner expects: the free chatbot tabs, the AI features quietly switched on inside the CRM and the email platform, the transcription app someone installed for meetings. You can't govern or leverage what you haven't listed. (This is also the moment to put an AI use policy in place, if there isn't one — the inventory and the policy are two halves of the same move.)

2. Data exposure paths. For each tool on the list: what goes in, at what sensitivity, under which account and subscription tier — because a free consumer tier and a contracted business tier carry different data terms for identical prompts. The audit output here is a short table of findings ranked by severity: customer PII in a free chatbot outranks marketing copy in a paid one by a wide margin.

3. Workflow and hours mapping. Where the paid hours actually go, at the level of repeated work: intake, scheduling, quoting, reporting, follow-up, data entry between systems that don't talk. This is the lens most "AI strategy" skips, and it's the one that makes the audit worth money — AI opportunity lives where hours repeat, not where demos impress.

4. Opportunity ranking with honest ROI. Cross the hours map against what current AI actually does well, and rank by (hours saved × loaded cost) minus the realistic cost to build and run — counting the unglamorous parts: integration, error handling, the human review step that stays. A real audit says "these two workflows are worth automating this year, these three aren't yet" — anything that recommends everything is a sales document wearing an audit costume.

The DIY checklist

An owner can run the first pass in an afternoon. Ten items:

1. List every AI tool anyone uses for work — ask, don't assume; amnesty gets honest answers.
2. Mark which are on personal accounts and which on company accounts.
3. Note the subscription tier of each — free consumer tiers are the exposure hot spots.
4. Write down, per tool, the most sensitive thing that's gone into it. No judgment; just facts.
5. Flag anything involving customer PII, financials, credentials, or NDA material in an unapproved tool.
6. List your five most repetitive workflows and estimate weekly hours on each.
7. For each, note what breaks when it's done wrong — the risk side of automating it.
8. Multiply hours by loaded hourly cost: that's the annual prize per workflow.
9. Mark which workflows live in systems with APIs or export paths — integration feasibility in one question.
10. Rank: biggest defensible prize, smallest data risk, first.

When a formal assessment pays for itself

The DIY pass finds the obvious. A formal assessment earns its fee when the stakes outgrow an afternoon: multiple systems that would need to talk to each other, regulated data in the mix, a real budget waiting on the answer, or a nagging sense that the hours map is wrong because nobody inside can see the shop objectively. A good assessment deliverable reads like an engineering document, not a pitch — findings with evidence, ROI math you can check, and a ranked plan with the "not yet" list included. That's what our AI readiness assessment produces; there's a sample report you can read before any call, which is also a useful benchmark for judging anyone else's audit offer.

The regulated-vertical layer

If the business touches regulated data, the audit grows a compliance lens on top: healthcare and dental practices need the deployment checklist HIPAA actually implies — BAAs, training-data exclusion, audit logging, retention — which is its own discipline, covered in the HIPAA-compliant AI guide. Law and accounting firms carry confidentiality duties that tighten the data-exposure lens by default. And a precision worth keeping: an audit finds facts and gaps. It doesn't certify compliance — nothing does; compliance lives in how the deployment is run after the audit.

What happens after the audit

The audit's job is a defensible shortlist. What follows — building the automations that made the cut, with the integration and review structure that keeps them safe — is a different project with its own economics; the rest of this pillar covers what that looks like at small-business scale. The audit's other output is quieter: the shadow-AI inventory usually shrinks on its own once there's a sanctioned path, because most shadow use was employees solving real problems with the only tools nobody had given them.