Boards and audit committees
You need to discharge oversight duties on AI and want an independent view rather than management marking its own homework.
The service
An evidence-based answer, not a workshop
Most organisations discover their real AI footprint the same way: badly, and after something has gone wrong. Teams adopt AI tools without asking, vendors embed AI into products mid-contract, and the systems making decisions about customers accumulate quietly. The health check is a structured sweep of all of it, assessed against the good practice codified in ISO/IEC 42001, the international standard for Artificial Intelligence Management Systems, without requiring you to pursue certification.
It is an assurance review: we examine, we test what we are told against evidence, and we report. We do not implement fixes, which is exactly why the findings can be trusted.
Deliverables
What an engagement includes
- D1A real AI inventoryEvery model, tool and AI-powered feature in use: the products you ship, the tools your teams adopted, and the AI working inside vendor systems. Most boards are surprised by this list, which is the point.
- D2A risk snapshot per systemFor each system that matters: who could be harmed, what could fail, what data it touches, and who is accountable. Ranked, so attention goes where it should.
- D3A governance gap assessmentYour current policies, oversight and controls measured against ISO/IEC 42001 good practice, stated plainly: what exists, what is missing, what is pretending.
- D4A board report in plain EnglishWritten for directors, not data scientists. Short enough to be read, specific enough to be acted on, and suitable for showing to customers or insurers who ask.
- D5A prioritised roadmapWhat to fix first, what can wait, and an honest view on whether pursuing ISO/IEC 42001 certification is worth it for you, including "not yet" if that is the truth.
Who this is for
Three situations we see most
Before big AI decisions
A major AI procurement, product launch or partnership is coming, and the decision deserves a clear picture of the risk position first.
Facing customer questions
AI governance questionnaires have started arriving from enterprise customers, and the honest current answer is improvised.
Independence, always: we assess and report; we do not build or sell the fixes. If the findings lead you to implementation work, you choose your consultancy, and whoever implements, the next review stays independent.
FAQ
Fair questions, straight answers
Is this an audit or consultancy?
An assurance review, which is the audit side of the line: we examine evidence and report findings. We do not design or implement solutions, so the report you put in front of your board carries no vendor incentive to find work for ourselves.
Do we need this before pursuing ISO/IEC 42001?
It is the natural first step: the inventory, risk snapshot and gap assessment are exactly the groundwork a certification project starts from, so nothing is wasted. But the health check stands alone, and for some organisations its honest conclusion is that full certification is not yet worth the investment.
What if you find something serious?
You hear about it immediately, not in the final report. Serious findings come with a clear statement of the exposure and the fastest safe way to reduce it, and we verify the fix once it is made if you want that closed loop.