Running your AI audit at your firm

When we think of an audit, many of us go straight to time, expense, energy and rules. It can start with a simple check-in instead. No blame, no punishment, just understanding.

An AI audit is a check-in of that kind, about the AI tools people in a firm are using. Many staff have found AI tools themselves and are using them for real work.

Say Marco works in a firm's property team. He pays $30 a month, on his own card and his own account, for a transcription tool that writes up his client meetings, which saves him typing notes after every call.

1What an AI audit is

An AI audit lists tools like Marco's. For each AI tool the firm's people use, it records who uses it, what they use it for, whether the firm pays for it, and whether it has been approved.

For this article, we use three levels of AI audit. The list is the basic one, the same kind of review as a software licence check. A structural audit builds on it by looking at what the firm gets from its AI use: where the same job is being solved in several ways, which models suit which tasks, what belongs in a shared prompt library, and how long routine work takes. A security audit looks at how each tool handles the firm's data. It covers more than this article sets out, including settings such as data retention, multi-factor authentication and which accounts are personal. Your information technology (IT) provider may run that one.

The basic list also takes in AI that arrives inside software the firm already has, such as a drafting feature switched on in the email program.

2What is already in use

Features like that, and tools like Marco's, take some asking to find, because they reach the firm through individual people and software updates. In May 2026, Salesforce research conducted by YouGov surveyed 1,293 Australians and found two in three workers use at least one AI tool regularly at work. Of the workers who use AI at work, 56% are using tools their employer did not provide or approve. The same Australian survey found 27% juggling several tools. Separate Salesforce research among desk workers found only 9% of Australian desk workers said AI was embedded in their day-to-day workflows.

Microsoft and LinkedIn's 2024 Work Trend Index, which covered 31 countries, found 52% of people who use AI at work are reluctant to admit using it for their most important tasks. Marco uses his tool in client meetings every week, and he may not think of a $30 subscription as something to raise. When tools arrive one person at a time, each person holds their own piece of the list.

So questions about AI can end up answered from memory. When a client wants to know which tools touched their matter, or a partner wants the monthly AI spend, the answer may depend on who is at the table.

3Running the check-in

To get the answer out of memory and onto paper, one option is a form sent around the firm, with a column for each tool and a deadline for replies.

But what comes back? Free versions, subscriptions on personal cards, browser extensions and features built into existing software can easily be left off. A form can also read like the start of an investigation, and Marco might wonder whether listing his tool will get it switched off. So the check-in runs as a conversation, and our post on shadow AI sets out six steps for having it.

What to do with the answers

With a spreadsheet, these five steps turn the answers into a list the firm can act on.

1. Add what the records already show. Expense claims and card reimbursements, the browser extensions on firm machines, and the AI features switched on inside the firm's existing software can all turn up tools the conversation missed. Your IT provider may also be able to pull a list of the AI services reached from the firm's network.

2. Record the same seven things for each tool: its name, who uses it, the work it is used for, whether the account is personal or the firm's, what it costs and who pays, whether client information is entered into it, and whether it has been approved.

3. Sort every tool into one of three piles: good and ready to become the firm's standard, duplicated, or needing a decision from the partners.

4. Take the third pile to the partners, with the person who uses each tool there to explain what it does.

5. Tell each person what happened to their tool, and where to find the firm's list.

Marco's tool holds client information in a personal account, so it goes to the partners with Marco there to explain what it does. If the firm approves it, it can move to a firm account. Any duplicate transcription tools can then be reviewed alongside it.

Once the piles are sorted, the firm works from one agreed list. When a staff member works out a better way to use a tool, the list shows who else uses it, so the method can reach them and become part of how the firm works.

Each AI subscription on the agreed list has a name and a user against it. When a client or a tender asks about the firm's position on AI, the firm can answer from its agreed list and the partners' decisions.

4Where we come in

With the agreed list in place, the structural work can move to how long the firm's routine work takes. For Marco's team, that could mean timing how long a set of meeting notes takes to reach the file once the call ends.

That timing is part of our investigation, which gives your firm a baseline of its own and measures it again at three months. The findings belong to your firm whether or not we go any further together.

If you would like help with the structural work, reach out to our team. The first conversation works out whether your firm is the right fit for the AI Uplift Program, and whether we are the right people to help.

Running a basic audit