Take the audit
How the score works
Each of the ten questions has four answers worth 0 to 3 points. The total is shown out of 100. The questions cover six areas: process clarity, data and knowledge, tools and access, people and ownership, risk and approvals, and customer contact.
The areas follow the idea behind the NIST AI Risk Management Framework: know your context (Map), set up governance and ownership (Govern), measure and manage what the system does. They are a practical checklist, not a certification or a NIST product.[1]
The final step of a good audit is the same one agent guidance stresses: decide in advance which actions need a person and start small, with checkpoints, before giving an agent real access.[2],[3]
The six areas, and what good looks like
Every question belongs to one of six areas. Your result lists the three lowest, because that is where a pilot is most likely to get stuck.
Process clarity
The work is written down as steps with owners and exceptions, and it repeats often enough to be worth automating.
Data and knowledge
The facts an agent needs live in one place that people keep current: prices, policies, customer history, product details.
Tools and access
Your main tools offer integrations, and each person (and each agent) has their own account instead of a shared login.
People and ownership
One named person owns the pilot, has time for it and agrees with the reviewers what the agent should and should not do.
Risk and approvals
You know which steps need a person, which data is sensitive and which rules apply, and it is written down.
Customer contact
You know how many calls, chats and emails go unanswered or slow, because that is often the fastest place to prove value.
None of this requires special software. A shared document, a named owner and an honest list of approvals already move most companies up a band.
What to do with your result
Fix the weakest area first
The audit lists your three lowest areas. Small steps count: writing one process down or naming one owner can lift a score quickly.
Pick one process
Choose the repeated, rule-bound process that costs most. Do not start with the most complicated one.
Agree what a person approves
Write down which steps need approval before an agent touches money, customers or records.
Ask for a written scope
Send us your result with a short description. We reply with a scope that names the tools, approvals and success measure.
Questions answered
How long does the audit take?
Do you store my answers?
Do I need to give my email?
What does a good score mean?
What if my score is low?
Is this a security or compliance audit?
Which framework is behind the questions?
Can you help me act on the result?
Sources
- AI Risk Management Framework (NIST), accessed 2026-10-12. Names the four core functions Govern, Map, Measure and Manage.https://www.nist.gov/itl/ai-risk-management-framework
- LLM06:2025 Excessive Agency (OWASP Gen AI Security Project), accessed 2026-10-12. Why approvals and least privilege matter before an agent acts on systems.https://genai.owasp.org/llmrisk/llm062025-excessive-agency/
- Building effective agents (Anthropic), accessed 2026-10-12. Why to start simple and keep human checkpoints.https://www.anthropic.com/engineering/building-effective-agents
How we checked this page
What we checked
- The scoring was tested by hand with all-zero and all-three answers (0 and 100) and mixed answers.
- The three public sources were opened and read on the access date.
What we could not verify
- The questions and bands are our own judgment and have not been validated against outcomes.
- The check does not look at your actual systems or data.
Send your result with a request
Press the button under your result to add the summary here, then tell us what you want to improve.
