Three weeks out

Three weeks out. A government tender closes, and one section asks how the company governs its AI. Or the certification audit is booked. The team has a policy, a risk register and a folder of documents, and no real idea whether any of it would hold up. Three weeks is long enough to find the gaps and too short to fix them properly. What usually follows is a scramble: documents written to fit the question, and controls that exist on paper first.

A readiness assessment is how you avoid being there. It traces a framework end to end, whether that’s ISO 42001 or Australia’s six essential practices for AI adoption (AI6). It runs from leadership and roles, through context, risk and impact assessment, to controls, monitoring and improvement. It reads every part against your organisation’s context and checks that they hang together. In effect, it’s a preview of what an audit would find.

But it isn’t an audit, and the differences are the point. A certification auditor has to stay independent, so they can tell you what they found but not how to fix it. A readiness assessment can do both. It can also work at different thresholds of evidence. Where an auditor needs proof, an assessment can start with how things actually work and what you intend, and explore it with you. Questions become conversations about why something should be the way it is, not only whether you can show it.

That’s the part people underestimate. Being ready isn’t only having the evidence. It’s understanding why the framework asks what it does, well enough to make your own calls and defend them. That’s the auditor’s mindset, and once a team has it, the management system becomes something they run rather than something they prepare for once a year.

What you get is practical: findings graded by how much they matter, and clear implementation guidance. That covers what to do first and what can wait, the resourcing it needs, the risks in implementing it, and strategies that suit how your organisation works. Where it helps, it includes building the capability in your own team, so you aren’t dependent on outside help.

Anyone who has shipped software knows that the cost of fixing something rises the later you find it. Governance works the same way. A gap found during design is a conversation. Found in an audit, it’s a nonconformity with a deadline. Found by a regulator or a journalist, it’s something else again.

Done early, a readiness assessment lets you implement at a pace that suits you, in an order that makes sense, rather than retrofitting under pressure when it’s late and expensive.

If three weeks out is somewhere you’d rather not be, a readiness assessment is the place to start.