What a readiness assessment actually checks

Thesis

A readiness assessment isn’t a gap checklist. It tests whether the management system hangs together: that the evidence exists, that the documents agree with each other, that the people involved are competent, and that the answers survive follow-up questions.

Reader

A founder or CTO with a tender or certification date in view; an NfP board wanting independent assurance.

Beats

1. Existence: does the process exist, is it followed, and does top management understand what it signed?
2. Consistency: risk register, impact assessment, Statement of Applicability and management review checked against each other (pieces 6 and 7).
3. Context: does the scope follow from 4.1 to 4.3 (piece 1)?
4. Proportion: is depth argued from the system’s risk (piece 4)?
5. What you get: findings graded as nonconformities and opportunities for improvement, and a prioritised plan.

Honest framing

This prepares an organisation; it doesn’t certify one. Certification is a certification body’s job. Credentials are described as trained, not registered, until registration.

Offer

Fixed-scope readiness assessment, and the routes beyond it: fractional AI lead, internal audit, governance clinic. Link to the offers page.

What you can do on Monday

Ask whoever owns your AI policy to explain one conclusion in it and what informed it. If the answer is thin, so is the system.