Lesson 3 · 22 min
The AI audit is the most effective service for getting into a company that has never heard of you. The client walks away with a document they keep, show to their partner, and use to decide: what AI the company already uses, what risks that brings, and what to do in the next 30 days. And it starts before the first question, with written authorization.
Start the lesson
Goal: conduct an AI audit with written authorization, an inventory of apps and agents, risks, and a report with a 30-day plan.
One agreement and four steps, always in this order. Click each one.
The audit doesn't end with itself: it generates the sales that follow, the fix, and the training.
What to do and the common mistake in each one.
Run the research prompt with the company name in a variable: change one line and reuse the text dozens of times.
Look for the assumption markers. If there are none, the model is presenting a guess as fact.
IT lists what it bought. Employees use extensions, chatbots on personal accounts, and recording apps that nobody approved: that's shadow AI.
A short internal survey ("how do you use technology at work?") reveals what the official list hides.
Use a form only when the client came to you. If you were the one who reached out, asking for homework before proving value kills the conversation.
Data: customer records in an open spreadsheet or going to a vendor with no contract. Permissions: an agent that sends, deletes, or gives discounts without approval. Keys: a password or access key visible in the code or shared around.
Each drafted fix says what would stay manual. "Nothing, everything automated" is a fantasy.
With the 7-part structure, you can answer the "and what do I get at the end?" question by email.
Write by dictating: say what you concluded, transcribe it, and ask the assistant to structure it. Your real opinion stays in the text.
The form comes first. You run the prompt before the meeting. You fill in the inventory and the report during and after.
SCOPE AND AUTHORIZATION FORM · AI AUDIT Company: <legal name> Date: <mm/dd/yyyy> Authorized by: <name, title> Auditor: <your name> WHAT IT IS: assessment and triage of AI risks. WHAT IT IS NOT: it is not a pentest, nor incident response, nor legal advice. WHAT I WILL LOOK AT - Inventory of AI apps, agents, integrations, and tools in use - What data each one accesses and where it sends it - Permissions: what each one can do on its own - Where access keys and passwords are kept (without copying them) WHAT I WILL NOT DO - Try to break in, test attacks, or take down any system - Copy, store, or take away customer or employee data - Change any configuration without a written request ACCESS: <screens, documents, people I will interview> PERIOD: from <date> to <date> DELIVERABLE: report with inventory, risks, and a 30-day plan Signature of the person authorizing: ______________________
You are an AI auditor preparing the first meeting with a company. EMPRESA = <company name> SITE = <website address> SETOR = <industry, if you know it> Search the web and return, in this order: 1. PROFILE: what the EMPRESA sells, to whom, apparent size, how it wins customers. 2. WHERE AI OR AUTOMATION IS ALREADY VISIBLE: bot on the website or on WhatsApp, forms, order app, customer area. Say where you saw it. 3. PAIN HYPOTHESES: 6 processes that companies like this do by hand. 4. RISK HYPOTHESES: for each item in step 2, what data it probably accesses and what it could do on its own. 5. QUESTIONS FOR THE MEETING: the 10 that only the owner can answer and that would change your conclusions. Mark with [ASSUMPTION] everything you inferred without a source. Do not invent numbers. Do not try to access restricted areas: only what is public.
AI INVENTORY · <company> · <date> | item | purpose | who uses it | data it accesses | can do on its own | where the key is kept | owner | official? | |------|----------|----------|------------------|--------------------|-------------------|------|----------| | <e.g., WhatsApp agent> | <sales> | <customer service> | <conversations, customer records> | <create order, discount> | <vendor dashboard> | <name> | yes | | <e.g., email summary extension> | | | | | | | no (shadow) | RISKS (one per line, with evidence) - DATA: <what leaves, where it goes, where you saw it> - PERMISSIONS: <what acts without approval, where you saw it> - KEYS: <where they are exposed or shared, where you saw it>
AI AUDIT REPORT · <company> · <date> 1. GOALS AND SCOPE What the company considers a priority, in its own words. Assessment and triage of AI risks; it is not a pentest, nor incident response, nor legal advice. 2. INVENTORY: apps, agents, integrations, and shadow AI, with an owner. 3. SYSTEMS AND DATA: what has an integration point, what doesn't, where the data is messy. 4. RISKS WITH EVIDENCE: data, permissions, and keys, from the most severe to the least severe. 5. TEAM READINESS: how open the team is to change. 6. PRIORITIZED FIXES AND OPPORTUNITIES: return on effort, with the math shown and what stays manual. 7. 30-DAY PLAN AND NEXT STEPS Week 1: <quick win> Week 2: <...> Week 3: <...> Week 4: <...> Later (60 and 90 days): <what comes next> 30-minute follow-up session: <date>
The audit is also your filter. And honesty is what closes the deal.
The same information written five different ways, duplicate records, a field nobody can explain.
Sell the data-organizing service first: less glamorous, more of a sure thing.
Say how much the workaround costs. If the client won't accept it, decline: blocked access eats up weeks through no fault of yours.
The team avoids detailing how they work, afraid of being replaced, or nobody below the owner was told.
Propose training before automation: people who have learned to use it stop sabotaging it.
Can't yet generate meetings on your own? The free audit is your way in and your practice. Already have a repeatable process and the client came to you? Charge.
At the end, educate without locking in: say where this kind of project usually goes wrong, even if they carry it out with someone else.
If you carry out this plan with another company, that's fine. Pay attention to these five points: that's where this kind of project usually goes wrong.
Horizonte is a fictional company of 40 people, with study AI pieces. Everything there is fake, and on purpose.
Fill out the scope and authorization form for Horizonte, with the owner (Carlos Mendes) as the person who authorizes. Then read aloud the sentence about what the audit is not.
Done when: the form has who authorizes, what you will look at, what you will not do, period and deliverable, and the sentence "it is not a pentest, nor incident response, nor legal advice" is written down and was said out loud.
Open the IT inventory and the lab pieces. Build the inventory with the template, including the tools that show up only in the internal survey. Name one data risk, one permissions risk and one keys risk, each with where you saw it. Close with the 30-day plan.
Done when: the inventory has every piece with an owner and the official/shadow mark; there are 3 risks (data, permissions, keys) with evidence; and the 30-day plan has one task per week. Finding all the planted flaws is left for the Auditor program.
5 questions. The explanation appears after your attempt.
Question 1 of 5
The company owner says "you can look at everything, make yourself at home" over the phone. What do you do before opening any system?
Question 2 of 5
IT's official list has 8 tools. Why does the inventory not stop there?
Question 3 of 5
An agent creates orders and grants discounts without anyone approving. Which of the three risks does this fall under first?
Question 4 of 5
In the audit meeting, what sets you apart the most?
Question 5 of 5
The client's data is in five spreadsheets with the same field written in different ways. What comes first in the 30-day plan?
Pick one option. The explanation shows up after you try.