What an AI agent audit should check
The audit should prove whether the workflow is ready for an agent, not just whether a demo can produce impressive output.
1. Workflow repeatability and frequency
Start with work that happens often enough to matter: stale lead follow-up, CRM cleanup, quote preparation, inbox triage, website checks, content refresh preparation, weekly reporting, or internal knowledge answers. Ask what triggers it, who performs it, and what happens when it is delayed.
2. Data sources, source-of-truth issues, and access permissions
Name the approved records, documents, pages, CRM fields, folders, SOPs, and decisions the agent can rely on. Flag messy, outdated, private, or uncontrolled information. If this is the main concern, use the AI Data Access Audit NZ and AI Data Readiness Checklist.
3. Human approval gates
Identify every action that needs a person before consequences happen. Approval gates belong around emails, DMs, CRM changes, pricing, quotes, customer promises, public publishing, finance, sensitive records, legal language, and privacy decisions. Use AI Approval Gates for Business Automation for deeper rules.
4. Integration points across business tools
List every system the workflow touches: CRM, inbox, CMS, forms, calendars, files, spreadsheets, dashboards, quoting tools, or project software. Decide whether the agent may read, draft, update, send, publish, delete, or only prepare work for review.
5. Risk level and business impact
A workflow with customer impact, private information, brand risk, commercial sensitivity, or high-volume output needs stronger controls. Name what could go wrong, who would notice, how to pause, and what evidence would be reviewed.