ViitorCloud
Home / Resources / Playbook

The Enterprise AI Readiness Audit, in five gates.

Three out of four enterprise AI projects fail to deliver intended ROI (2026 McKinsey, RAND, MIT NANDA). Almost none of the failures are technical, programs ship a model and stall on data, governance, security, evaluation, or handover. This is an audit you run before the build. Each gate is binary.

Playbook / ChecklistAuthor: Vishal Shukla, VP of TechnologyBFSI · Healthcare · Public SectorRelevant to: AI Security · AI Copilots · Data
Key takeaways
3 of 4 enterprise AI projects miss intended ROI; the failures are operational, not technical.
Run the audit before the build; each gate is binary, pass, or don't start construction.
Most enterprises fail at least two gates on the first run.
Best run by a cross-functional team: AI program owner, CISO, data owner, compliance lead, executive sponsor.
Fix order: data first, security second, governance third, evaluation fourth, handover fifth.
The audit

Five gates. Pass, or don't start construction.

Gate 1
Data Readiness

Does the organization have data an AI system can be trained on, evaluated against, and trusted in production?

Pass criteria
Source data identified, named, owned
Data quality measured, not assumed (Gartner: only 12% of orgs have data clean enough for production AI)
Sensitive fields tagged at column level
Lineage traceable within one business day
A ground-truth set exists, business-owned
Common failure
Fails on lineage or ground-truth (criteria 4 or 5).
If you fail
Stop; run a focused data foundation engagement first.
Gate 2
Security Boundaries

Will the AI system satisfy your security posture and sector regulatory regime?

Pass criteria
Threat model written down: prompt injection, model extraction, training-data poisoning, exfiltration named
Framework alignment mapped as a gap document: NIST AI RMF, ISO 42001, OWASP LLM Top 10, EU AI Act, HIPAA, DORA, SEBI
Access control at API and data layer
An adversarial test plan exists
A named owner for security operations after launch
Common failure
Threat model and mapping become zombie artifacts.
If you fail
Bring in an AI Security Review before the build.
Gate 3
Model Governance

When a decision is questioned, can you defend it?

Pass criteria
Explicit risk classification
Named model approval gates in the SOW
Decision logging from day one: input, model version, output, confidence, reasoning chain
Bias and fairness testing part of the build
An AI-specific incident response playbook
Common failure
Decision logging bolted on and incomplete.
If you fail
Bring governance work to the front of the build.
Gate 4
Evaluation Infrastructure

How will you know the model is working, and how fast will you know when it stops?

Pass criteria
A version-controlled ground-truth set, business-owned
An automated evaluation harness on every change plus scheduled runs
Production monitoring at three levels: accuracy, input drift, output drift
Hallucination rate measured, under 3% on monitored queries is a defensible benchmark
Evaluation infrastructure owned by your team after the build
Common failure
The harness atrophies post-launch.
If you fail
Build the evaluation infrastructure first, then the model.
Gate 5
Operational Handover

On the day the build partner leaves, can your team run the system?

Pass criteria
A named internal operator with budget from day one
An operations runbook that exists and has been used
A team trained against the actual system during the build
A defined exit for the build partner
A system operable without the build partner
Common failure
Fails silently, no one to call six months later.
If you fail
Do not start the build.

A failed gate is a finding, not a verdict.

Produce a remediation plan, named owner, scope, timeline, budget, and complete it before the build starts. ViitorCloud runs a version of this framework on the front of every enterprise AI engagement, included at no additional cost. Standards cited: NIST AI RMF, ISO/IEC 42001, OWASP LLM Top 10, EU AI Act, HIPAA, DORA, SEBI.

PDF

Get the 6-page playbook

The full checklist with pass/fail criteria per gate, ready to run with your cross-functional team: AI program owner, CISO, data owner, compliance lead, executive sponsor.

Not sure your program clears the gates?

A senior practitioner will run the audit with you before the build starts.