AI Governance
& Risk Audit
A fixed-price, structured external review for Australian organisations adopting AI and wanting a clear view of governance gaps, unmanaged risk, and what needs attention before commitments deepen.
The AI Governance & Risk Audit is an independent diagnostic review of AI usage, governance practices, operational workflows where AI tools appear, and decision risk. It is an advisory service and does not constitute a statutory audit, legal advice, or regulatory certification.
AI tools are in use.
Governance is not.
In most Australian organisations, AI adoption is happening informally. Staff are using public AI tools without oversight. Confidential data is being entered into third-party systems. There is no policy, no governance structure, and no senior person with a clear view of what is actually occurring.
Leaders face real uncertainty about their governance responsibilities and are under pressure to adopt AI faster than their risk frameworks can absorb. The result is tool sprawl, shadow IT, and decisions being made without the information needed to make them well.
Most organisations do not know the extent of their AI exposure until someone asks the right questions. That is what this audit does.
A structured diagnostic.
Not open-ended consulting.
The AI Governance & Risk Audit is a productised professional service with defined scope, defined deliverables, and fixed pricing. It is not an open-ended engagement, a retainer, or a consulting relationship.
It is a structured diagnostic informed by governance principles referenced in the AICD AI Governance Checklist for SME and NFP Directors, applied to your organisation's specific AI context, operational workflows where AI tools appear, and current usage patterns. It surfaces gaps, identifies risk exposure, and produces a clear picture of what needs attention.
What you receive at the end is practical and actionable. Not a report designed to generate follow-on work.
This service is based on thirty years of implementing technology in operational environments, including seven years as a Chief Information Officer in large-scale organisations. That background includes direct responsibility for technology governance, risk oversight, and decisions of exactly the kind this audit addresses.
The audit is informed by governance principles referenced in the AICD AI Governance Checklist for SME and NFP Directors, applied within the Australian privacy and governance context. It is designed for organisations that do not have a large internal technology team and need a structured external view rather than a vendor recommendation.
Defined deliverables.
A brief call to confirm fit and scope before any commitment is made. No charge.
A structured deep-dive covering AI tool usage, governance structures, data handling, and current risk exposure.
A structured assessment of your organisation's AI risk profile across governance, data, operations, and policy dimensions.
A prioritised set of actions based on the audit findings. Practical and specific to your organisation.
A customisable policy template for governing AI tool use within your organisation.
Three steps.
Intro call
A 15-minute call to confirm the audit is the right fit and to agree scope and pricing tier. No commitment required.
Audit and review
A 90-minute structured discovery call followed by analysis informed by the AICD AI Governance Checklist, your specific operational context, and the workflows where AI tools appear.
Delivery
Risk scorecard, strategic action plan, and responsible AI usage policy template delivered within the agreed timeframe.
Clear pricing. No surprises.
Tier is based on organisation size and AI tool complexity, confirmed during the intro call. All tiers include the same core deliverables.
SME Starter
Sole traders and small businesses with limited AI tool usage and a straightforward operating structure.
SME Standard
Small to medium businesses with multiple departments and moderate AI tool adoption.
SME Advanced
Larger SMEs and NFPs with more complex operations, multiple stakeholders, and broader AI tool exposure.
Custom
Organisations with complex governance structures, multiple entities, or specific requirements outside the standard tiers.
All prices AUD, excluding GST. Includes all deliverables listed above.
Who this is for.
- Australian SMEs and NFPs adopting AI tools or evaluating AI adoption
- Leaders who want an independent governance view before committing further
- Organisations with unmanaged AI tool usage and no current policy
- Boards and directors seeking a clear pre-commitment risk picture
- Businesses seeking a review informed by AICD director governance principles
Who this is not for.
- Organisations outside Australia (this service is Australia-specific)
- Those seeking legal advice, compliance certification, or tax guidance
- Organisations wanting AI implementation, development, or software services
- Businesses looking for a retainer or ongoing consulting arrangement
Scope
This service is designed for Australian organisations and is informed by governance principles referenced in AICD materials and the Australian privacy context. It is not structured for non-Australian regulatory environments.
Frequently asked.
Is this legal advice?
No. The AI Governance & Risk Audit is a structured diagnostic service. It is not legal advice, compliance certification, or financial advice. If your organisation requires formal legal or compliance guidance, engage appropriately qualified professionals.
Is this implementation support?
No. The audit identifies governance gaps and risk exposure and produces an action plan. Acting on those findings is your organisation's responsibility. Zyrilium does not provide AI implementation or software services.
Is this only for Australian organisations?
Yes. The audit uses the AICD AI Governance Checklist as a reference point and is applied within the Australian privacy context. It is not structured for non-Australian regulatory environments and is not offered to organisations outside Australia.
How is the pricing tier determined?
Tier is confirmed during the intro call based on organisation size, AI tool complexity, and the number of stakeholders involved. The right tier is agreed before any commitment is made.
What do we receive at the end?
An AI risk scorecard, a strategic action plan, and a responsible AI usage policy template. All delivered within a defined timeframe agreed at the start of the engagement.
The AI Governance & Risk Audit provides observations and recommendations based on the information available at the time of review. It does not certify compliance with any regulatory framework.
Book a 15-minute intro call.
The intro call is free and without obligation. It is a brief conversation to confirm the audit is the right fit and to determine the appropriate tier.
This is not legal advice, financial advice, or an implementation service. Designed for Australian organisations only.