An audit checks you against criteria that already exist. A readiness assessment finds what is missing before anyone checks. That is the difference, so the sequence runs one way: assessment, then fix, then audit.
The harder news is that most companies asking need a third thing. If you already pay for AI licenses and somebody has asked what the money bought, both engagements on offer will inspect your data, your permissions and your governance. Neither tells you whether your people can use the tools, which is usually the part that is not ready.
The two words, as a vendor uses them
Three contrasts do the work, and most buyers have forgotten them by the second proposal.
| Readiness assessment | Audit | Capability read | |
|---|---|---|---|
| Question it answers | Are we in a position to do this? | Does what we claim hold up? | Can our people do the work with these tools? |
| Direction in time | Forward, before spend | Backward, over what already runs | Present, over current work |
| Criteria | Chosen by the assessor | Fixed in advance, written down | Tasks your team does weekly |
| Output | Scored gaps and a plan | Findings against each criterion | A before-and-after on real tasks |
| Who can run it | Anyone, including you | Someone independent | You, or you with a vendor |
| Typical length | 2 to 5 weeks | 1 to 3 weeks of fieldwork | A baseline week, then repeat |
Nobody markets the third column. It is what you were trying to buy when you started searching, and naming it is how you avoid paying for the first column by mistake.
One more distinction worth keeping: an assessment can be wrong and still be useful, because it is a judgment about your position. An audit that is wrong has failed at its job. That higher bar is why it costs more and why fewer firms can honestly offer it.
Where these words have fixed meanings
The market treats both terms as marketing. In assurance work they are defined, and the definitions are short enough to use as a test.
ISO 19011:2018, the standard for auditing management systems, defines an audit as “the systematic, independent and documented process for obtaining objective evidence and evaluating it objectively to determine the extent to which the audit criteria are fulfilled.”
Three words carry that sentence. Systematic: a planned scope, not a tour. Independent: the checker did not build the thing. Documented: a record someone else could follow. One phrase carries the rest: audit criteria, requirements written down before the auditor arrived.
There is a real AI standard to audit against. ISO/IEC 42001, published in December 2023 as the first AI management-system standard, certifies on the same two-stage route as ISO 27001: Stage 1 reviews whether the design and documents are ready, usually in a day or two, and Stage 2 tests whether the controls work in practice, over one to three weeks. Annual surveillance follows, with recertification every three years.
Note what Stage 1 does: it reviews readiness. In the one place where both words are defined, a readiness assessment is not a rival to an audit. It is the first gate of one.
The other framework you will hear named works differently. NIST’s AI Risk Management Framework 1.0, released on 26 January 2023 with its Govern, Map, Measure and Manage functions, is “intended for voluntary use.” Nobody certifies against it, so a firm offering to audit you against NIST is selling an assessment at audit prices.
The test for any proposal, whatever its title: what are the criteria, where are they written, and is the checker independent of the work? Three answers, or it is an assessment. No insult in that. It is a reason not to pay audit prices for one.
Why the market swaps them freely
Because the words sell to different buyers and the work underneath is often the same. “Audit” sounds rigorous and finite, which plays well with a CFO. “Assessment” sounds developmental, which plays well with an operations lead who does not want a verdict on the file. Several firms publish both pages and deliver one engagement.
You can watch it happen in published pricing. Pertama Partners’ pricing guide, updated 17 June 2026, lists AI readiness audit bands of SGD $15,000 to $35,000 for under 100 staff and SGD $40,000 to $85,000 for 100 to 1,000. Those are Singapore-dollar figures weighted to that market, so read them as structure, not as your quote. The page calls the engagement an audit throughout, scopes it as a forward-looking readiness exercise, and never draws the distinction.
Search the question and most of what comes back is agency blogs, two of which carry figures I could not trace to any published document: 59% of companies hitting data-governance incidents without a prior assessment, credited to Gartner, and 73% fewer oversharing incidents, credited to Microsoft. If a proposal quotes either at you, ask for the citation first.
The read neither engagement includes
Read the scope sections of the readiness products on sale and the pattern shows fast. Data quality and ownership. Integration surface. Permission hygiene. Process mapping. A change-management section, three paragraphs long, asking whether leadership is aligned.
Not one measures whether a person on your team can take a task they do every week and get a better result with an assistant than without one.
The blind spot is historical rather than lazy. This diagnostic was built for companies planning to build AI systems. RAND’s study of why those projects fail, from interviews with 65 data scientists, reports five root causes cited by 84% of them: the problem was misunderstood, the data was not there, the team chased technology over user needs, the infrastructure could not deploy the result, or the task was beyond what the field can do. Four of the five are build-side.
That fits a company training a model. It does not fit a company that bought 200 seats and wants to know why 40 people use them. For the second, those five questions return a clean bill of health and explain nothing.
The gap shows in the adoption numbers. McKinsey’s November 2025 State of AI survey found 88% of organizations reporting regular AI use in at least one function, while only about 39% could point to any enterprise-level EBIT impact. Gallup’s workforce tracking put frequent AI use at work, meaning a few times a week or more, at 26% of US employees in the fourth quarter of 2025 and near 30% by May 2026. Access is close to universal. Use is not. An infrastructure review cannot see that gap, because the infrastructure is fine.
We run hands-on fluency sessions for teams in this position, and the pattern in the room holds: the blocker is rarely the data and almost never the permissions. Nobody has shown this person how to get a usable first draft out of a tool, on the document in front of them, due today. A paid seat is not a capability, and no report converts one into the other.
Which one you need first: four starting positions
Find yours. The answer is different in each, and in two of the four it is neither product.
1. You have bought licenses and cannot show a return. You need the capability read, this quarter. Baseline a week of real tasks, train a cohort, measure again. The measurement playbook sets out which AI enablement metrics to take, and in what order. A readiness assessment here tells you that you are ready for the thing you already did.
2. You are about to build or buy an AI system that touches customer data. You need a readiness assessment, and the data-and-governance scope these reports emphasize is the right one. Here the build-side root causes are live risks, and a five-figure diagnostic that stops a six-figure mistake has paid for itself.
3. A customer, insurer or regulator has asked for evidence. You need an audit, against named criteria, by somebody independent. If the ask is ISO/IEC 42001 certification, the route is defined and starts with a gap review against the standard. A generic readiness report will not satisfy the request: no criteria, no independence, no findings.
4. Somebody senior asked whether you are ready and nobody has a number. You need an internal read, not a purchase. One afternoon, three questions: who uses these tools weekly, on which tasks, and what did those tasks take before. If you cannot answer the third, that is your finding, and it is what any paid engagement would reach in week two at far greater cost.
In position 3, or position 2 with regulated data, buy the engagement. For the other two: internal read, then a trained cohort, then a paid diagnostic only if the first two surface something you cannot fix yourself. Most companies at 50 to 500 staff never reach that third step, which is the honest version of this advice and not the profitable one.
What each one costs
Market ranges, not quotes, and the spread is wide because the word on the invoice does not fix the scope.
A scored readiness report with an interview round and a written plan runs roughly $15,000 to $50,000 at mid-market size. A conformity audit against a published standard costs more and adds a certification-body fee, because independence and documented evidence are expensive to produce. A capability read, run in-house, costs ten to thirty hours of internal time. Hands-on team sessions sit in the $2,000 to $15,000 band in the current market depending on depth and cohort size, with automation work afterward in a separate band of roughly $25,000 to $150,000.
Rank those with the denominator from the cost-per-head versus cost-per-hour-saved comparison and the result is unflattering to the report. A $35,000 diagnostic returns no hours. It can still be the right buy, in positions 2 and 3, because it buys a decision or it buys evidence. What it does not buy is capacity, and the proposal will not say so.
One line to add to any scope you sign: name the deliverable and name who may rely on it. “Report” is not a deliverable. “A findings register against each control, with evidence references, that our insurer will accept” is.
What neither can tell you twelve months later
This is the part that should decide your sequence, and no vendor raises it.
Neither engagement captures a before-state of how your work gets done. Both capture the state of your systems. So when next year’s question arrives, and it arrives as “did any of this work,” the report in the drawer cannot answer it. It described a starting position, not a measurement you can repeat.
A baseline does answer it, and it is cheap. Pick six tasks people do weekly, time them, keep the output. One week of light effort, and the only artifact that lets you make a claim later. Build it before any engagement starts, or the engagement becomes the thing you have evidence of instead of the change.
Then expect decay. Saks and Belcourt’s study of 150 organizations, published in Human Resource Management in 2006, found about 62% of training content applied right after training, 44% at six months, and 34% at a year. Applied skills fade, the tools change under the user, and one report in January shows neither. If AI training ROI is the question being put to you, a model your finance team cannot dismiss is what to build, and the payback-period question is the next one down.
Frequently asked questions
What is the difference between an AI readiness audit and an AI readiness assessment?
An audit compares evidence against criteria written down before it started, by someone independent of the work. A readiness assessment finds the gaps between where you are and where you want to be, and the assessor usually picks the criteria. The market uses both words for the same forward-looking engagement, so ask what the criteria are, where they are written, and who is independent of them.
Which one should I run first?
Assessment, then fixes, then audit, if you need an audit at all. That is the sequence in standards practice: ISO/IEC 42001 certification starts with a readiness review of your design and documents before anyone tests whether the controls work. Running the audit first buys a list of failures you already knew about, at a higher hourly rate.
Do I need either one before rolling out AI tools to staff?
Not usually, at 50 to 500 staff with commercial assistants and no customer-data integration. A rollout needs a permission check on your document stores and a baseline of the tasks you expect to get faster. If it feeds AI systems with customer or regulated data, a readiness assessment scoped to data and governance earns its fee.
How long does each one take?
A scored readiness assessment runs two to five weeks at mid-market size, mostly interviews and document review. Certification audit fieldwork runs one to three weeks across the two stages, after your fixes are done. A capability read takes a week to baseline and a day to repeat, which is why it is the one to start with.
What does an AI readiness assessment cost?
Expect roughly $15,000 to $50,000 for a mid-market engagement with interviews and a written plan, with wide variance by scope and firm. One consultancy’s published band is SGD $40,000 to $85,000 for 100 to 1,000 staff over three to five weeks. Free self-scoring tools are fine for a first look, as long as the score is a conversation starter and not a finding.
Can we run the assessment ourselves?
Yes, and for the capability question you should, because you see the work an outsider cannot. Self-assessment cannot stand in for an audit, since independence is part of the definition. Use the internal version to decide whether you need to buy anything at all.
What should the deliverable contain?
Name it in the scope before you sign. A readiness deliverable needs a scored current state, a ranked gap list with an owner per line, and a plan with dates. An audit deliverable needs a findings register against each criterion, an evidence reference per finding, and a statement of who may rely on it. “A report and a presentation” is not a deliverable.
Does the EU AI Act require one of these?
No. Article 4 has applied since 2 February 2025, and the Digital Omnibus rewrite effective 27 July 2026 frames the duty as taking measures that support AI literacy among staff who work with these systems. That is a training duty with a paper trail, not an audit requirement. The evidence it asks for is a record of who was trained, on what material, and when.
We already had an assessment and nothing changed. What now?
Go straight to the capability read and treat the report as context, not a plan. The usual failure is that it listed gaps nobody owned. Pick one cohort and one set of weekly tasks, baseline them, train on the team’s own documents, and re-measure at 30 days. One moved number beats a second diagnostic.
Where to start
Open whichever proposal is on your desk and find three things: the criteria, the independence statement, and the deliverable. If the criteria are the vendor’s own framework and the author also wrote the fix list, you are buying an assessment. Price it as one.
Then spend a week measuring six weekly tasks before you sign. If “are we ready” is being asked at all, somebody will soon ask “did it change,” and that week is the only cheap way to have an answer.
For a second read on a proposal you are holding, or on which of the four positions you are in, a free AI-readiness call is a direct way to get one. We deliver the hands-on fluency programs these reports are written to justify, and we will say when the right next step costs nothing.
Dirk Jan van Veen, PhD
