What Does an Automation & Technology Readiness Assessment Include?

An Automation & Technology Readiness Assessment should answer two leadership questions at the same time:

1. Where can better process design, automation or AI create measurable business value?
2. What must be true for the justified intervention to be implemented responsibly and at scale?

If an assessment only produces a maturity score, it is incomplete. If it only produces a long list of use cases, it is also incomplete.

A useful assessment connects business priorities, workflows, data, technology, governance and organisational capability to a prioritised roadmap.

Why organisations commission an Automation & Technology Readiness Assessment

Typical triggers include:

• leadership wants a defensible automation or AI investment sequence but does not know where to start;
• departments are experimenting independently;
• several AI vendors are proposing different solutions;
• pilots exist but are not reaching production;
• employees are using unsanctioned AI tools;
• risk and technology teams are concerned about governance;
• the organisation wants to invest, but needs a defensible sequence.

The assessment creates a shared evidence base before the organisation commits significant budget.

The Abrasim assessment structure

We structure the work around five stages:

Scope → Baseline → Opportunities → Prioritise → Roadmap

The exact depth depends on the organisation, but the logic should remain consistent.

1. Scope the business questions

The assessment starts with leadership priorities, not a model catalogue.

Useful questions include:

• Where is growth constrained?
• Which workflows consume disproportionate skilled time?
• Where do customers experience delays or inconsistency?
• Which decisions are slowed by fragmented information?
• Which processes have high rework or error rates?
• Where is knowledge difficult to find or reuse?
• Which business capabilities need to scale without equivalent headcount growth?

The scope should also establish which business units, geographies, systems and risk categories are in view.

Without a clear scope, a readiness assessment turns into an organisation-wide technology brainstorming exercise.

2. Establish the current baseline

Before designing an AI future state, understand how the organisation works today.

The baseline typically covers six readiness dimensions.

Value

Are business outcomes and performance measures clear?

Workflow

Are priority processes understood well enough to redesign?

Data

Is the necessary information available, usable and governed?

Technology

Can AI capabilities integrate safely into existing systems?

Governance

Are accountability, access, monitoring and human-control requirements understood?

Capability

Does the organisation have the ownership, skills and change capacity to operate what it builds?

These are explained in more detail in AI Readiness: The 6 Things a Business Needs Before Scaling AI.

3. Discover AI opportunities through workflows

Opportunity discovery should not ask employees only:

Where would you like AI?

That tends to produce ideas shaped by whatever tools people recently saw demonstrated.

Instead, analyse real workflows.

For each process, identify:

• triggers;
• inputs;
• repetitive tasks;
• information retrieval;
• synthesis;
• decisions;
• handoffs;
• exceptions;
• controls;
• outputs.

Then consider a range of interventions:

Remove

Can unnecessary work disappear entirely?

Simplify

Can the workflow be redesigned before technology is added?

Automate

Can deterministic work be handled by conventional automation?

Augment

Can AI help a person research, draft, classify or decide?

Agent

Can a governed AI system perform a sequence of tasks and tool calls under defined controls?

This prevents the assessment from recommending AI where a simpler intervention would be better.

4. Prioritise opportunities

Not every valid use case deserves funding now.

Abrasim evaluates opportunities through four lenses:

Business value × Feasibility × Risk × Learning value

See the full AI use-case prioritisation framework.

Typical outputs are grouped into:

Act now

High-value opportunities with enough readiness for a controlled pilot or implementation.

Enable first

High-value opportunities blocked by data, integration, process or governance gaps.

Learn cheaply

Lower-risk opportunities that can build reusable capability and evidence.

Park

Ideas with weak economics, disproportionate risk or no meaningful business owner.

A credible assessment should reduce the opportunity list, not merely expand it.

5. Build the roadmap

The roadmap connects opportunities to the capabilities required to deliver them.

It may include:

• priority pilots;
• workflow redesign;
• data-quality work;
• integration requirements;
• identity and access controls;
• AI governance standards;
• evaluation methods;
• staff enablement;
• platform decisions;
• monitoring;
• change management.

The sequence matters.

If five use cases require the same knowledge-retrieval layer or secure model gateway, that shared capability may deserve investment before separate departmental solutions are built.

What should the assessment deliver?

Leadership should receive decision-ready outputs.

Executive findings

A clear summary of where value exists, the main readiness constraints and what leadership needs to decide.

Readiness baseline

Evidence across the six readiness dimensions rather than one unexplained maturity score.

Workflow and opportunity map

The business processes reviewed and the interventions identified.

Prioritised use-case portfolio

Each opportunity with rationale, expected value, feasibility, risk and dependencies.

Governance requirements

Controls and ownership required for the priority use cases.

Technology and data implications

What must connect, change or become available.

Roadmap

A practical sequence for pilots, enabling work and scale.

Measurement model

How the organisation will know whether value is being created.

What evidence should be collected?

The best assessments combine leadership views with operating evidence.

Inputs may include:

• executive interviews;
• workflow workshops;
• process documentation;
• performance data;
• employee interviews;
• customer-journey evidence;
• data and system inventories;
• architecture documentation;
• governance policies;
• existing AI experiments;
• vendor contracts;
• analytics and operational reports.

The purpose is to compare what the organisation believes happens with what actually happens.

How should AI risk be handled?

Risk should influence prioritisation from the beginning.

NIST’s AI Risk Management Framework provides a useful cross-sector structure around governing, mapping, measuring and managing AI risk.

For individual use cases, practical controls may include:

• human review;
• restricted tool permissions;
• protected data boundaries;
• logging;
• evaluation datasets;
• confidence thresholds;
• escalation paths;
• output monitoring;
• supplier due diligence.

The appropriate control depends on what the AI is allowed to do and the consequence of being wrong.

South African context

South African organisations operate in a developing AI policy environment while still needing to comply with existing obligations around privacy, employment, contracts, information security and sector-specific regulation.

Cabinet withdrew the 2026 draft national AI policy for rework. That uncertainty is not a reason to avoid internal governance.

It is a reason to build controls around actual risk rather than waiting for one final AI-specific law to define every operating decision.

How long should an assessment take?

There is no credible universal answer because scope varies significantly.

A single business unit with a narrow set of workflows is different from a multi-country organisation with legacy systems, sensitive data and multiple operating divisions.

The important question is whether the engagement is deep enough to produce evidence but focused enough to lead to decisions.

An assessment that takes months and leaves leadership with only a conceptual strategy has failed in a different way from a two-day workshop that declares the organisation “AI ready”.

How is this different from an AI workshop?

A workshop is useful for alignment and education.

An assessment is evidence-based.

A workshop may generate candidate use cases. An assessment validates, prioritises and connects those use cases to readiness, risk, dependencies and a roadmap.

Many organisations use a workshop as an entry point and then assess the most promising areas more deeply.

When should you not commission one?

An assessment may not be the first priority when:

• the organisation has no clear business problems it wants to improve;
• basic digital systems are not operating reliably;
• leadership is seeking a predetermined recommendation for a tool already purchased;
• there is no capacity to act on the findings.

The value of assessment comes from improving a decision.

If no decision will follow, the work becomes documentation.

What a good assessment changes

Before the assessment, the conversation often sounds like:

We need an AI strategy.

After a good assessment, it should sound more like:

These three workflows represent the strongest near-term opportunities. Two can be piloted now. The third requires a data-integration dependency. These controls are required. These are the baselines we will measure, and this is the shared capability we should build before scaling further.

That is the difference between AI enthusiasm and an investment plan.

How to run the assessment step by step

Step 1: Frame the value questions

Ask where growth, customer response, skilled capacity, quality, speed or risk is constrained. Name the sponsor, decision owner, business owner, affected people and investment decision. Do not start with a list of models, vendors or employee suggestions.

Output: an assessment charter tied to business and workflow outcomes.

Step 2: Inventory current AI use

Record approved and unapproved tools, embedded vendor features, proofs, automations, custom systems and manual workarounds. Capture owner, users, data handled, permissions, supplier, purpose, cost basis, evaluation method, incidents and operating status.

Output: a current-use register that makes shadow AI, duplication and unsupported production use visible.

Step 3: Map priority workflows

Observe work at the level of trigger, task, input, decision, handoff, exception, control and output. Measure available volume, cycle time, delay, rework, skilled effort and quality. Identify what should be removed or simplified before considering AI.

Output: workflow maps and evidenced constraints, not a brainstorm of use cases.

Step 4: Define candidate interventions

For each constraint, compare policy, process, conventional automation, analytics, retrieval, generation, prediction, augmentation and agentic coordination. State what the system would be allowed to read, generate, recommend or execute and where a person remains accountable.

Output: clearly bounded opportunities with non-AI alternatives.

Step 5: Assess readiness by use case

Evaluate value, workflow stability, data availability and permitted use, integration, identity, security, model or supplier fit, evaluation readiness, governance, adoption and operating ownership. Enterprise-wide maturity averages should not hide that different use cases require different controls.

Output: use-case readiness profiles and shared enabling dependencies.

Step 6: Model failure and consequence

Describe credible errors, unsafe actions, data exposure, bias, security abuse, supplier failure and human over-reliance. Identify affected people and processes, detectability, reversibility, escalation and residual risk. Route legal or sector assurance to qualified reviewers.

Output: a risk and control register connected to actual system permissions and consequences.

Step 7: Prioritise the portfolio

Score business value, customer value, feasibility, data readiness, integration, risk, operability and time to learning. Classify opportunities as act now, enable first, learn cheaply or park. Record why a high-interest idea is not ready.

Output: a ranked portfolio that leadership can fund selectively.

Step 8: Design proofs of value

For each selected proof, define the workflow boundary, users, baseline, evaluation dataset, quality threshold, human oversight, data controls, permitted actions, logging, cost envelope, success and guardrail measures, stop condition and production gate.

Output: proof designs that test value and risk rather than produce demonstrations.

Step 9: Sequence shared capability

Map data, integration, identity, procurement, policy, evaluation, monitoring, change and skill dependencies across the selected portfolio. Decide which capability should be shared and which should remain use-case specific.

Step 10: Make the investment decision

Leadership should approve specific proofs, enabling work, parked ideas and prohibited uses. Every decision needs a business owner, technical owner, risk owner and review date.

Expected result: a defensible investment sequence with governed proofs, explicit dependencies and evidence thresholds for production or scale. The assessment does not promise automation savings or model performance before those are measured in the organisation's workflow.

For the governance shared by all audit types, use How to Choose and Run the Right Business Audit.

Use the copy-ready governance and decision templates in the Leadership Audit Working Pack.

Sources and further reading

• NIST AI Risk Management Framework
• NIST Generative AI Profile
• OECD: The Adoption of Artificial Intelligence in Firms
• South African Presidency: withdrawal of draft AI policy