SAMPLE-AI-01 · FICTIONAL DATE 2026-01-12
Example Workshop Ltd · AI Readiness and Governance Review
Status: Fictional format sample · Domain label: example.test (reserved fictional domain; no real organisation) · Method: read-only review of supplied evidence; no live access.
Scope
Copilot readiness for a fictional pilot of 40 users: SharePoint sharing, sensitivity labels, 6 Copilot Studio agents and audit.
Executive summary
The pilot is not yet safe to widen. Several sites are open to the whole organisation, labels cover little content, and two agents have no owner and reach a finance library. Audit is on but retention is short and nobody reviews it.
Evidence reviewed
| ID | Source | Coverage | Status |
|---|---|---|---|
| E-01 | SharePoint site sharing report | 212 sites | Provided; metadata only |
| E-02 | Sensitivity label policy and label activity export | 4 labels, file counts | Provided |
| E-03 | Agent list export | 6 agents | Provided |
| E-04 | Audit configuration screenshot | Retention and search | Provided |
| E-05 | Pilot user list | 40 users | Provided; pseudonymised |
What was not checked
- Document content
- Third-party AI tools in use
- Individual user permissions at file level
- Quality of AI answers
Findings
Severity: High means fix first; Medium means plan soon; Low means tidy up.
| ID | Severity | Finding | Evidence | Recommended next step |
|---|---|---|---|---|
| F-01 | High | 17 sites shared with "everyone in the organisation", including HR and finance | E-01 | Restrict to named groups, then review site owners before widening the pilot. |
| F-02 | High | 2 of 6 agents have no owner and one reaches the finance library | E-03 | Assign owners; reduce knowledge sources to the minimum. |
| F-03 | Medium | Sensitivity labels applied to about 6% of files in scope | E-02 | Introduce a default label and auto-labelling for the highest-risk content. |
| F-04 | Medium | "Anyone" links allowed on 9 sites | E-01 | Disable "anyone" links where not needed; expire existing links. |
| F-05 | Medium | Audit retention is short and no one reviews Copilot activity | E-04 | Extend retention as policy requires and name a reviewer. |
| F-06 | Low | No acceptable-use policy for AI tools | None supplied (administrator reports none exists) | Draft a short policy and agree an approval path for new agents. |
Fix first
- Restrict the 17 broadly shared sites Effort: Medium.
- Assign owners to all agents and trim knowledge sources Effort: Low.
- Disable "anyone" links where not needed Effort: Low.
- Name an audit reviewer and extend retention Effort: Low.
- Start default and auto-labelling Effort: High.
30/60/90-day plan
- First 30 days: Restrict broad sites; assign agent owners; write the short AI policy.
- By 60 days: Disable anyone links; set audit retention and reviewer; label the highest-risk libraries.
- By 90 days: Review results with the pilot group; re-run the sharing report; decide on widening the pilot.
Customer decision
- Approval: this sample authorizes no changes; no remediation was performed.
- Limit: findings reflect only the evidence listed above, as supplied at the time.
Limitations
This fictional sample demonstrates format, not a real assessment. It contains no real customer data, gives no security or compliance guarantee, and made no change to any system.