AI Capability Maturity Assessment · Part III. Running an assessment
Running an assessment
In this chapter
The assessor-led process from kickoff to read-out: the timeline, who takes part, scope and edition, the four sources of evidence, the validation and moderation rules, and worked calibration examples. It closes with how the same model runs as a self-assessment.
An assessor-led assessment takes about six weeks from kickoff to read-out. The model’s toolkit supplies every instrument: the evidence request, the interview guides, the staff survey and five workshops. The steps below follow the order the toolkit sets.
Timeline
Week 1
W1 Kickoff and ambition sounding (120 minutes)
Confirmed scope and edition, Evidence request issued with owners and due dates and Interview schedule
Week 1
Issue in week 1. Where an item does not exist, say so; its absence is recorded as evidence and is not chased. Provide documents in their current version; provide records for the last 12 months unless stated.
Weeks 2 and 3
Interviews run 30 to 60 minutes with two assessors: one leads, one codes each substantive answer to a criterion and an evidence confidence as it is given. Interviews test and extend what the documents show; they do not replace them. Run them in weeks 2 and 3, after the evidence request has been issued.
Weeks 2 and 3
Open to all staff in scope for 7 to 10 days. Anonymous; no free-text question asks for names. Use a survey tool the organisation already approves.
Week 3
W2 Evidence review and lifecycle walk-through (150 minutes)
Observations coded to criteria in D2, D3, D4, D6 and D7, List of unregistered AI found and Follow-up evidence actions
Week 4
W3 Scoring moderation (180 minutes)
Agreed score, confidence, evidence IDs and reason for all 40 criteria, Moderation log and Domain and overall results computed
Week 5, after playback of validated scores
W4 Target state and roadmap planning (210 minutes)
Domain targets with ambition and time frame, Criterion target overrides with reasons and Prioritised initiative list with horizon and owner
Week 6
W5 Read-out and decisions (90 minutes)
Recorded decisions, Endorsed or amended targets and Funded first horizon
Roles
Who takes part, and how. Interview guides exist for the roles marked interviewed; workshop attendance and evidence-request ownership come from the toolkit.
| Role | Interviews | Workshops | Evidence items owned | Leads the playbook |
|---|---|---|---|---|
| Board or accountable authority | Not interviewed | W5 | ||
| Executive sponsor or Chief AI Officer Government edition: Chief AI Officer or accountable official | Interviewed | W1, W4, W5 | 3 | Operating model; Strategy and leadership |
| CIO or CTO | Interviewed | W1, W2, W4, W5 | 2 | Platform and security |
| CISO or security lead | Interviewed | W1, W2, W4 | 6 | |
| Chief Data Officer or data owner | Interviewed | W1, W2, W4 | 2 | Data and knowledge |
| Legal, privacy and records lead | Interviewed | W1, W2, W4 | 1 | |
| Risk, compliance and internal audit | Interviewed | W1, W3, W4, W5 | 3 | |
| Use-case owner or business lead | Interviewed | W2, W4 | ||
| Engineering or architecture lead | Interviewed | W2 | 6 | Engineering practice |
| Frontline staff | Interviewed | |||
| AI lead or AI centre of excellence | Not interviewed | W1, W2, W3 | 10 | Governance and assurance; Use-case portfolio and value |
| People and capability (HR and learning) | Not interviewed | W1, W4 | 3 | People and adoption |
| Procurement and contract management | Not interviewed | 1 | ||
| Records manager | Not interviewed | 1 | ||
| Chief Financial Officer or finance lead | Not interviewed | W4, W5 | 2 | |
| Internal communications | Not interviewed | W1 | 1 | |
| AI governance committee | Not interviewed |
Scope and edition
An assessment covers either the whole enterprise or one business function. The criteria are the same in both; what changes is the evidence sampled and who owns the resulting initiatives.
- Whole enterprise: All business units, all AI however acquired. The default, and required for the government edition’s obligations view.
- One business function: A named function such as finance, marketing, customer service, human resources or a program area. Use when a function is moving faster than the enterprise, or to pilot the assessment before an enterprise-wide run.
In a function-scoped assessment, sample only the function’s use cases, staff and records for ‘both’ and ‘function’ criteria, and state the scope on every generated document.
Choose the edition at kickoff (workshop W1). The government edition carries the Commonwealth obligations and their dates; see Editions and obligations.
Gathering evidence
Evidence comes from four sources, and the strongest scores rest on more than one:
- Documents and records from the evidence request (41 items, each with an owner and a format).
- Interviews with 9 roles, coded to criteria as they happen: Code each answer as criterion number plus confidence: ‘evidenced’ only when the evidence is seen or provided afterwards; otherwise ‘asserted’. Log the follow-up evidence request with an owner and date.
- The staff survey (25 items), which can corroborate, flag or cap a score but never raise it.
- Observation in the workshops, especially the lifecycle walk-through of a real use case (W2).
Validation and moderation
- Two assessors score each criterion independently before discussing it (assessor mode).
- Differences of more than one level are resolved by seeking more evidence, never by averaging. Differences of 0.5 to 1.0 are resolved in moderation with the reason recorded.
- Every score of Level 3 or above cites at least one evidence ID, and every pass test claimed names the evidence that meets it.
- Survey flags are reviewed criterion by criterion in moderation, and the outcome is recorded.
- Domain scores are played back to the people who provided the evidence before any report is drafted. Corrections arrive as new evidence logged in the evidence register, not by email or negotiation.
- A quality reviewer who did not score re-checks a sample of 20 percent of criteria (at least eight, covering every domain) against their pass tests. If more than two sampled scores change, the whole domain is re-moderated.
- Assessors do not score areas they manage or have advised on in the last 12 months.
- Any score that changes after playback records the new evidence and who supplied it.
Moderation
Turn two independent scores and the survey into one agreed, evidenced score per criterion.
- Show both assessors’ scores, confidence and evidence IDs side by side; start with the largest differences.
- For each criterion, read the pass tests aloud from the lowest unmet level and check the evidence against them.
- Apply caps (confidence, currency, survey, function scope) and record which applied.
- Record the agreed score, the confidence, the evidence IDs and a one-sentence reason.
- List open evidence actions with owners and dates; criteria with open actions are scored on the evidence held now.
Calibration examples
Worked cases that show how the pass tests and caps decide a score. Review two together before moderation.
2.3 Use-case register Proposed 3, agreed 2
A spreadsheet register lists 42 deliberate projects with owners and tiers. No discovery sweep has been run, and no embedded vendor AI is listed. The survey shows 38 percent of staff use AI features built into software that are not on the register.
The Level 3 pass test requires a discovery sweep in the last 12 months covering embedded AI. Not met, so the score is 2 (2.5 in assessor mode only if a sweep is under way with findings partly added).
1.3 Executive ownership Proposed 3, agreed 2.5
A Chief AI Officer was appointed in 2026. The delegation instrument gives authority over the register and the tool list but says nothing about pausing a use case, and there is no budget line.
Level 2 is met. The Level 3 pass test needs authority to pause and a budget line; substantial parts are in place, so 2.5 in assessor mode, 2 in self or team mode.
3.5 Incident and near-miss management Proposed 3, agreed 2.5
An approved AI incident runbook names halt authority and notification routes. It has never been rehearsed, and the incident register has no entries.
The Level 3 pass test requires a rehearsal record. An empty register is also a red flag for under-reporting. 2.5 in assessor mode.
8.3 Acceptable use Proposed 3, agreed 2.5
A two-page acceptable-use policy is published and acknowledged by 92 percent of staff. Survey awareness of the main rules is 61 percent.
The Level 3 pass test requires survey awareness of at least 70 percent. Acknowledgement is not awareness.
6.2 Autonomy and human oversight design Proposed 4, agreed 3
The platform enforces approval for every write action. Approval logs show a median of four seconds per approval and 99.6 percent approved. Nobody reviews these figures.
Level 3 is met (matrix and approval records). Level 4 requires monitoring of approval and override rates to detect rubber-stamping; the data suggests rubber-stamping and nobody is looking. Score 3 and raise a finding.
1.5 Executive evidence rhythm Proposed 3, agreed 2
Several executives say the executive committee reviews AI monthly. No papers or minutes were provided.
Asserted, so capped at 2.0 until papers are produced.
4.4 Provenance and decision records Proposed 3, agreed 2.5
Decision records with all minimum fields exist for one in-scope system. A second in-scope system that drafts letters about eligibility keeps no records.
The Level 3 pass test needs records for every in-scope system. One of two is substantial progress, not Level 3.
5.5 Observability, halt and rollback Proposed 4, agreed 3
A documented halt procedure exists for the customer chatbot and was rehearsed in March with a measured time to halt of 6 minutes. The chatbot is low tier; there are no high-tier systems.
Level 3 is met. Level 4 also requires agent identities and alert-response records, not shown. Rehearsal alone does not make Level 4.
Running it as a self-assessment
One respondent chooses, for each criterion, the level descriptor that best matches the organisation and states their confidence. No assessor sees evidence.
Confidence is asked in plain words: We could show the evidence today
, We believe so, but have not checked
or Not sure
.
Every output is labelled ‘Self-assessed and not validated’. Generated text uses ‘you reported’ rather than ‘the assessment found’.
The free assessment applies every rule on this site, from the caps to the roadmap, and produces the same reports as an assessor-led engagement, labelled as self-assessed.
This assessment is not legal advice and is not a certification. Obligations and dates were checked against official sources on 15 October 2026; confirm them against the source instruments, which can change.