Product

Product overview Agents Automations Apps Code (Beta) Integrations Governed Runtime Security

Where Renly runs

Windows app Android app Inside other AI apps

Solutions

Finance Sales Operations People and HR Marketing Enterprise

Resources

Pricing Docs Academy Blog Compare Support

AI governance and capability

AI governance framework AI governance assessment AI capability maturity AI maturity assessment
Book a demo Sign in

AI Capability Maturity Assessment · Part III. Running an assessment

Running an assessment

7 minute read · Version 1.0.0

In this chapter

The assessor-led process from kickoff to read-out: the timeline, who takes part, scope and edition, the four sources of evidence, the validation and moderation rules, and worked calibration examples. It closes with how the same model runs as a self-assessment.

  1. Timeline
  2. Roles
  3. Scope and edition
  4. Gathering evidence
  5. Validation and moderation
  6. Calibration examples
  7. Running it as a self-assessment

An assessor-led assessment takes about six weeks from kickoff to read-out. The model’s toolkit supplies every instrument: the evidence request, the interview guides, the staff survey and five workshops. The steps below follow the order the toolkit sets.

Timeline

  1. Week 1

    W1 Kickoff and ambition sounding (120 minutes)

    Confirmed scope and edition, Evidence request issued with owners and due dates and Interview schedule

  2. Week 1

    Evidence request issued

    Issue in week 1. Where an item does not exist, say so; its absence is recorded as evidence and is not chased. Provide documents in their current version; provide records for the last 12 months unless stated.

  3. Weeks 2 and 3

    Interviews by role

    Interviews run 30 to 60 minutes with two assessors: one leads, one codes each substantive answer to a criterion and an evidence confidence as it is given. Interviews test and extend what the documents show; they do not replace them. Run them in weeks 2 and 3, after the evidence request has been issued.

  4. Weeks 2 and 3

    Staff survey open

    Open to all staff in scope for 7 to 10 days. Anonymous; no free-text question asks for names. Use a survey tool the organisation already approves.

  5. Week 3

    W2 Evidence review and lifecycle walk-through (150 minutes)

    Observations coded to criteria in D2, D3, D4, D6 and D7, List of unregistered AI found and Follow-up evidence actions

  6. Week 4

    W3 Scoring moderation (180 minutes)

    Agreed score, confidence, evidence IDs and reason for all 40 criteria, Moderation log and Domain and overall results computed

  7. Week 5, after playback of validated scores

    W4 Target state and roadmap planning (210 minutes)

    Domain targets with ambition and time frame, Criterion target overrides with reasons and Prioritised initiative list with horizon and owner

  8. Week 6

    W5 Read-out and decisions (90 minutes)

    Recorded decisions, Endorsed or amended targets and Funded first horizon

Roles

Who takes part, and how. Interview guides exist for the roles marked interviewed; workshop attendance and evidence-request ownership come from the toolkit.

RoleInterviewsWorkshopsEvidence items ownedLeads the playbook
Board or accountable authorityNot interviewedW5
Executive sponsor or Chief AI Officer
Government edition: Chief AI Officer or accountable official
InterviewedW1, W4, W53Operating model; Strategy and leadership
CIO or CTOInterviewedW1, W2, W4, W52Platform and security
CISO or security leadInterviewedW1, W2, W46
Chief Data Officer or data ownerInterviewedW1, W2, W42Data and knowledge
Legal, privacy and records leadInterviewedW1, W2, W41
Risk, compliance and internal auditInterviewedW1, W3, W4, W53
Use-case owner or business leadInterviewedW2, W4
Engineering or architecture leadInterviewedW26Engineering practice
Frontline staffInterviewed
AI lead or AI centre of excellenceNot interviewedW1, W2, W310Governance and assurance; Use-case portfolio and value
People and capability (HR and learning)Not interviewedW1, W43People and adoption
Procurement and contract managementNot interviewed1
Records managerNot interviewed1
Chief Financial Officer or finance leadNot interviewedW4, W52
Internal communicationsNot interviewedW11
AI governance committeeNot interviewed

Scope and edition

An assessment covers either the whole enterprise or one business function. The criteria are the same in both; what changes is the evidence sampled and who owns the resulting initiatives.

  • Whole enterprise: All business units, all AI however acquired. The default, and required for the government edition’s obligations view.
  • One business function: A named function such as finance, marketing, customer service, human resources or a program area. Use when a function is moving faster than the enterprise, or to pilot the assessment before an enterprise-wide run.

In a function-scoped assessment, sample only the function’s use cases, staff and records for ‘both’ and ‘function’ criteria, and state the scope on every generated document.

Choose the edition at kickoff (workshop W1). The government edition carries the Commonwealth obligations and their dates; see Editions and obligations.

Gathering evidence

Evidence comes from four sources, and the strongest scores rest on more than one:

  • Documents and records from the evidence request (41 items, each with an owner and a format).
  • Interviews with 9 roles, coded to criteria as they happen: Code each answer as criterion number plus confidence: ‘evidenced’ only when the evidence is seen or provided afterwards; otherwise ‘asserted’. Log the follow-up evidence request with an owner and date.
  • The staff survey (25 items), which can corroborate, flag or cap a score but never raise it.
  • Observation in the workshops, especially the lifecycle walk-through of a real use case (W2).

Validation and moderation

  1. Two assessors score each criterion independently before discussing it (assessor mode).
  2. Differences of more than one level are resolved by seeking more evidence, never by averaging. Differences of 0.5 to 1.0 are resolved in moderation with the reason recorded.
  3. Every score of Level 3 or above cites at least one evidence ID, and every pass test claimed names the evidence that meets it.
  4. Survey flags are reviewed criterion by criterion in moderation, and the outcome is recorded.
  5. Domain scores are played back to the people who provided the evidence before any report is drafted. Corrections arrive as new evidence logged in the evidence register, not by email or negotiation.
  6. A quality reviewer who did not score re-checks a sample of 20 percent of criteria (at least eight, covering every domain) against their pass tests. If more than two sampled scores change, the whole domain is re-moderated.
  7. Assessors do not score areas they manage or have advised on in the last 12 months.
  8. Any score that changes after playback records the new evidence and who supplied it.

Moderation

Turn two independent scores and the survey into one agreed, evidenced score per criterion.

  1. Show both assessors’ scores, confidence and evidence IDs side by side; start with the largest differences.
  2. For each criterion, read the pass tests aloud from the lowest unmet level and check the evidence against them.
  3. Apply caps (confidence, currency, survey, function scope) and record which applied.
  4. Record the agreed score, the confidence, the evidence IDs and a one-sentence reason.
  5. List open evidence actions with owners and dates; criteria with open actions are scored on the evidence held now.

Calibration examples

Worked cases that show how the pass tests and caps decide a score. Review two together before moderation.

2.3 Use-case register Proposed 3, agreed 2

A spreadsheet register lists 42 deliberate projects with owners and tiers. No discovery sweep has been run, and no embedded vendor AI is listed. The survey shows 38 percent of staff use AI features built into software that are not on the register.

The Level 3 pass test requires a discovery sweep in the last 12 months covering embedded AI. Not met, so the score is 2 (2.5 in assessor mode only if a sweep is under way with findings partly added).

1.3 Executive ownership Proposed 3, agreed 2.5

A Chief AI Officer was appointed in 2026. The delegation instrument gives authority over the register and the tool list but says nothing about pausing a use case, and there is no budget line.

Level 2 is met. The Level 3 pass test needs authority to pause and a budget line; substantial parts are in place, so 2.5 in assessor mode, 2 in self or team mode.

3.5 Incident and near-miss management Proposed 3, agreed 2.5

An approved AI incident runbook names halt authority and notification routes. It has never been rehearsed, and the incident register has no entries.

The Level 3 pass test requires a rehearsal record. An empty register is also a red flag for under-reporting. 2.5 in assessor mode.

8.3 Acceptable use Proposed 3, agreed 2.5

A two-page acceptable-use policy is published and acknowledged by 92 percent of staff. Survey awareness of the main rules is 61 percent.

The Level 3 pass test requires survey awareness of at least 70 percent. Acknowledgement is not awareness.

6.2 Autonomy and human oversight design Proposed 4, agreed 3

The platform enforces approval for every write action. Approval logs show a median of four seconds per approval and 99.6 percent approved. Nobody reviews these figures.

Level 3 is met (matrix and approval records). Level 4 requires monitoring of approval and override rates to detect rubber-stamping; the data suggests rubber-stamping and nobody is looking. Score 3 and raise a finding.

1.5 Executive evidence rhythm Proposed 3, agreed 2

Several executives say the executive committee reviews AI monthly. No papers or minutes were provided.

Asserted, so capped at 2.0 until papers are produced.

4.4 Provenance and decision records Proposed 3, agreed 2.5

Decision records with all minimum fields exist for one in-scope system. A second in-scope system that drafts letters about eligibility keeps no records.

The Level 3 pass test needs records for every in-scope system. One of two is substantial progress, not Level 3.

5.5 Observability, halt and rollback Proposed 4, agreed 3

A documented halt procedure exists for the customer chatbot and was rehearsed in March with a measured time to halt of 6 minutes. The chatbot is low tier; there are no high-tier systems.

Level 3 is met. Level 4 also requires agent identities and alert-response records, not shown. Rehearsal alone does not make Level 4.

Running it as a self-assessment

One respondent chooses, for each criterion, the level descriptor that best matches the organisation and states their confidence. No assessor sees evidence.

Confidence is asked in plain words: We could show the evidence today, We believe so, but have not checked or Not sure.

Every output is labelled ‘Self-assessed and not validated’. Generated text uses ‘you reported’ rather than ‘the assessment found’.

The free assessment applies every rule on this site, from the caps to the roadmap, and produces the same reports as an assessor-led engagement, labelled as self-assessed.

This assessment is not legal advice and is not a certification. Obligations and dates were checked against official sources on 15 October 2026; confirm them against the source instruments, which can change.