Sample Report — Demonstration Data

Review Assessment

Prepared using Triance, Draita’s AI Governance Navigator.

Sample Report — Demonstration Data

All figures below are illustrative sample data for a fictional organization.

Executive summary

Ready for a controlled pilot, not for organization-wide deployment

Northbridge Group has clear executive intent and a mature security baseline, which places it ahead of most organizations of similar size. Readiness is constrained by governance foundations rather than technology: there is no maintained inventory of AI tools, permissions across document repositories have not been reviewed for assistant-scale access, and generative AI is not yet covered by an approved policy.

These are addressable within one quarter. We recommend proceeding with a scoped pilot in parallel with remediation, then reassessing before broad rollout. Four material questions were answered Unknown, and each should be resolved before licences are extended beyond the pilot group.

Overall readiness

62%

Pilot Ready

Your responses indicate that foundational controls support a small, limited pilot with restricted access and named oversight. Address the remaining gaps before production deployment.

Classification bands: Not Ready (0–39%), Pilot Ready (40–64%), Controlled Deployment Ready (65–84%), Scale Ready (85–100%).

Where you are strong

Strongest areas

  • Security

    78%

    Identity controls, MFA enforcement and endpoint baselines are mature and consistently applied.

  • Strategy and ownership

    74%

    Leadership intent is clear and AI objectives are recognised at board level.

  • People and adoption

    68%

    Staff appetite is high and early champions have emerged in operations and marketing.

Where you are exposed

Highest-priority gaps

  • AI inventory

    41%High risk

    No maintained register and no measurement of unsanctioned tool usage.

  • Data and access

    48%High risk

    Permission hygiene and data classification are not ready for assistant-scale access.

  • Operations and evidence

    55%Attention

    Controls are informal and cannot currently be evidenced to auditors or customers.

  • Risk and compliance

    57%Attention

    Policy coverage and vendor assurance are incomplete for regulated data.

Recommendation

Deployment recommendation

Proceed with a controlled pilot of up to 40 Microsoft 365 Copilot licences, limited to departments whose repositories have completed a permissions review. Defer ChatGPT Enterprise procurement until vendor data residency and sub-processor terms are assessed. Do not extend licences organization-wide until the AI inventory, policy and retention controls are in place and evidenced.

Recommended scope
Pilot — 40 licences, 3 departments
Reassessment point
Day 90, before wider rollout
Blocking conditions
Inventory, permissions, policy

Priorities

Top five actions

  1. 1Assign a named executive owner for AI adoption and governance.
  2. 2Complete a permissions and oversharing review on all repositories in scope for assistants.
  3. 3Approve and communicate the AI acceptable-use policy with an acknowledgement record.
  4. 4Establish the AI tool register and run a first discovery sweep for unsanctioned tools.
  5. 5Define retention rules for prompts, outputs and chat histories.

Basis of assessment

How your readiness result was calculated

Triance Assess evaluates seven areas of AI governance: strategy and ownership, AI inventory, data and access, risk and compliance, security, people and adoption, and operations and evidence.

Each response contributes to the relevant area score. Yes receives the full available score, Partially receives half, and No receives zero. Unknown also receives zero because the control cannot currently be confirmed. Questions may carry different weights based on their governance importance.

Not Applicable is available only for approved conditional questions. Valid Not Applicable responses are excluded from scoring rather than treated as a weakness.

An area receives a percentage only when at least three questions have scoreable responses and more than half of its questions are covered. Otherwise, the area is shown as Insufficient Evidence, Insufficient Coverage or Not Applicable. An overall score is not shown when an applicable area lacks sufficient coverage.

The overall score is mapped to one of four readiness levels: Not Ready, Pilot Ready, Controlled Deployment Ready or Scale Ready. Critical deployment blockers are evaluated separately and may lower the final readiness level even when the numerical score falls within a higher level. When this happens, the result explains the effect of the blocker.

What each readiness level means

Not Ready
Your responses indicate significant governance or control gaps. Address the critical and foundational gaps before beginning or expanding an AI deployment.
Pilot Ready
Your responses indicate that foundational controls support a small, limited pilot with restricted access and named oversight. Address the remaining gaps before production deployment.
Controlled Deployment Ready
Your responses indicate that core governance controls support a limited production deployment with defined scope, access controls, human oversight and monitoring. Address the remaining gaps before broader rollout.
Scale Ready
Your responses indicate that governance controls are established, documented and operating consistently enough to support broader deployment. Each AI use case still requires appropriate review, approval and ongoing oversight.

Responsible use of this assessment

Triance Assess provides decision support based on the organisation's self-declared responses. Responses and supporting evidence have not been independently verified through technical testing, document review or audit.

The assessment and report are not a certification, legal or regulatory compliance determination, audit or assurance opinion, and do not replace professional legal, risk, security or compliance advice.

A readiness score or classification does not constitute approval or permission to deploy an AI system. Deployment decisions remain the responsibility of the organisation and its authorised governance, risk, security, legal and business decision-makers.

This sample report contains illustrative demonstration data and does not describe an assessed organisation.