Organisation Readiness Assessment
Know how far your view of your capability can be relied on.
In about 30 minutes, see where your organisation is ready to adopt and sustain change, where it needs support, and what to do first. The guidance below the assessment helps you give answers you can defend.
Find out how much of what you know you can rely on.
- Where your organisation is ready to adopt and sustain change, and where it needs support.
- Which gaps and dependencies to deal with first.
- Whether governance and ownership are strong enough to build on.
- Which answers rest on one person's view, so you know what to confirm.
- Whether a deeper assessment is worth your time.
Who else should see this?
Answer from where you sit. A first view from one person is useful, and it carries more weight once colleagues who own other areas have checked it. Ask them to take the same assessment, then compare.
Your answers carry most weight when
- You are accountable for the area.
- You know how the work is actually done.
- You can say who owns governance, technology and data decisions.
- You can tell fact from assumption.
- You can reach people who can check your answers.
Where you are less sure
Say so. "Unknown" is a useful answer, and the result shows you where to look first.
Say how established each position is, and how you know.
Answer against the scope as it operates today. Each question takes a response and the basis for it. An unknown is a finding: it scores zero and stays visible as a gap. Confirm existence, ownership and approval status only, and do not enter budgets, personal data or credentials. Your result appears as soon as you finish, and a private link to it is emailed to you.
Loading the assessment.
How useful was this assessment?
Your feedback is critical to improving this assessment, and every comment is read by the team. Rate it, add a comment if you can, and we will email your result link straight after.
Choose a rating above to send your rating and comments. Skipping does not send them.
Readiness is distributed across the organisation.
Executives understand purpose, appetite and investment. Process owners and front-line teams understand how work actually happens. Technology, data and security leaders understand access and dependency. Legal, compliance, risk and audit understand obligations and assurance. HR and change leaders understand whether people can exercise meaningful oversight.
The assessment is designed to expose the differences between these perspectives. An approved position, an individual view and a disagreement between functions are not equivalent answers, so each carries a different weight. Each one reveals a different action.
The same foundations decide value. KPMG's 2026 Global AI Pulse found the strongest outcomes were associated not with deploying more AI, but with capabilities such as accountability, governance and cost visibility. McKinsey found that organisations with explicit ownership for responsible AI reached materially higher maturity than those without a clearly accountable function.
KPMG, Global AI Pulse Q2 2026. McKinsey, State of AI Trust in 2026.
Treat a one-person result as provisional until the functions that own each domain have confirmed it.
Combine authority, expertise and operational reality.
Include both decision-makers and people close to the work. Senior leaders can define the intended operating model. Operational participants reveal the exceptions, workarounds, tacit knowledge and dependencies that a sound operating change depends on.
| Perspective | Typical participants | Contribution |
|---|---|---|
| Executive direction | Sponsor, COO, CIO, CTO or business-unit leader | Outcomes, funding, acceptable authority and decisions |
| Process and operations | Process owners, operational leaders, process excellence | Actual work, exceptions, dependencies and performance |
| Technology, data and AI | Architecture, IT, integration, data and AI leaders | Feasibility, information, platforms and observability |
| Security and identity | Security, IAM and resilience leaders | Access, permissions, traceability and continuity |
| Governance and assurance | Risk, legal, privacy, compliance and internal audit | Obligations, challenge, controls and evidence |
| People and organisation | HR, workforce, learning and change | Roles, capacity, consultation, skills and oversight |
| Commercial ecosystem | Finance, procurement and supplier management | Economics, contracts, concentration and exit |
| Front-line knowledge | Managers, subject-matter experts and users | Workarounds, tacit knowledge and real consequences |
Run it as a working session with the full team.
The online result is an indicative baseline. To turn it into decisions, work through the same domains with the people who own them and capture the following alongside each answer.
-
Set the scope
Agree whether the assessment covers the whole organisation, a division, a department or a team. The report title names the scope, and a scoped result must not be presented as representing the whole organisation.
-
Assign domain leads
Give each domain an accountable lead who can gather evidence and involve the right specialists. Accountability should not default to IT because AI is involved.
-
Gather evidence before concluding
Use current strategies, policies, process documentation, architecture, data records, risk assessments, audit findings, incident data, workforce plans and performance measures. Record "unknown" where evidence does not exist.
-
Review answers together
Use the questions to surface disagreement as well as gaps. Different answers from operations, IT, risk and executives are themselves a readiness finding.
-
Convert findings into decisions
Identify missing confirmations, capability gaps, accountable owners and the processes worth assessing next. Prioritise by value, exposure and dependency, not by how easy a gap is to close.
-
Reassess as authority expands
Confidence changes as processes, regulation, technology and the operating model change. Repeat the assessment at agreed milestones and after a material change.
Capture with every answer
- A response: demonstrated, established, partially established, recognised or planned, not established, unknown or not applicable.
- The basis for it: approved, owner confirmed, team consensus, individual view or disputed.
- The accountable owner.
- The internal source that confirms the position. Do not record confidential detail.
- The required action, its priority, its dependency and a target date.
An honest "not established" or "unknown" is more valuable than an unsupported "established". The objective is not to appear ready. It is to understand how far the position can be relied on.
The organisational conditions around operating change.
The overall score is the average confidence across the core questions. Each domain is scored on its own, and the conditional Agentic AI screen is reported separately.
- 1
Purpose, outcomes and direction
4 questions
- 2
Governance and accountability
4 questions
- 3
Portfolio and prioritisation
4 questions
- 4
Process and operating-model capability
4 questions
- 5
Information, technology and security
4 questions
- 6
People, change and operational capacity
4 questions
- 7
Assurance, resilience and lifecycle
4 questions
- 8
Justification and benefits governance
4 questions
A foundation for decisions, not a document that sits on a shelf.
A process can look technically suitable while organisational ownership or governance remains insufficient. Strong enterprise governance does not make every process ready. This is the context that makes a process assessment meaningful.
- A shared organisational context supported by evidence.
- A disagreement and unknowns register.
- A register of the initiatives, decisions and accountabilities in scope.
- Clear decision rights and accountable owners.
- Gates that need a condition before anything proceeds.
- Cross-cutting organisational actions.
- Candidate processes for the Process Readiness Assessment.
- A baseline that can be refreshed after material change.
Designed with reference to recognised frameworks.
The assessment reflects organisational and lifecycle concepts from the NIST AI Risk Management Framework and ISO/IEC 42001, risk, transparency and human-oversight concepts relevant to the EU AI Act, and agent-specific control areas identified by OWASP. These sources give credible foundations, but no framework can answer the questions for your organisation. That takes evidence from the people who own, operate, govern and experience the work.
IGX360 independently developed this assessment. It is not certification, assurance, legal advice or endorsement by the referenced organisations.
Move from organisational context to a defined process.
Once the team can name a process and the outcome it must deliver, use the Process Readiness Assessment. It shows how much confidence can be placed in your understanding of that process and which operating modes are worth investigating.
Practical questions.
Who should complete the Organisation Readiness Assessment?
One informed person can produce a useful baseline, and it stays provisional until the functions that own the evidence have checked it. Answer against the scope you choose: the organisation, a division, a department or a team. Where participants disagree, treat the difference as a finding to investigate.
What does the result tell me?
A confidence score and band for the scope, a score for each domain, the unknowns and disagreements listed, and prioritised actions. It is an indicative baseline. It is not certification, assurance, legal advice or approval to deploy any technology.
What happens to my answers?
Your responses and report are stored securely and available for 30 days from submission, and a private link to your result is emailed to you. Your organisation keeps ownership of the information it submits. Download any report you want to keep before it expires.
The Organisation Readiness Assessment provides an indicative confidence baseline for internal discussion. It does not constitute legal, regulatory, security or technical advice, certification, assurance, or approval to deploy any technology. IGX does not independently validate the information unless expressly stated. Obtain appropriate specialist advice and assurance for the use case, sector and jurisdictions involved.