AI Account Set-up and Audit
A careful, plain-language program that puts your staff on appropriate business AI accounts, checks the cyber foundations underneath, and agrees where AI is worth using first.
The situation it solves
Your firm is interested in AI. Some people are already using it. But you are not sure whether staff are on accounts that are appropriate for client work, whether sensitive information has been pasted somewhere it should not be, or which workflow would actually repay the effort.
Terms like "enterprise data protection", "tenant" or "Essential Eight" get used without explanation. This program explains them as we go, and makes the decisions with you rather than for you.
A good fit if you are
- A professional services firm, such as accounting, legal, consulting or advisory
- Holding confidential client or business information
- Running Microsoft 365 or Google Workspace
- Keen to use AI but not interested in configuring it yourselves
Probably less suitable if
You already have the in-house technical capability to configure, secure and govern your own AI environment. In that case you may only need a second opinion, which we are happy to discuss.
Setup, Essential Eight alignment, Review.
Each stage is connected. The exact activities are confirmed when scope is agreed, based on your systems and what is already in place.
Setup
Put staff on appropriate business AI accounts, not personal ones.
- Scope to agree
- The appropriate account setup and access arrangements for your environment are agreed before work begins.
- Decisions made
- Which AI tools are approved, who gets access, and which data settings are switched on or off.
- Outside scope
- Building custom AI applications or automations. Those can be scoped later if useful.
Essential Eight alignment
Check the cyber foundations the AI accounts sit on.
- Scope to agree
- The scope of assessment, recommendations and any implementation is agreed before work begins.
- Decisions made
- Which gaps to fix now, which to plan for, and what level of maturity is realistic for your firm.
- Outside scope
- Certification or a guarantee of security. Essential Eight is a foundation, not a stamp.
Review
Look at how AI is actually being used and decide what comes next.
- Scope to agree
- Review activities and any written outputs or recommendations are defined in the agreed scope.
- Decisions made
- Where AI is worth applying first, and whether any further work is worth scoping.
- Outside scope
- Ongoing managed support, unless separately agreed.
A note on Essential Eight
Essential Eight is a set of baseline cyber security strategies from the Australian Cyber Security Centre. Aligning with it is an important foundation. It is not a certification, it is not a guarantee, and it does not on its own make every use of AI safe. We treat it as one part of a wider approach to data handling and governance.
What the program is for
These are the purposes the work is aimed at. Specific deliverables are set out in the agreed scope.
Clearer staff access
Knowing who uses which AI tools, on which accounts, and why.
Less risk of misplaced information
Reducing the chance of client data ending up in unsuitable tools.
An agreed starting workflow
One practical place to begin, chosen with the people doing the work.
A prioritised roadmap
What to do next, in order, and what can wait.
Process and commitment
- 1
Initial conversation
Call or email. We talk about your firm, your systems and what you are unsure about. Please do not send confidential client information at this stage.
- 2
Scope and fee agreed
We put the proposed scope, what we need from you, and the fee in writing. Nothing starts until you agree.
- 3
The work
We will need an administrator contact for your systems, a decision-maker who can agree policy, and some time from the people who use AI day to day. How and where the work happens is agreed as part of scope.
- 4
Wrap-up
We review the work against the agreed scope and discuss next steps. Any further work is optional and scoped separately.
Frequently asked questions
Who is the AI Account Set-up and Audit for?
Australian professional services businesses, such as accounting, legal, consulting and advisory firms, that hold confidential client information and would rather not configure and govern AI tools themselves.
Who is it not a good fit for?
Businesses that already have the in-house technical capability to configure, secure and govern their own AI environment will usually get less value from it.
Does Essential Eight alignment mean we are certified or fully secure?
No. Essential Eight is a set of baseline cyber security strategies published by the Australian Cyber Security Centre. Aligning with it is an important foundation, not a certification, and it does not make every use of AI safe on its own. It sits within a wider approach to data handling and governance.
How much does it cost?
It depends on the size of the business, the systems involved and what is already in place. We talk through your situation first, then agree the scope and fee in writing before any work starts.
Do we need to share confidential client data with you?
Please do not send confidential client information when you first get in touch. If an engagement goes ahead, we agree what access is needed and how information will be handled as part of the scope.
What do we need to provide?
Typically an administrator contact for your Microsoft 365 or Google Workspace environment, a decision-maker who can agree policy, and time from the people who will actually use AI day to day. The exact list is confirmed when scope is agreed.
Can you help with automation, training or custom solutions afterwards?
Possibly. Those can be discussed as next steps once the foundations are in place. Any further work is scoped and agreed separately.
Start with a conversation.
Tell Jon what your firm uses today and what you are unsure about. Scope and fee are agreed before any work begins. Please do not send confidential client information in your first message.