MESA POINT · ENGAGEMENT

The Shadow AI Audit

What AI is already running inside our company, and who governs it?

For CFOs, CISOs, and compliance officers  ·  Internal offering one-pager  ·  2026-07-17

Why this engagement exists

AI did not wait for your approval. It arrived one login at a time. A finance analyst pastes the forecast into a chatbot. A sales rep runs accounts through a tool nobody cleared. A team wires an agent into a workflow over a weekend. None of it shows on an org chart. All of it makes decisions with your name on them.

That is shadow AI. Software already reading, classifying, drafting, and deciding inside your walls, with no owner and no record of what it did. You cannot govern what you cannot see. The Shadow AI Audit makes it visible.

What we find

We map every place AI already touches a decision in your company. For each one we answer four questions. What is it deciding. Who owns that decision when it goes wrong. What limit is set on it. What happens when it should escalate and does not.

Then we sort what we find into the four Mesa categories.

• Decisions. Judgment that must stay with a person, because it carries risk a machine has no business holding.
• Sentinels. Conditions a system should watch and flag. It monitors. It never acts alone.
• Automations. Work a system runs start to finish, on its own, inside limits it does not get to set.
• Human-in-the-Loop. Calls a system can draft or propose, but never send or act on without a person's approval.

What you get

• A complete inventory of AI in use, sanctioned and shadow, decision by decision.
• A named owner for every automated decision, or a flag where none exists.
• The exposure list. Where AI is deciding past its authority, and what it would cost you if a regulator or a board asked today.
• A three-layer map. A board layer your leadership can ratify, an operational layer your teams run on, a developer layer engineering builds to. The three agree because they are the same map.

How it runs

One ninety-minute session with your executive sponsor. From there a structured instrument goes to everyone whose work touches AI, and we synthesize in parallel. We come back with the audit drafted. The sessions after that are reviews, not interviews. The whole thing asks three to five hours of senior time and lands in three to four weeks.

Why it matters

Most firms will tell you to write an AI policy. A policy governs what people are supposed to do. The Shadow AI Audit shows you what they are actually doing. One of those ends a board conversation. The other starts an investigation.

Map first. Then decide what to keep, what to bound, what to escalate, and what to shut off.

Mesa Group is a professional services firm in the Command Mapping category. Mesa Point maps decision authority. Mesa Built builds the systems that authority calls for. The principle is constant: automation with authority.

Source: Mesa Group site engagement listing.