An AI workflow readiness audit is a structured check you run on one workflow before you connect any AI tool to it. On one page, you write down the workflow's trigger and inputs, its decision rules, the systems it touches, its exceptions, the approvals it needs, its handoffs and what counts as done. The audit ends in one of four outcomes: automate now, document first, run a constrained assisted pilot, or leave it manual.
Automation copies whatever process you already run. If the rules live in one person's head, the tool copies the gaps too, at speed. It is easy to connect a tool to a half-defined process, watch it misfire and conclude that AI does not work here. Without a defined workflow, you cannot tell whether a failure came from the tool or the process. This worksheet separates those questions before you spend anything.
TL;DR
- Audit one workflow at a time. Not the business, not a department. One workflow.
- Write down seven things: trigger and inputs, decision rules as if/then statements, systems and access owners, exceptions and where they go, required human approvals, handoffs, and completion criteria.
- Choose one of four outcomes: automate now, document first, run a fenced assisted pilot, or stay manual.
- Stop signs: rules that live in one person's head, no definable success, exceptions outnumbering normal cases, irreversible actions with no approval step, and personal data flows you have not accounted for under Zimbabwe's Cyber and Data Protection Act.
- Track completion rate, exception volume, time to first acknowledgement and correction rate. Treat any hours-saved figure quoted before those settle as a guess.
Why map the workflow before you automate it
Automation does not improve a process. It repeats one, faster, and without the person who used to quietly patch the gaps. Whatever is undefined in the manual version stays undefined in the automated one; you just find out at machine speed, in front of customers. If the workflow runs through WhatsApp on somebody's personal phone, that is another reason to write it down.
We have already published a worked example of this discipline. From property inquiry to assigned agent maps one real estate workflow, an enquiry arriving and reaching the right agent, through eight distinct stages before any automation decision. This article is the parent framework: the same method, stripped of the sector, so you can apply it to a quotation process, a job card, a stock request or a delivery confirmation, anything that runs on rules.
If you are still one step earlier, deciding whether you need outside help at all, start with what AI consulting is and whether your business needs it and come back with one workflow chosen.
Mapping before deploying is not homework we invented. NIST's voluntary AI Risk Management Framework (AI RMF 1.0, published January 2023, with a revision in progress) organises the work into govern, map, measure and manage, and puts mapping the context ahead of deployment. The framework is American and voluntary, so it does not bind a Zimbabwean business, but the ordering is the useful part: understand the process and its risks before the tool goes in.
The readiness worksheet: seven things to write down
One page. One workflow. Fill it in with the people who actually run the process, not from memory in a manager's office. If any section will not fit on the page, that section is telling you where the real work is.
| Step | Worksheet section | What to write down | It is ready when |
|---|---|---|---|
| 1 | Trigger and inputs | What starts the workflow and every input it needs (message, form, document, payment, call), plus the format each arrives in | You can list the inputs for the last ten real cases without saying "it depends" |
| 2 | Decision rules | Every decision as an explicit if/then statement, including the default when no rule matches | Someone new could make the same calls using only what is written |
| 3 | Systems and access | Every system touched, including WhatsApp and spreadsheets, and the named owner of each login | No system is owned by "everyone" or by a personal account nobody controls |
| 4 | Exceptions | The cases that do not fit the rules, and the single queue or person they go to | Exceptions are named and routed, not handled by whoever notices |
| 5 | Human approvals | Steps that must not happen without a named person's sign-off, especially outbound messages, payments and record changes | Every irreversible action has an approver, and the approver knows it |
| 6 | Handoffs | Every point where work passes between people or systems, and how the receiver knows it has arrived | Nothing moves by assumption or a shout across the office |
| 7 | Completion and escalation | What done looks like, and what happens (and when) if a case stalls | You can check any case and say whether it is complete, stalled or escalated |
To use this, put the seven section names down the left of one blank page or sheet, and fill the right side with your answers for one workflow. If your answers do not fit on that page, you are auditing more than one workflow.
Two notes on filling it in.
Decision rules must be written as if/then statements. "Use your judgement" is not a rule; it is the absence of one. If the person doing the work applies judgement, interview them until the judgement becomes rules, plus a defined exception queue for whatever remains.
Test the sheet against real cases, not the ideal case. Pull the last ten actual instances of the workflow, including at least one that went wrong, and check every one against what you wrote. The gaps you find are the audit's real output.
Signs a workflow is not ready for AI
Any one of these is a stop sign. Not forever, but for now.
- The rules live in one person's head. If only one senior person knows why some requests get escalated, you cannot configure a tool to do it, and you carry key-person risk worth fixing whether you automate or not.
- You cannot define success. If the team cannot agree on what a correctly completed case looks like, no tool can hit the target, and nobody will be able to say whether the automation is working.
- Exceptions outnumber the normal cases. Then it is not a workflow with exceptions; it is judgement work wearing a workflow's clothes. Automating it produces fast, confident, wrong answers.
- It takes irreversible external actions with no approval step. Sending money, messaging customers, changing records other people rely on. If the manual process has no sign-off on these, add one before any tool touches them.
- It moves personal data you have not accounted for. Customer names, numbers, ID details, addresses. If you cannot say where that data sits and who may access it, resolve that first. More on this below.
This matches what the people building these systems say. Anthropic's engineering guidance on building agents, published in December 2024, makes the same point from the builder's side: well-defined, predictable tasks suit simple, structured workflows. More autonomous setups buy flexibility at the price of higher cost and compounding errors, which is why that guidance calls for guardrails, sandboxed testing and human checkpoints. Our reading of that for a small business: the less defined your process, the more you pay for the automation and the more of its output you end up correcting.
Choose one of the four outcomes
- Automate now. All seven sections complete, no stop signs, and the workflow has already run with AI assistance under human approval long enough for the correction rate to settle. This outcome belongs to a second pass, after a pilot, not a first one.
- Document first. One or more sections is blank or vague. The gap, not the tool, is your project. If the audit sends you here, treat it as a good result: the gap it exposes is worth fixing whether or not you ever automate.
- Assisted pilot. The sheet is complete and survives the ten-case test, but the workflow has never run with a tool attached. This is where a genuinely ready workflow starts. Fence it in (next section) and let the exception queue tell you what the sheet missed.
- Stay manual. A stop sign you cannot remove, or volumes so low that building and maintaining an automation costs more attention than doing the work.
Whether an automation is worth its price is a separate question from whether the workflow is ready, and it is not this article's job. Budgeting and choosing between projects sit outside this worksheet on purpose.
System access, data ownership and the law
Section 3 deserves its own pass because unclear system access and data ownership can block automation. Answer these in writing:
- Who owns the login for each system the workflow touches? A named person, or "the WhatsApp on the sales phone"?
- If the workflow runs partly on a personal number, device or email account, what happens when that person leaves?
- Can you export your data (contacts, messages, records) out of each tool, and have you ever tested the export?
- Where does customer data sit once the AI tool is connected, and does the vendor's agreement let them use it?
- Can you switch the integration off without losing the records it created?
On the legal side: personal data processing in Zimbabwe sits under the Cyber and Data Protection Act [Chapter 12:07], with POTRAZ designated as the Data Protection Authority. Licensing regulations introduced in September 2024 (SI 155 of 2024) added duties for data controllers, including licensing and breach notification obligations. The published guidance behind this paragraph dates from November 2024 and the requirements may have changed since, so treat this as a question on your worksheet, not a compliance summary: confirm your current obligations with POTRAZ or a lawyer before customer data flows into a new tool.
If you pilot, fence it in
An assisted pilot is not a smaller version of full automation. It is a different thing, with a fence.
- One workflow, one slice. One channel, branch or customer segment. Everything else keeps running the manual process.
- A named owner. One person who checks the exception queue daily and answers for the pilot. Not a committee.
- Human approval on anything outbound or irreversible. Drafts and internal routing can be automatic. Messages to customers, payments and record changes get signed off by a person until the correction rate earns something looser.
- A rollback you have rehearsed. Turning the tool off must land you on the documented manual process, which exists because you did the audit. If switching off would strand work, the fence is broken.
- A review date, set before launch. On that date the pilot is extended, adjusted or stopped, using the measures below.
Guard the fence. A pilot that works invites scope expansion. The answer is a new audit for the new task, not a quiet extension of the old fence.
What to measure without promising ROI
You do not need revenue projections to judge a pilot. Four observable measures, all defined by your own worksheet:
- Completion rate. The share of cases meeting your written completion criteria without intervention.
- Exception queue volume. Rising volume means your rules miss reality. Falling volume means the map matches the territory.
- Time to first acknowledgement. How quickly an incoming case gets its first response, where your workflow has one.
- Correction rate. The share of AI-assisted outputs a human had to fix before they were usable.
Anyone quoting hours saved or a productivity multiplier before these four have stabilised is guessing. Track them for the pilot period, compare against the manual baseline (measure it during the audit if you can), and let that drive the extend-or-stop call.
Start with one workflow
Pick one workflow. Write the seven section names down one page, fill them in with the people who run the process, and test what you wrote against your last ten real cases. Sections 2 and 4 ask the hardest questions. Read your own answers there first.
If you finish the sheet and want a second opinion on the automate, document, pilot or stay-manual call, book a consultation. Bring the filled-in page. It makes the conversation shorter and sharper.
Sources
- Anthropic, Building effective agents, December 2024: engineering guidance on when structured workflows beat autonomous agents.
- NIST, AI Risk Management Framework, AI RMF 1.0, January 2023: a voluntary framework organised as govern, map, measure and manage.
- DLA Piper Africa (Manokore Attorneys), A quick-start guide to Zimbabwe's data protection regulations, November 2024: on the Cyber and Data Protection Act and SI 155 of 2024.
Updated: August 2026.
Run the audit, then talk it through
Fill in the worksheet for one workflow, then bring it to a conversation. We will give you a straight opinion on whether to automate, document first, pilot or stay manual.
About the author
Simon
Simon writes about websites, lead capture, and digital growth for real estate agencies in Zimbabwe.
