1. Agree the question and scope
Before reviewing anything, we agree what the organisation needs to be able to answer, which teams, systems or workflows are in scope, what evidence is expected and what is explicitly out of scope. This keeps the review proportionate and prevents a broad claim from being made on narrow evidence.
2. Understand the work
We speak with the people who operate, oversee and are affected by the process. We look for the difference between documented procedure and actual practice, including informal AI use that may not appear in a system register.
3. Review the evidence
Evidence may include policies, risk registers, supplier information, data flows, process documents, approvals, evaluation records, sample outputs and incident information. Missing evidence is recorded as missing; it is not silently replaced by an assumption.
4. Map risk, opportunity and restraint
We consider these together. A workflow can be a credible automation opportunity while still being unready because of a data, ownership or policy dependency. Equally, a well-controlled process may still be a poor candidate for AI.
5. Label each claim
Evidenced
Directly supported by material reviewed within scope.
Estimated
A bounded estimate with its assumptions made visible.
Our judgement
A professional interpretation, clearly separated from observed fact.
6. Test the findings
Draft findings are checked for factual errors, missing context and unclear ownership. A factual review does not mean that difficult conclusions are negotiated away; it ensures the conclusion is based on an accurate account.
7. Write for the person who has to explain it
The report is written for the person who must explain the position to a board, regulator, funder, client or membership. Each priority finding should answer: what we found, why it matters, what evidence supports it, what should happen next and what remains uncertain.
Independence and limits
Our recommendations aren't shaped by what we sell. Mise may help with follow-on work where appropriate, recommend another specialist or advise that no intervention is needed. We do not provide accredited certification or replace legal advice.
What good evidence looks like
Good evidence is relevant to the actual use, attributable, current enough for the decision and capable of being reviewed. A polished policy that nobody follows is weaker evidence than a modest process with clear owners, records and tested escalation.