AI Audit Cost and Duration

The cost and duration of an AI audit come from the work required and the sequence in which that work can happen. Auditor effort, internal staff effort and elapsed calendar time are different quantities. A thirty-person-day assessment does not necessarily finish in thirty days, and assigning three people does not automatically reduce it to ten. Access, evidence preparation, specialist availability and review dependencies can dominate the calendar.

This guide gives procurement and delivery owners a practical way to estimate capacity and timing before seeking a quotation. All quantities and rates in the worked example are hypothetical planning assumptions, not Open for AI prices, Saudi market benchmarks or delivery commitments. Commercial inclusions, pricing models and quote comparison are covered separately in AI auditing pricing. Here the objective is to understand what work the budget and schedule must support.

Define the unit of work before asking how long

“One AI system” is not a reliable unit of audit effort. One application may contain several languages, user roles, data sources and action paths. Another may be a narrow read-only model with stable inputs. Start with the claims to examine: performance on defined tasks, access boundaries, approval behaviour, source support, operating records or supplier evidence. Then identify the procedures needed for each claim.

Record the version and environment to be examined, the period of operation, available evidence and exclusions. A design review with controlled tests has different work from a period-based operating review. If the buyer needs both, the estimate should show both. Scope definition is therefore an estimating input, not an administrative activity that can be left until after the price and deadline are fixed.

The GAO Cost Estimating and Assessment Guide is a useful public reference for structuring estimates around a baseline, work breakdown, assumptions and uncertainty. It is not an AI audit rate card or a Saudi procurement rule. The calculation below applies that planning logic to an original, deliberately bounded audit scenario.

Separate four kinds of time

Auditor effort is the productive work required from the assessment team. Client effort is time spent preparing records, arranging access, explaining the workflow and reviewing factual matters. Waiting time occurs when a dependency is unavailable. Elapsed time is the calendar interval from the agreed start to the defined deliverable. Adding effort and waiting without modelling overlap produces misleading estimates.

Also distinguish working days from calendar days. A plan expressed in nineteen working days cannot be converted into an exact completion date without the relevant calendars, holidays, availability and start conditions. Review windows should be agreed with named people. “The business will respond within two days” is weak planning if the only qualified reviewer is unavailable for a week.

The start condition matters as much as the finish date. A provider may be ready to begin while test access, evidence authority or supplier participation remains unresolved. Define whether the engagement starts at signature, mobilisation or evidence readiness, and show these as separate milestones. Otherwise both parties can believe they agreed to the same duration while measuring different intervals.

Worked example: a bilingual technical-enquiry assistant

Assume a hypothetical industrial distributor uses an assistant to draft replies to technical enquiries in Arabic and English. Staff review replies before sending them. The audit covers one application version, one approved document collection, two user roles and the draft-to-review workflow. It examines selected answer support, review-state enforcement and evidence retention. It excludes product engineering certification, live customer sending and a comprehensive review of every corporate system.

Assume further that a usable test environment exists, masked cases can be provided, the document owner can resolve reference questions and the supplier permits the agreed testing. These are dependencies, not facts about every engagement. If an assumption fails, the estimate must be revised or the conclusion narrowed. Hiding an access gap inside an optimistic effort number does not make the gap disappear.

Illustrative bottom-up effort estimate, measured in person-days

Work package	Planning quantity	What produces the work
Scope and criteria	4 auditor person-days	Confirm claims, boundaries, reference decisions and evidence authority
Evidence examination	6 auditor person-days	Inspect documents, configurations, operating records and completeness
Test design and reference review	5 auditor person-days	Prepare bilingual cases, selection logic and reviewer criteria
Execution and investigation	8 auditor person-days	Run authorised procedures, investigate exceptions and preserve evidence
Analysis and report preparation	5 auditor person-days	Develop findings, assess limitations and finalise the report
Independent quality review	2 auditor person-days	Challenge evidence-to-conclusion reasoning and reporting consistency
Total external effort	30 auditor person-days	Sum of the six work packages; no remediation implementation included

The table estimates work, not how many days the buyer must wait. Each quantity needs a basis. For example, test design depends on the number of distinct tasks and the difficulty of establishing acceptable answers, not just the number of generated responses. Arabic review may require a subject-matter reviewer who understands both the terminology and the source material; treating it as automatic translation understates effort and weakens the audit.

Turn effort into a dependency-based calendar

The hypothetical plan uses three suitably qualified people when evidence work and test preparation overlap, and fewer at other times. It assumes prompt access and availability. Initial test preparation can begin from approved scope, but final cases must reflect evidence findings before execution. Report finalisation waits for factual responses. A colleague who is available but lacks the required language or technical competence cannot simply replace a constrained specialist.

Illustrative nineteen-working-day sequence for the thirty-person-day estimate

Working days	Activity and effort	Dependency
1–2	Scope and criteria: 4 person-days across two people	Named decision owner and initial system information
3–5	Evidence examination: 6 person-days across two people	Authorised access and complete enough exports
3–7	Test preparation: 5 person-days by a separate evaluator	Initial scope; final design incorporates evidence review by day 7
8–11	Execution: 8 person-days across two people	Stable test version and approved fixtures
12–13	Initial analysis and draft: 3 person-days	Material exceptions sufficiently investigated
14–15	Quality review: 2 person-days	Draft findings and supporting work available
16–18	Client factual-response window: 3 elapsed working days	Named reviewers available; external effort not added in this assumption
19	Finalisation: 2 person-days across two people	Responses received; no new material evidence requiring further testing

The arithmetic remains thirty auditor person-days: four plus six plus five plus eight plus three plus two plus two. The three-day response window adds elapsed time, not assumed auditor effort. The calendar is an illustration, not a guaranteed schedule. If factual review introduces a new material version, the finalisation assumption may fail and further work must be planned.

The GAO Schedule Assessment Guide explains why dependencies and schedule risk matter to credible planning. Applied here, the lesson is simple: adding staff to an activity that is waiting for evidence does not remove the wait. Adding a reviewer late can also create handover and quality-review work. Capacity and sequence must be considered together.

Estimate the buyer's effort explicitly

The client contribution is often omitted from proposals and then appears as an unexpected burden on operations. In this hypothetical case, assume eighteen internal person-days: three for the business owner, five for technical and access support, four for evidence preparation, four for bilingual subject-matter review and two for factual response and coordination. These are illustrative capacity reservations, not mandatory staffing levels.

Internal work should not duplicate the auditor's judgement. The document owner can explain which source is authoritative and resolve factual ambiguity, but should not choose only favourable cases or rewrite historical records. The technical team can provide exports and explain configuration, while the auditor assesses their relevance and reliability. The estimate should include time to resolve questions without giving management control over unfavourable conclusions.

Schedule the scarce internal roles early. If the Arabic technical reviewer can contribute only half a day per week, four person-days of work may span a much longer period than the external plan assumes. Record availability as capacity per week and identify which tasks require that person. This makes the source of delay visible and gives management a real choice about resourcing or scope.

Translate capacity into an illustrative budget

For a planning calculation only, apply an invented blended external rate of SAR 3,000 per person-day to the thirty-person-day estimate. The resulting external effort allowance is SAR 90,000. A hypothetical twenty-percent uncertainty reserve adds SAR 18,000, giving a planning allowance of SAR 108,000. These figures are not a quotation, a market average or an assurance that the work can be purchased at that rate.

The calculation excludes applicable taxes, travel, third-party testing charges, specialist legal work, remediation implementation and the organisation's internal labour cost. Whether any of those belong in a real commercial quote must be agreed separately. The reserve is a planning response to uncertainty; it is not automatically a fee owed to the provider, and it should not conceal a known work package that has simply been left out.

Internal effort can be valued using the organisation's own approved cost assumptions if needed. Avoid presenting salary divided by days as a precise opportunity cost without considering availability and displaced work. For some buyers, the more useful metric is which operations or change projects will be delayed while the evidence owners support the audit.

Use sensitivity analysis to identify the real cost drivers

Ask what changes the estimate materially. In the hypothetical scenario, adding another materially different workflow might add five person-days, an evidence-access workaround four, and another language three. Together those assumptions would raise effort from thirty to forty-two person-days. At the same invented rate, the external effort allowance becomes SAR 126,000 before any reserve or exclusions. None of these increments is a universal unit price.

The corresponding calendar cannot be calculated by adding twelve days automatically. Some work may run in parallel; some may extend the critical sequence. A new language may depend on one unavailable specialist. An access workaround may delay all testing. A second workflow may share evidence while requiring independent execution. Rebuild the dependency plan rather than scale the original duration by a percentage.

Distinguish uncertainty from scope change. Uncertainty concerns how much effort an agreed procedure will require; scope change adds or alters the work requested. Both may affect budget, but they should be recorded separately. This allows the buyer to understand whether the baseline was unrealistic, evidence quality changed or management deliberately expanded the question.

Why evidence quality changes both effort and duration

A large evidence folder can increase work if documents contradict each other, versions are unclear or exports cannot be reconciled. The team must first establish what can be relied upon before drawing conclusions. A concise, traceable package can reduce avoidable clarification without reducing test depth. Preparing for an AI audit explains how to organise existing records without manufacturing a favourable history.

Missing evidence creates a decision, not an unlimited investigation mandate. The parties can obtain the evidence, agree alternative procedures, narrow the conclusion or stop the affected work. Estimate each option before continuing. If a supplier cannot provide operating records, ten more days of interviews may still fail to answer the original question. The schedule should show the point at which that limitation is escalated.

Version stability matters too. A changed model, source collection or approval path can invalidate part of a test plan. Agree a baseline and a change-notification process. The organisation may legitimately need to fix a serious issue immediately, but the audit must record which evidence belongs to the old and new versions and whether retesting is additional work.

Plan remediation and retesting as separate decisions

The time needed to identify a finding is not the time needed to repair it. Remediation may depend on supplier releases, data rebuilding, policy decisions or integration changes. Do not promise a fully remediated system by the audit report date unless the specific implementation work is understood and contracted. The report should identify what must happen before closure can be evaluated.

Reserve retesting capacity against a defined set of findings or a stated allowance, with clear assumptions about the changed version and evidence readiness. A retest of one corrected transition differs from repeating an entire bilingual evaluation after a model replacement. AI audit retesting should be scoped around the closure claim, not treated as an unspecified final meeting.

Stress-test the calendar against named bottlenecks

Take the nineteen-working-day illustration and ask what happens if the factual-response window cannot begin on day sixteen. If the responsible reviewer is unavailable, finalisation cannot simply proceed on day nineteen under the original assumption. Some reporting work may continue, but unresolved factual matters must either be addressed later or remain clearly stated limitations. The revised completion point depends on the actual response and any new investigation it creates.

Now consider a different constraint: test access is available, but the bilingual reference reviewer is not. Execution without agreed reference decisions may produce outputs that cannot be judged consistently. Adding more test operators would increase activity without resolving the bottleneck. The sponsor can reserve the specialist earlier, narrow the task boundary or revise the sequence; the estimate should show how each option changes the evidence the audit can produce.

Record these constraints separately from productive effort. A provider may need only a small amount of additional work but a longer booking interval because the right specialist is available later. Conversely, a short calendar can require more effort if several people must work in parallel and coordinate their conclusions. Neither effect should be hidden by quoting one undifferentiated number of days.

Set a decision rule for investigation that expands

An unexpected exception can lead to a focused investigation or reveal that the original evidence plan is inadequate. Agree a point at which the team explains the new question, work completed and options before expanding further. The buyer can then choose deeper investigation, an alternative procedure or a bounded limitation. This protects necessary professional judgement without turning every uncertainty into unlimited effort.

In the enquiry-assistant example, several unsupported replies may trace to one obsolete document. Investigating that common cause differs from discovering unrelated failures across access, source selection and review-state enforcement. The estimate should respond to the evidence pattern. Do not multiply the original test count mechanically or assume that one repair closes every exception merely because the symptoms look similar.

For budgeting, distinguish the most likely work plan from a stress scenario. A reserve should have a stated purpose and a person authorised to release it. If the baseline changes because the buyer adds another workflow, update the baseline rather than quietly consume uncertainty reserve and pretend scope stayed constant. A transparent record lets the sponsor learn from the estimate instead of seeing only a final variance.

At completion, compare planned and actual work by package and explain the material differences. This is useful input for the next assessment of the same environment, but it should not become a universal rate or duration benchmark. Another application may have different evidence quality, consequences and access even when it uses the same model supplier.

Manage the estimate during delivery

Maintain a short variance record showing baseline effort, effort used, work remaining, elapsed delay, cause and decision. A rising percentage-complete figure is unhelpful if the most uncertain procedure has not begun. Report progress by evidence-backed milestones: scope agreed, population reconciled, cases ready, tests executed, findings reviewed and report finalised.

When the forecast changes, state the options and their effect on the conclusion. Reducing coverage can save work, but the limitation must be visible. Adding capacity may help a parallel task, but it cannot make missing historical evidence exist. Extending the calendar may preserve depth without increasing all fee components. These choices should be explicit rather than hidden inside a revised end date.

For an audit scoping discussion about cost and timing, prepare the system boundary, available evidence, review period, languages and key staff availability. Open for AI's AI auditing services can then be scoped around the required decision. A defensible estimate explains the work, assumptions and dependencies that make the number meaningful.