$ cat audit-checklist.md

AI SDLC audit checklist

A self-check for engineering leaders whose teams use AI coding tools. Answer each item yes or no, and be strict: if you'd have to go and find out, the answer is no.

It takes about 15 minutes. The unchecked items show where AI is probably costing you more than you think.

Dominique Legault · ReliableGenius

0 / 31Check every item that's true for your team today.

1Visibility

0 / 4

You know which AI coding tools each team uses, and which ones are paid for by the company.
You can tell which merged pull requests were mostly written by an agent.
You know roughly what you spend on AI tools and model usage per engineer each month.
Someone owns AI tooling decisions for engineering as part of their actual job.

2Delivery results

0 / 4

You measured delivery (lead time, deploy frequency, change failure rate, time to restore) before the AI rollout, so you have a baseline.
You've compared those numbers since the rollout, and they improved.
Rework is tracked: code that gets rewritten or reverted within a few weeks of merging.
Your engineers would say AI makes them faster on your main, older codebase too.

3Deciding before building

0 / 5

Tickets have a written Definition of Ready that the team actually follows.
Open questions on a task get answered before an agent or engineer starts it.
Specs and acceptance criteria are written down where an agent can read them.
When an agent makes a design decision mid-task, it gets surfaced to a person.
Your backlog is ordered by something more than whoever asked loudest.

4Review and quality

0 / 5

Reviewers are keeping up. The queue of PRs waiting for review hasn't grown since the rollout.
Large PRs get the same depth of review as small ones. Whether people or agents do the reviewing, your team has decided how much change it can review well, and sticks to it.
AI-written code has to meet the same test coverage bar as human-written code.
Every AI-written change is reviewed by a person or by a different model from the one that wrote it.
Security scanning runs on every change, including the ones agents open.

5Governance and risk

0 / 5

There's a written policy on what agents may and may not do (touch production config, change auth code, add dependencies).
Agents run with the minimum permissions they need, in isolated environments.
Secrets and customer data can't end up in prompts or model context.
For any change, you can show who or what wrote it, who reviewed it, and what checks it passed.
If you're in a regulated industry, you know which rules apply to AI-assisted development (for example the EU AI Act, NIST AI RMF or ISO 42001) and where you stand.

6Context and knowledge

0 / 4

Architecture decisions are recorded somewhere agents and new hires can find them.
Agents start each task with project-specific context: conventions, patterns and domain terms.
Lessons from past incidents and mistakes make it back into what agents see.
Your internal docs, tickets and wiki are searchable enough that an agent could find the answer a senior engineer would give.

7People

0 / 4

Engineers have had real training on working with agents, beyond being handed a license.
Senior engineers spend most of their time on design and decisions. Cleaning up agent output is a small part of their week.
Junior engineers can explain the code they ship, including the parts an agent wrote.
You have a way to share what works between teams.

Scoring

0 to 10AI is mostly running on its own. Expect rework, review bottlenecks and risk you can't see yet. Start with sections 2 and 4.

11 to 20You have the basics, but probably can't prove AI is paying off. The gaps are usually in sections 3 and 6.

21 to 31You're in good shape. The next step is letting agents take on more of the work under clear rules, with people making the decisions.

What the full audit adds

This checklist tells you where to look. The AI SDLC Audit goes and looks: interviews across engineering and product, your actual delivery data before and after AI, and a review of how agents are set up in your repos and pipelines. You get a written report and a prioritized plan in two to three weeks, for a fixed fee.

See the audit