The method, in practice.

The situation

Staff had adopted three different AI assistants on their own, two of them touching client financial data. Partner reporting lived in a dozen hand-built spreadsheets refreshed by one person, quarterly, by hand.

The method applied

• AI Use Policy written and adopted by the partners, with rules for each kind of client financial data
• The assessment flagged the two tools reaching client data; one approved, one retired
• Applications assessment mapped the practice-management, tax, and billing systems for connection
• Base dashboard set up in the firm's own Microsoft cloud account

Where they stand

Partner reporting comes from the dashboard, not the spreadsheet chain. IT spend is reviewed monthly. The next automation on the plan replaces the manual client onboarding checklist.

Read the full profile

The situation

Production, inventory, and finance each ran their own system, and leadership saw a combined picture once a month, assembled by hand from spreadsheet exports. AI use was officially not allowed and unofficially everywhere.

The method applied

• AI Use Policy replaced the ban no one could enforce with rules people could actually follow
• The assessment listed the AI tools staff had signed up for on their own under the ban
• Applications assessment marked the ERP, warehouse, and accounting systems as ready to connect
• Base dashboard set up with production, inventory, and spend views in one place

Where they stand

The monthly hand-assembled report is gone; leadership reads the same dashboard the floor managers do. First automation on the plan: an alert when inventory and production numbers disagree.

Read the full profile

The situation

The firm came asking for AI automation, but had no written rules, no list of its systems, and no single view of its own numbers. Building automation on that footing would have meant automating chaos.

The method applied

• The review first: policy adopted, AI use assessed, and the request for an AI assistant tested against the setup
• Applications assessment found the CRM and time-tracking systems could feed one platform
• Base dashboard set up with the standard report on what technology costs
• Only then: the automation conversation, now grounded in real data

Where they stand

The automation they originally asked for is being built into the platform they now own, under their policy, fed by their systems, on the subscription they already pay for.

Read the full profile

The situation

Front-desk staff across three sites were using an unapproved AI tool to draft patient letters. The practice administrator suspected it, could not prove it, and had no rule to point to. Reporting came from practice-management exports no one checked against each other.

The method applied

• AI Use Policy adopted with one hard rule: no patient-identifiable data outside the practice's own Microsoft account, and a named owner for exceptions
• The assessment confirmed the unapproved AI tool use at all three sites and found a transcription tool the clinical lead had bought on a company card
• Applications assessment mapped practice management, scheduling, and billing; the transcription tool went through an access review and stayed
• Base dashboard set up in the practice's own Microsoft cloud account; AI security features switched on to enforce the patient-data rule

Where they stand

Patient letters are drafted in an approved tool inside the practice's own account. The monthly AI report shows blocks and approvals by site. Reporting on visits, billing, and no-shows comes from one dashboard.

Read the full profile

The situation

No IT staff, an outside IT firm on a basic contract, and a development director building grant reports by hand from the donor database and the accounting system every quarter. Volunteers were using free AI tools on donor lists.

The method applied

• AI Use Policy adopted by the board with donor data as protected information; volunteers covered in writing
• The assessment found donor exports in two personal AI accounts; both closed
• Applications assessment connected the donor database and accounting; the grant-tracking spreadsheet was marked for replacement
• Base dashboard set up in a new Microsoft cloud account owned by the nonprofit; vCIO Advisory tier added for the board

Where they stand

Grant reports come from the dashboard in an afternoon. The board receives a quarterly technology brief from the vCIO. IT spend is visible for the first time, and one duplicate subscription was canceled.

Read the full profile

The situation

An acquisition arrived with its own Microsoft account: 18 mailboxes, three years of files no one had permission-checked, and a renewal date nine weeks out. Sales wanted Copilot, the license list did not match the staff list, and a second account was quietly doubling the admin work.

The method applied

• Licensing review across both accounts: 68 licenses bought against 51 active users, with a renewal nine weeks out
• Microsoft 365 tenant review ranked the findings: five top-level admin accounts, old password-only sign-in still on, 14 anyone-with-the-link sharing links, nine apps awaiting approval
• Fixes made alongside the IT firm: admin accounts cut to two, password-only sign-in blocked, sharing links and app approvals closed out one by one
• Move between the two Microsoft accounts planned first, then run: sign-ins, mail, files, and Teams, with permissions reviewed on the way through rather than copied wholesale
• Copilot readiness after the permissions settled: sensitive files labeled, a 12-person sales pilot, use measured against cost per active user
• Microsoft 365 monthly watch: license and usage reporting, Microsoft's security score trend, the renewal calendar, sharing changes, and apps awaiting approval

Where they stand

One Microsoft account, one renewal, and a license bill that matches active use. The monthly watch reports the account in the same place as the AI dashboard reporting, so the next renewal arrives with the decision already written.

Read the full profile

The situation

Ninety staff, an outside IT firm that did good work, and a leadership team that met it quarterly, with every meeting starting with what had broken. Three AI tools had been bought department by department, and the ERP renewal was eighteen months out with no plan attached to it.

The method applied

• AI Use Policy adopted first; the assessment listed the AI tools bought under it
• Base dashboard set up with the standard report on technology costs, so license, vendor, and subscription spend sat in one view
• vCIO Program started monthly: plan review, vendor renewals, and written priorities for the IT firm
• IT firm scorecard agreed and reviewed monthly; problems routed to the vCIO instead of the owner
• Dashboard maintenance and the AI security subscription on the same monthly rhythm, with the maintenance note opening the leadership meeting
• Annual IT budget built from the dashboard's cost report; automation plan agreed with leadership, one feature a quarter

Where they stand

The IT firm has written priorities and a scorecard. Renewals are negotiated from a calendar rather than a reminder email. Two automations from the plan are live and the third is scoped from what the dashboard showed.

Read the full profile

The situation

Two companies merging into one, a new ERP already signed for, and the IT director gone. The board was being asked to approve technology spend against a plan no one in the room could explain, and the two companies' AI tools had never been put side by side.

The method applied

• AI Use Policy written for the combined company before the two setups were joined
• The assessment run across both companies; duplicate AI tools priced before their renewals landed
• Applications assessment for the merged business: what replaces what, in what order, and what waits a year
• Weekly place in leadership and operations meetings; every ERP and migration decision made with a written assessment attached
• Board briefing pack ahead of the approval vote, and support on the due diligence for a second acquisition
• Interim IT leadership while the search ran, then a handover pack for the incoming director

Where they stand

The ERP went live inside the agreed window with the AI policy already in force across both companies. The new director inherited a technology plan, a license inventory, a renewal calendar, and an open decision list instead of a stack of vendor email.

Read the full profile