A board sits through a financial audit. Revenue up. Margins up. Cash flow healthy. The income statement averages out to a comfortable read. And then the auditor pauses on one paragraph deep in the notes: a material weakness in internal controls over revenue recognition.
The opinion is qualified. Questions get asked. Nobody in the room says "yes, but our averages are great" — because everyone in the room already knows that a single material weakness cannot be averaged away. The strength of the rest of the financial picture does not compensate for it. The audit committee's job is to surface the weakness, not to integrate it into a comforting score.
That instinct — that one material weakness invalidates the aggregate — is exactly the instinct missing from how the market scores AI readiness in 2026.
Picture this on an AI readiness scorecard
A scorecard lands on a board agenda. The headline number is 6.7 out of 10. The executive team reads it as "above threshold" and the conversation moves on to implementation.
Three months later the programme is halted. An audit committee member has noticed that one of the underlying pillar scores was a score of 2 out of 10. Not a 6. A 2. Buried inside a comfortable-looking average.
This is the central failure mode of the AI readiness market in 2026. Scorecards are computed, published, and read as weighted averages. Averaging produces a single number that compresses genuinely incompatible signals into a plausible one. And the plausible number is precisely the number a regulated enterprise cannot afford.
A different approach treats AI readiness the way a financial audit treats internal controls — not as something to average, but as something to surface.
Three questions, and what happens when you combine them
For any candidate AI use case, a board needs three independent questions answered:
Is this technically feasible?
Does the technology actually exist for this work; is the data clean enough; will it scale.
Can the workforce calibrate it?
Are the people skilled enough to know when the AI is right — and when it is not.
Is the governance mature enough?
Can the firm absorb the cost of being wrong; are the controls auditable; is the regulator's threshold met.
Each question gets a score, 0–10, on a published instrument. The question is how the three scores combine.
The market defaults to the weighted average — add the three, divide by three, present the headline. Tidy. Comparable. High numbers feel like high readiness.
The alternative — drawn from reliability engineering, not management consulting — multiplies the three together and normalises to a 0–100 scale. The unforgiving result: a weak score does not smooth out. It dominates. The chain is as strong as its weakest link.
That choice is not a rhetorical preference. It is a specific mathematical stance from the same reliability engineering that has governed how safety-critical systems are designed since the 1940s. And it is the reason an audit committee's third question lands differently under the two models.
A worked example a board member will recognise
Two candidate activities. Each scored on the three pillars.
Reconciliations automation
Feasibility 9 · Workforce 9 · Governance 9. Strong across the board.
Averaging model: 9.0 / 10
Weakest-link (0–100): 73
Customer complaint triage
Feasibility 9 · Workforce 9 · Governance 2. Two strong scores and a single failing control.
Averaging model: 6.7 / 10 (above threshold)
Weakest-link (0–100): 16 (governance problem)
Under the averaging model, both activities look above the line. The executive team walks out of the readiness review with two priorities.
Under the reliability-engineering model, the executive team walks out with one priority and one governance problem.
Now ask the audit-committee question: which version of the score does the audit committee want the firm to have used?
The 2 needs to be exposed as a 2. Not buried inside a 6.7. A weakest-link score obliges. An averaged score obfuscates. That is not a presentation preference. It is the governance standard.
Why averaging feels right — and why it fails
Averaging has intuitive appeal. It treats every dimension as equally important. A strong pillar compensates for a weak one. It produces a single number that is easy to compare across activities.
It is also the wrong model for this class of problem.
AI transformation readiness is not an additive problem. It is a necessary-condition problem. A business activity cannot be AI-led if it is technically infeasible. It cannot be AI-led if the workforce cannot calibrate the AI's output. It cannot be AI-led if the governance is immature and the cost of error is catastrophic. Any one of those three conditions, alone, stops the transformation. The other two do not compensate.
A weakest-link model expresses that logic correctly. An additive model produces a number that is plausible in aggregate and wrong at the activity level. The two disagree on which activity to prioritise — and the disagreement matters, because regulated enterprises answer their audit committee's questions at the activity level, not at the portfolio level.
The academic lineage
The doctrine is not original. It is drawn from classical reliability engineering — the series-system reliability theorem that has governed engineered systems with dependent components since the 1940s.
In a series system, total reliability is the product of the component reliabilities, not their average. Three components each 90 per cent reliable, in a chain where any failure brings the system down: 0.9 × 0.9 × 0.9 = 0.729. Not 0.9. The product.
A chain's strength is its weakest link. In reliability engineering that is not a metaphor. It is a theorem.
Applying that theorem to AI readiness is the contribution. The existing market still uses weighted averages because the templates were inherited from strategic-capability assessments — where the underlying problem is genuinely additive. For those problems, averaging is correct. For AI readiness scored at the activity level, averaging is category-mistaken.
What this changes for the board
Three things.
1. What the scorecard looks like
Headline numbers stop being comforting. A high score requires strength across all three pillars — not two out of three.
2. What the scorecard discloses
A failing pillar doesn't just pull the headline number down. It becomes the headline. An audit committee sees the weak pillar the way it would see a material weakness in a financial audit.
3. What the scorecard prescribes
A pillar weakness stops looking like a polish problem and starts looking like what it is — a structural constraint that has to be closed before the activity moves.
The scorecard becomes an investment-lever map. Weakest-link scoring makes the lever explicit. Averaging makes it invisible.
Why the market still averages
Three reasons. None of them defensible on the audit-committee floor.
Precedent
Readiness scorecards are inherited from strategic-capability assessments, which are genuinely additive problems. The template carries over even when the underlying problem is structurally different.
Optics
Averaged scores skew high. A 6.7 is a comforting number. An executive sponsor who has paid for an assessment prefers the 6.7 to the 16. So does the firm that sold the assessment.
Analytical convenience
Additive models produce tidy charts and tractable portfolio comparisons. They also produce scorecards that do not survive the audit committee's third question.
The market will move to weakest-link scoring when audit committees force the move. Some already have. Most have not.
The board-floor question
The question every audit committee asks of a financial control is the same: what was the weakest control, and what was done about it?
That question applies to AI readiness, and it has the same form. A weakest-link readiness score lets a board answer it. An averaged one does not.
That is the difference between a governance instrument that helps the board,
and a scorecard that just helps the procurement memo.
By Krishna Goli, Co-founder, Compass · Hexalink Ltd.
Previously: delivery leadership at Domino's Pizza Group, Vitality Life, Capgemini, Fujitsu, ING Bank, Thomson Reuters.
Compass is a joint venture between Hexalink Ltd and Novoflux. Patrick Hyland (Founder, Novoflux) is co-founder of Compass.