NIS-2
Readiness for the EU NIS-2 directive. Standard in Growth Platinum and Enterprise Platinum. Option in the others.
/consulting/aip // QA10 methodology
AI Process Intelligence Audit (AiP) — see how your company really works.
This is not an IT audit. It's an organizational culture and process analysis. We spend working hours with people at every level, from management to operations, and synthesize three different versions of the same truth into one map on which decisions can be made. Lean, Six Sigma, MUDA live in your company; Process Mining where system data makes sense.
What is the AiP Audit
The AiP Audit is not an IT audit — it's an audit of the organization that uses IT.
The AI Process Intelligence Audit starts with people, not systems. We dedicate working hours to employees at every level: management, department heads, operations. Each describes processes as they see them from their position. Then we confront three perspectives with what the data shows. Result: an AS-IS map that is closer to reality than documentation in a drawer and closer than management's intuition.
The truth is always in the middle.Management knows how it was supposed to be. The department head knows how it should be. The employee knows how it actually is. None of these three perspectives alone is the full truth. The AiP Audit is about working with all three simultaneously, adding hard data from systems (where available), and building a map on which your management makes decisions.
What the audit covers
- Structured interviews with employees at all levels: management, middle management, operations.
- Gemba walk: the auditor walks with an employee through the process from start to finish.
- Activity classification according to Lean (VA / NVA / NNVA).
- Identification of seven types of MUDA: overproduction, waiting, transport, over-processing, inventory, unnecessary movement, defects.
- Toyota's 5 Whys technique for finding the root cause of every problem.
- IT infrastructure diagnosis: systems map, integrations, stack.
- Cybersecurity maturity level assessment.
- Process Mining on system data, if you have it and if it makes sense.
- AS-IS map in BPMN 2.0 standard as the final synthesis product.
What the audit does NOT include
- Financial analysis, legal compliance review, tax verification. These are different specializations; we will recommend the right partner.
- A strategic interview with management that ends with recommendations to "do digital transformation."
- Process Mining as a standalone tool. Log analysis without confrontation with people gives one version of the truth — the system version. That is not yet the truth.
- Full-scale information security audit per ISO 27001. We assess levels and flag gaps; certification is done by a specialist firm.
- Implementation. The audit ends with a plan; execution is led by a separate stage with Engineering Lab or your team with our plan in hand.
Wi-Fi
Wireless audit by a network partner, coordinated by QA10. Option in every variant.
Who it's for
Three company segments we work with.
We scale the AiP Audit to the size and operational maturity of your company. A Start-up gets a condensed analysis of key processes before scaling. With Growth we work with full methodology across multiple departments. Enterprise combines diagnosis with a Change Management program for the entire organization.
Start-up
1–5 employees, 100–200 documents per month, no dedicated departments or max 2–3. The company may not yet have an ERP or CRM. Processes live in founders' heads, Google Sheets, Slack message history.
Growth
5–60 employees, dedicated departments, documented procedures, middle management. Several systems (ERP, CRM, WMS) that don't fully communicate. Each department has its own version of processes.
Enterprise
60+ employees, multiple branches, mature organizational culture, multi-level decision-making structure. Transformation requires a Change Management plan, competency mapping and internal communication strategy.
Note on EU formal classification: segments (Start-up, Growth, Enterprise) are matched to operational maturity, not to EU Regulation 651/2014 criteria. If you are applying for grants — we will verify the classification together during a call.
Scale
Fewer than 100 documents a month and under 5 people. Even Basic costs more than it returns.
Scope
Financial analysis, legal compliance, tax. Different work. We name a partner.
Deck
A SWOT slide for the board. We deliver maps and Excel models, not a chart pack.
How the AiP Audit works
Gemba. MUDA. ABC. Board.
Lean in the field (interviews, gemba, MUDA) plus Process Mining and Activity-Based Costing. Express: one week per piece. Basic: up to 90 days. Platinum adds on-site visits and longer documents.
- Gemba
Process discovery: three perspectives and data
We start with people. Structured interviews with management (how it was supposed to be), with department heads (how it should be), with operations (how it actually is). Gemba walk: the auditor walks with an employee through the process at the actual place of execution. Where the company has systems collecting logs, we also reconstruct process flows in BPMN 2.0 analytically. Four sources of truth for confrontation. In parallel, we map the IT infrastructure.
- MUDA
MUDA analysis and Activity-Based Costing in the field
We classify every activity mapped in Gemba according to Lean (VA / NVA / NNVA). We identify seven types of MUDA: overproduction, waiting, transport, over-processing, inventory, unnecessary movement, defects. For each activity we calculate the actual cost through Activity-Based Costing. You learn that handling one invoice costs PLN 100, and with automation it should cost PLN 18. The difference × volume = a concrete amount.
- ABC
Solution Design and Financial Impact
For each of the TOP 5 processes we design architecture in three scale variants. Core is building a data-driven company — eliminating data silos and creating a coherent information ecosystem. Performance is automation that sets the pace for competitors. Enterprise is pioneering automation and robotization. We calculate NPV, IRR, Payback and sensitivity analysis.
- Board
Executive presentation and Quick Wins plan
We present results to your management board, online or at your site. In Platinum three on-site visits (two before the audit for deep organizational understanding, one after for the presentation). We discuss Quick Wins: 3–5 optimizations deployable in 30–60 days, most often without capital expenditure. If you are interested in the EU funding path, we start the Funding process in parallel.
Docs
10 core in every variant. Express adds 2 specialist. Platinum adds 8.
Technical stack
What we use during the audit.
We combine classic teamwork methods (interviews, Gemba, Lean) with analytical tools (Process Mining, ABC). Where needed, lightweight Python scripts for data extraction from systems are added.
Teamwork methods
Structured interviews with employees at all levels (management, department heads, operations) · Gemba walk — observation of work at the place of execution · Lean classification: Value-Added / Non-Value-Added / Necessary-NVA · MUDA — seven types of waste · 5 Whys (Toyota technique)
Process Mining
Event log analysis from ERP, CRM, WMS · AS-IS reconstruction in BPMN 2.0 · Detection of variants, loops, bottlenecks · Confrontation of system data with interview perspectives
Activity-Based Costing
Costing of each activity (not department) — full employee cost with overhead · Allocation drivers per process (orders → order department handling cost) · Unit cost matrix for TOP 5 processes
Audits and compliance
Cybersecurity maturity assessment (scale 1–5) · NIS-2 readiness audit (standard in Growth Platinum + Enterprise Platinum, optional in others) · Wi-Fi and wireless network audit — specialist partner, QA10 coordination
Data integration and extraction
Lightweight Python scripts where the client's API is insufficient · Log parsing (CSV, XES, JSON, custom dumps) · Secure copies of working datasets to isolated QA10 environment
Dashboards and documents
BPMN 2.0 (PNG, XML, Visio, SVG) · Financial models in Excel with sensitivity analysis · Executive Summary, Main Report (60–100 pages), Quick Wins Plan
Variants
Choose the variant matched to your company's segment.
We offer three AiP Audit variants: Basic, Express and Platinum. Each scales to three segments (Start-up, Growth, Enterprise). Differences concern delivery time, specialist documents, number of visits and accompanying programs.
Basic
Ten core documents. One auditor, email contact. No on-site visits.
- Start-up
- PLN 7,500 · 45 days
- Growth
- PLN 25,000 · 90 days
- Enterprise
- on request · 135 days
- 10 core documents
- One lead auditor
- Email contact
- Standard pace without time pressure
Express
10 + 2 documents (Funding Acquisition Plan, Competitive Benchmarking). One on-site visit. 15% discount on Funding.
- Start-up
- PLN 12,500 · 20 days
- Growth
- PLN 35,000 · 45 days
- Enterprise
- on request · 60 days
- 10 + 2 specialist documents
- Auditor + dedicated Project Manager
- One on-site visit
- 15% discount on Grant Monitoring (45 days from Acceptance Protocol)
Platinum
10 + 8 documents. Two auditors + Project Manager. Three on-site visits. Funding application included in audit price.
- Start-up
- PLN 25,000 · 60 days
- Growth
- PLN 90,000 · 75 days
- Enterprise
- on request · 90 days
- 10 + 8 specialist documents
- Two auditors (verification principle)
- Three on-site visits
- Funding application included
- 9% discount on QDeployment (12 months)
- YU-NA.io membership after implementation
Express
Recommended start. Fast delivery, Funding discount, two specialist documents, one on-site visit.
Platinum
9% on QDeployment for 12 months after report signoff. Core 150 000–1 500 000 PLN. Performance 250 000–50 000 000 PLN.
All prices net. Time in business days. Enterprise: individual calculation.
Dig.IT 2026 // ARP FENG 2.21
Dig.IT 2026 — grant for manufacturing SMEs.
The ARP program (FENG action 2.21) finances digital transformation of SMEs with PKD section C (manufacturing, 20–249 employees). Pool of PLN 140M, grants PLN 150–850k per company.
Funds
Digital maturity diagnosis (AiP Express qualifies) · automation (Document AI, RPA, integration) · software (ERP/MES/WMS) · 30% own contribution.
Path
AiP Express (4 wks, dossier) · funding application 4 000 / 7 000 PLN per Annex 4 · grant → QDeployment · QCare after a year.
The June 30, 2026 date on this page is past. We verify the live call before we file.
/consulting/aip/programs // additional funding and support paths
Accompanying programs — funding, AI agents, grant monitoring.
The AiP Audit is just the entry point. Additional funding and automation paths lower the activation threshold and accelerate time-to-value.
SmartFlow — flexible audit payment
Payment variant for the AiP Audit processed through a payment gateway with a choice of financial partner. Activation link within 2 business days of contract signing (valid 5 days). Decision rests solely with the financial partner based on creditworthiness assessment.
- Pekao S.A. — installments
- Erste Bank — installments
- Alior Bank — installments
- PragmaGO — installments or BNPL
- Inbank — installments
Full terms — Annex 3 to AiP Agreement. In case of partner rejection, automatic switch to CLASSIC variant (advance payment within 7 days of notification).
AI Agent Package
3 deployed AI agents running on your data (Claude via Bedrock + Vertex AI). Each agent takes over specific repetitive work: document parsing, classification, draft generation.
- Agent configuration for your stack (Microsoft 365 / Google / Custom)
- Polish legal-business corpus fine-tuned
- Infrastructure in EU (eu-central-1)
- Auditability of every agent decision
Grant Monitoring
9-month monitoring of competitive calls (EU funds, national, Norwegian, Polish-Japanese) for financing audit result deployment. Conducted by a certified EU Funds expert.
- Basic / Express add-on: 750 PLN net one-time
- Express: 15% discount (down to 637.50 PLN), valid 45 days from Acceptance Protocol
- Platinum: monitoring included in audit price
- Period: 9 months from Audit Acceptance Protocol
Funding Application
Separate service after positive qualification for an active call (confirmed in writing by an expert in Grant Monitoring). Complete application dossier: feasibility study, financial and risk analysis, technical documentation, regulatory annexes, representation in the evaluation process.
- Project up to 500,000 PLN: 4,000 PLN net
- Project over 500,000 PLN: 7,000 PLN net
- Platinum: Application included in audit price, regardless of project value
- Full terms — Annex 4 to AiP Agreement
Platinum variant // exclusive benefits
What you get in Platinum that's not in Basic/Express.
Check
Cross-check verification
Two auditors verify conclusions mutually. Mitigates single-analyst bias. Standard in finance, exceptional in Polish consulting.
9%
9% discount on QDeployment
After completing the Platinum Audit, if you choose implementation with QA10, you get a 9% discount on the QDeployment contract (Core/Performance/Enterprise).
12 mo
12-month implementation exclusivity
For 12 months we do not perform a similar audit for competitors in your category and region. The 9% on QDeployment is tied to that exclusivity.
Docs
8 specialist documents
Funding plan, benchmarking, Employment Impact, 3-year predictive model, Change Management, Digital Skills Roadmap, advanced benchmarking, communication strategy.
/consulting/aip/security // GDPR + EU-US DPF + subprocessors
Your data is secured at the contractual level.
Crypto
AES-256 at rest · TLS 1.3 in transit · 2FA · RBAC per project · 90-day session audit.
Transfer
EU-US DPF · SCC · TIA per processor · no EEA exit without SCC · list in DPA Z5.
DPA Z5
AWS Frankfurt · Vertex AI europe-west3 · Claude via Bedrock · Microsoft 365 · Celonis · UiPath · n8n · Make.
Full Data Processing Agreement (DPA) is part of the AiP Audit package in all variants. Current subprocessor list available on request — changes are subject to a 30-day right of objection.
Deliverables // 10 core + 2 Express + 8 Platinum
Concrete deliverables, not slides.
Every variant ends with the same set of ten core documents. In Express two specialist ones are added, in Platinum eight. Everything in editable formats. Everything your property — you may use it regardless of whether you decide to implement with us.
Core
10 documents. Every variant.
Express
+2 specialist. Also in Platinum.
Platinum
+8 extended. 20 in all if you take Platinum.
AiP Audit — 10 core documents
All variants- 01 Main Audit ReportPDF · 60–100 pp
Methodology, characteristics of audited areas, analysis of identified problems and strategic recommendations. Contains chapters covering the full list.
- 02 Executive SummaryPDF · 5–10 pp
Condensed synthesis for management: key findings, TOP 5 recommendations, savings potential, strategic transformation directions.
- 03 AS-IS Process Map (BPMN 2.0)PNG · XML · Visio · SVG
Graphical documentation of actual process flows. Basis for change discussions and input for grant applications.
- 04 TO-BE Process Map — 3 variantsPDF · BPMN 2.0
Target architecture per scale variant: Core (procedural changes), Performance (system integration layer), Enterprise (multi-system transformation).
- 05 Process Automation CatalogPDF + XLSX
Ranking of TOP 5 processes with 10-point scale assessment, urgency classification, estimated difficulty level and recommended technologies.
- 06 ABC Unit Cost TableXLSX
Per process, per activity. Allocation drivers visible. Costing of each activity at full employee cost with overhead.
- 07 Cost-Benefit Analysis (CBA) + ROIXLSX
CAPEX, OPEX, NPV, IRR, Payback Period, sensitivity analysis, scenarios: optimistic / realistic / pessimistic. For your CFO.
- 08 Implementation Risk MatrixPDF
Technical, organizational, competency risk. Per variant. Mitigations described step by step.
- 09 Quick Wins PlanPDF
3–5 optimizations deployable in 30–60 days, most often without capital expenditure. Per Quick Win: description, costs, expected results.
- 10 Strategic Transformation RoadmapPDF · MD
Calendar roadmap 12–24 months. Milestones, gate validations, recommended implementation sequence.
Express+ — 2 specialist documents
Express + Platinum- 11 Funding Acquisition PlanPDF · 15–25 pp
Map of available grant instruments matched to company profile: FENG, NCBR, regional paths, Dig.IT, Technology Credit.
- 12 Competitive BenchmarkingPDF · XLSX
Company positioning against 5–8 competitors: process maturity, operational costs, automation, grants obtained historically.
Platinum — 8 extended documents
Platinum only- 13 Change Management ReportPDF · 30–50 pp
Assessment of organizational readiness for change. Stakeholder map, adoption risks, internal communication plan, training program.
- 14 Funding Application included in audit pricePackage DOCX · XLSX · PDF
Complete application dossier for the selected program. Feasibility study, timeline, budget, declarations, results promotion plan.
- 15 NIS-2 Readiness AuditPDF · checklist
Compliance diagnosis with EU NIS-2 directive: technical measures, organizational measures, 12-month adaptation plan.
- 16 Build vs Buy Decision MatrixPDF · XLSX
Per component recommendation: do it yourself / implement with us / buy off-the-shelf solution. Full 5-year TCO analysis per path.
- 17 Extended financial modelsXLSX with Monte Carlo
Sensitivity simulations on key parameters (volume, labor costs, exchange rates). Monte Carlo for 3 variants.
- 18 Team Competency MapPDF · XLSX
Per role: current competencies, gaps relative to target state, training or recruitment recommendation.
- 19 Validation sessions with management committeeSessions + protocols
Up to 4 sessions of 90 minutes with management. Assumption validation, scope correction, implementation sequence recommendation.
- 20 YU-NA.io membership after implementationAnnual membership
Annual membership in the Platinum clients club: quarterly benchmarks, access to pattern library, priority QA10 support.
All deliverables on the client side — handed over in editable formats. Upon full payment of the fee we transfer economic copyright.
Competitive positioning // market analysis April 2026
Five types of providers in Poland compete with our offering. The matrix shows who has exactly what.
Data from public sources (published pricing, KRS filings, annual reports). Where data is non-public — marked "?". Corrections welcome: hello@qa10.io
FAQ
Most common questions about the AiP Audit.
Is the AiP Audit an IT audit?
Yes and no. The core of the AiP Audit is organizational culture and business process analysis — Lean Six Sigma, interviews at all levels, Gemba walks, MUDA classification. IT infrastructure diagnosis is a natural extension of Step 1 and you get it in every variant: systems map, integrations, architecture, stack. If you are looking for a full-scale information security audit with ISO 27001 certification or a DORA compliance audit — that is a different specialization; we will recommend the right partner.
What if we don't have an ERP or CRM?
We work regardless. The AiP Audit doesn't require mature IT infrastructure — it requires that processes are happening. In Start-ups we reconstruct processes from conversations, Slack, Google Sheets and work observation. For companies without systems, the audit concludes with an additional recommendation: which systems to implement first and in what order.
Who exactly does the auditor talk to?
All levels, because everyone holds a fragment of the truth. Management describes how processes were designed to work. Department heads describe how they should work according to their understanding. Operational employees describe how their day actually looks. We confront these three versions with each other and with system data (where available). The truth is always in the middle; no single perspective is sufficient.
How much time does this realistically take from my team?
Depends on the variant and segment. We schedule auditor conversations and observations so they don't overload operational work — typically 30–90 minutes per person. In Growth, a total of 15–30 hours of client team time in the Express variant. In Start-ups, the whole team for a few afternoons. In Enterprise we scale: 60–120 hours spread over 2–3 months. For your CFO: one hour. For management: 90 minutes for the final presentation.
How do you maintain anonymization during interviews?
Interviews are confidential. The management report does not include names or quotes attributed to specific individuals. Instead, aggregated perspectives per level appear ("operations department managers' perspective", "invoicing specialists' perspective"). This standard protects employees from consequences of honest statements and is a prerequisite for the audit to produce valuable data.
Does the AiP Audit include cybersecurity assessment and NIS-2 readiness?
Cybersecurity level assessment is a standard element of every variant: we assess your company on a maturity scale, identify gaps, recommend priority actions. NIS-2 directive readiness audit is standard in Growth Platinum and Enterprise Platinum variants. In other variants, NIS-2 is an additional option. Wi-Fi audit is coordinated through a partner firm; available in all variants as an additional option.
How much historical data do you need from systems?
Where systems exist, typically 6–12 months of operational logs. For retail and e-commerce we recommend 12 months covering a full seasonal cycle. If you have less, we work with what's available with a limited sample annotation. If you have more, we sample. Where systems don't exist, weight rests on the interview and observation layer.
Do you work in our stack, or impose your own?
We work in yours. Your stack may differ; we select tools to match your infrastructure, not the other way around. There are two exceptions. If your stack makes data extraction impossible in a reasonable time, we propose an intermediate layer (lightweight Python script). Our AiPoweredSavings™ scoring tools are internal know-how and are not transferable. Audit work products (BPMN 2.0, Excel, PDF, DOCX) are transferred to you after closing.
Does the AiP Audit qualify for EU grant funding?
In most cases, yes. AiP Audit documentation is designed as ready input for Technology Credit FENG applications, NCBR programs and regional paths. In Express and Platinum variants, a discount on the Funding service applies. Express: 15% for 45 days after the audit. Platinum: Funding application included in the audit price. If the application is rejected for formal reasons attributable to us, we refund 100% of audit costs.
What automation effect do the Core, Performance and Enterprise architectures deliver?
The three architectures differ in depth and capex, not in a signed-off percentage. Core removes data silos. Performance automates the bottleneck. Enterprise is a multi-system rebuild. NPV, IRR and payback are calculated per process in the report. We do not quote a site-wide time cut.
Who owns the AiP Audit results?
You do. Upon full payment of the fee we transfer economic copyright to all audit documents. You may use them internally, show them to banks, attach them to grant applications, modify them. The only thing that remains our intellectual property is the AiPoweredSavings™ methodology as such — you cannot offer it as a competing service, but you can use every result of our work in your company without restrictions.
Why does the Enterprise segment have pricing "on request"?
All three variants in the Enterprise segment (Basic, Express, Platinum) have individually determined pricing. Enterprise covers companies with multiple branches, complex organizational structure and a different scope of interviews, analyses and optional extensions (NIS-2, Change Management, Wi-Fi audit). Actual cost depends on the number of branches, number of employees participating in interviews, scope of system integrations and potential internal communications program. Price ranges are known internally, but a specific amount requires a conversation with QA10 management.
/FAQ // AIP AUDIT
Most common questions about the audit
How long does the audit take?
Basic variant — 3–4 weeks. Express — 6–8 weeks. Platinum — 10–14 weeks. We count from the day the contract is signed and system access is provided. Client-side delays extend the timeline but not the cost.
What do I get in the final report?
The report consists of five sections: process map (BPMN), cost analysis (ABC method), automation potential matrix per process, NPV estimate and payback period per process, implementation variant recommendation with justification. Platinum additionally includes independent expert counter-signatures.
Do I need to prepare data before the audit?
There are no hard requirements, but the more you have — the deeper the audit. Useful: data from ERP/CRM systems for the last 12 months, list of operational processes with owners, cost extracts per department. If you don't have this — we start with employee interviews and build the map from scratch.
Does the audit mean a commitment to implementation?
No. The audit ends with a report — the implementation decision is 100% yours. The report includes a QDeployment variant recommendation, but it is a suggestion, not a binding offer. Many clients use the report for internal budget justification.
What happens if the audit finds no potential?
We refund part of the fee. In the Platinum variant — if identified savings do not exceed 3x the audit cost, we refund 50% of the fee. Condition: you have data available. This is a contractual clause, not marketing.
Does the audit cover AI Act compliance?
Yes, in Express and Platinum variants. We check which processes qualify as high-risk systems under Annex III of the AI Act and flag them in the report. We identify risks and advise on next steps.
Who physically conducts the audit?
Always a QA10 senior consultant, not a subcontractor. CEO Mateusz Jakimow personally leads Express and Platinum variants or supervises them as lead. Basic is conducted by a certified process analyst with at least 3 years of experience.
Conversation
Let's start with a 30-minute conversation.
You'll see how the methodology works on your data, get an initial estimate of variant and delivery time, and if it fits — we propose a start date.
Schedule an AiP Audit conversationAll qualifying conversations are led by Mateusz Jakimow (CEO). No SDR, no salesperson. email: hello@qa10.io · phone: +48 880 839 850