The 5-Question Substrate Audit (And What Your Score Means)

The substrate audit is a 5-question diagnostic. Each question scores 0 or 1. Total honestly. Most businesses score 0 to 1 of 5, which means the AI deployed on top of the operation is reading folklore. This page is the deep treatment of each question, with what a "yes" looks like in practice, what a "no" looks like, the common shapes of every failing answer, and the action to take at each score band.

Run this against your own operation in 15 minutes. The result tells you whether to maintain, repair, or start from scratch.

Question 1. Does a single authoritative document exist for each top recurring decision?

Pick your top 10 recurring decisions. Vendor selection. Routing standards. QC thresholds. Hiring rubrics. Pricing rules. Credit-hold thresholds. Build-buy framings. Customer-segmentation logic. Whatever your business decides repeatedly. For each one, ask: if a new hire wanted to read the current policy, would they find one document that is authoritative?

Yes looks like: a known path in a repository or shared structure. The document lives in markdown. Its title is unambiguous. There is only one of it.

No looks like: "ask Mike," "check the wiki," "it's in an email thread from last spring," "the SOP is on the shared drive but I think it's out of date." Two pages exist on the same topic with contradictory information. A deck made for an all-hands two years ago is still being treated as policy.

Common shapes of no: tribal knowledge in the heads of senior employees; PowerPoint decks that nobody updates but everyone references; a Notion page that was canonical until someone forked it and now there are 3.

Question 2. Does that document have a version history with named authors and dated changes?

Find the document from question 1. Look at its edit history. Can you tell who wrote each change and when? Can you read the previous version? Can you see what changed between any two points in time?

Yes looks like: a git log showing every change, with author, timestamp, and a commit message that explains why. Or a wiki with full version history including diffs and reviewer attribution.

No looks like: a PDF with no metadata. A Google Doc with "anonymous edits" or with edits attributed to a shared account. A Notion page where the only timestamp is "last edited 18 months ago" and no record exists of what the prior version said.

Common shapes of no: the document was authored once and nobody has touched it since, but the business has changed; the document has been edited many times but the wiki hides the edit trail behind a paid plan; the document is a PDF, which cannot be diffed.

Question 3. Are changes to it reviewed before they take effect?

Pick a hypothetical change to the document. Increase a QC threshold by 5%. Add a new vendor-approval criterion. How would that change be made? Who has to approve it? What stops anyone with edit access from publishing it immediately?

Yes looks like: a pull request with at least one named reviewer required before merge. Or a wiki workflow that routes proposed changes to a defined approver, who has to sign off before the change goes live to readers.

No looks like: anyone with edit access can publish. The Notion workspace is open to all employees. The Google Doc has public edit. No record exists of who approved the last change because no approval happened.

Common shapes of no: "we trust each other," which means there are no gates, which means any disgruntled or careless employee can silently rewrite policy; the wiki has a "request review" feature but nobody uses it; review happens informally in a Slack channel that nobody can audit later.

Question 4. Can an LLM read every relevant decision document without a vendor portal or paid integration?

Pick the same document. Could an AI agent on your laptop read it right now? Could it read every related decision document, the way a new hire would, by walking the directory? Or does the document live behind a vendor's API that costs money per call, or a portal that requires interactive login, or a proprietary binary format that requires a vendor SDK?

Yes looks like: markdown files on disk, accessible through the filesystem or a git API. Documents in a wiki with a fully open and free read API. Plain text the model can consume directly.

No looks like: ERP data locked inside a vendor's portal with API access gated behind a paid integration tier; quality manuals existing only as PDFs; CAD drawings only in a proprietary binary; SOPs in a wiki whose API requires per-request billing.

Common shapes of no: the substrate is technically readable, but only at a cost that makes AI agent workflows uneconomic; the substrate is in PDFs that an LLM can extract text from but cannot diff across revisions; the substrate is held in a SaaS product whose vendor has explicitly disabled the LLM use case.

Question 5. Is there a process that detects when operations have drifted from the recorded decision?

The substrate says the routing standard is X. The shop floor is doing Y. The substrate says the credit hold threshold is $5,000. The AR team waived it on a $40,000 invoice yesterday. Who notices? When? How fast?

Yes looks like: a periodic audit comparing recorded decisions to actual operations. Or an automated check that flags operational events outside the recorded policy. Or a drift dashboard reviewed weekly.

No looks like: nobody notices until an external event (an audit, a customer complaint, a regulatory inspection, a lawsuit) reveals the gap.

Common shapes of no: the SOP exists but nobody references it; the policy was set during a planning offsite and quietly abandoned; the documented process and the actual process diverged over time and nobody can remember when.

Scoring bands

Score	What it means	What to do
4 or 5	The substrate is real and holding pressure. AI deployed on top of it can return defensible answers.	Maintain. Quarterly audit. Refresh entries with date-stamped changes. Watch for drift on the question you scored 0 on, if any.
2 or 3	A substrate exists but does not hold pressure. Some decisions are recorded, others are not. The AI's answer quality is uneven.	Identify which questions you scored 0 on. Fix the one with the highest blast radius first. Most often that is question 3 (review gates) or question 4 (LLM-readability).
0 or 1	No substrate. The AI is reading folklore. Output is plausible and frequently wrong. This is the most common result.	Start with one decision domain. Vendor selection, QC thresholds, or the hiring rubric. Put it in markdown, in git, with a review rule. Expand to a second domain only after the first is stable.

What this audit does not measure

The audit measures the operating discipline. It does not measure the quality of the decisions themselves. A business with a perfect substrate can still make terrible vendor choices, set bad pricing, or hire the wrong people. The substrate makes the decisions legible. The decisions themselves are still on the humans.

The audit also does not measure the model. A frontier model on top of a real substrate produces sharper answers than a smaller model on the same substrate. But a frontier model on top of folklore still produces folklore. The substrate is the floor on answer quality. The model is the ceiling.

Frequently asked

What if my business has only 3 recurring decisions, not 10?

Then ask the 5 questions against those 3 decisions. The number 10 is a heuristic for "most of what binds future operations." Smaller operations have fewer binding decisions. Run the audit against whatever set you have.

Does scoring 4 or 5 mean I do not need to do anything?

No. It means you can maintain rather than build. Substrates rot. Decisions get superseded by emails. Reviewers leave. The quarterly audit is the maintenance discipline. The score is a snapshot, not a finished state.

Can I skip question 4 if my business is not using AI yet?

Skip it now and you will fail it later. Question 4 is the question that determines whether the substrate you build today is usable by AI agents next year. Markdown on disk in git is the answer that satisfies the question regardless of whether you currently have an AI agent reading it.

Who should run the audit?

Whoever is closest to the decisions. The operations leader runs it on operations decisions. The engineering leader runs it on architectural decisions. The CEO runs it on strategic decisions. The audit takes 15 minutes per domain. Run it on every domain that matters.

What's next

If you scored 0 or 1, pick the decision domain with the highest operational blast radius and put it in the substrate this week. Markdown file. Git repository. One named reviewer per change. The expansion plan is in the pillar: Decision-State, Airlocked to Code-State: Defining the AI Substrate.

If you scored 2 or 3, the work is to fix the specific question you failed. Most teams fail question 3 (review gates) or question 4 (LLM-readability). The remedies are different for each. The pillar piece covers both.

If you want a second opinion on your score before acting on it, the Business System Review is the fixed-scope engagement that maps your decision domains, scores the substrate, and hands back a written report. No commitment to further work.