Innoligo copilot readiness assessment · Final report
Marlow Pike Accountants
Fictional UK accountancy practice, 60 staff in two offices, Microsoft 365 Business Standard and Premium, considering Copilot for everyone.
The question: Is our data ready for Copilot, and who should get it first?
1Executive summary
Not ready for 60 licences. Ready for an 18-person pilot once nine sites are locked down.
Copilot would let any member of staff find payroll, partner drawings and client tax files through a simple question, because nine sites are open to the whole firm. Licensing and sign-in security are in good shape. Fix the permissions, publish an AI policy, and start with the 18 people who have a measurable use case, instead of buying 60 licences now.
52 / 100
readiness score today (target 75 before pilot)
9 sites
open to everyone, holding 312 finance and HR files
£12,450
first-year saving from piloting with 18, not 60
2Scope and method
What we looked at
- Licensing and Copilot eligibility for each user
- Identity and sign-in security
- SharePoint, Teams and OneDrive permissions and sharing links
- Where sensitive content lives, and labelling
- AI policy, ownership and current use of AI tools
- Use cases by team, and how to measure them
Access and evidence
- Read-only Global Reader role for 30 days
- SharePoint sharing and permissions reports
- A 10-question staff survey (41 of 60 replied)
- Workshops with the Managing Partner and two team leads
Not included
- Buying or configuring Copilot
- Legal advice on professional conduct rules
- Changes to permissions (the plan says who should make them)
3Readiness by domain (out of 5)
- LicensingAll users on eligible plans4 / 5
- Identity and securityMulti-factor authentication on for all3.5 / 5
- Data and permissions9 sites open to everyone1.5 / 5
- Sensitive contentNo sensitivity labels in use1.5 / 5
- AI policyNone; 23 staff use personal AI accounts1 / 5
- People and adoptionInterest high, no owner named2.5 / 5
- Use cases18 people with a clear, measurable use3 / 5
4Findings, ranked
Every finding has the evidence behind it, what it means for the business, the fix, the effort and the cost. A real report adds an evidence appendix with the underlying exports.
1.HighSites open to the whole firm
- Evidence
- 9 SharePoint sites shared with "Everyone except external users", holding 312 files that look like payroll, partner or client tax material.
- Business impact
- Copilot would summarise these for any of the 60 staff who asked.
- Fix
- Restrict the 9 sites to the teams that own them; move partner material to a private site.
- Effort
- 3 to 4 days
- Cost
- None
2.HighStaff already using personal AI accounts
- Evidence
- 23 of 41 survey replies use free AI tools for work, including drafting client letters.
- Business impact
- Client data may already be leaving the firm, outside any contract or control.
- Fix
- Publish a one-page AI policy this month; give a sanctioned option (Copilot Chat with work accounts).
- Effort
- 2 days
- Cost
- Copilot Chat included for work accounts
3.MediumNo sensitivity labels
- Evidence
- Labels exist in the Premium licences but none are published.
- Business impact
- No way to stop Copilot using, or staff sharing, the most sensitive documents.
- Fix
- Publish 3 labels (Public, Internal, Confidential) and auto-label the tax and payroll libraries.
- Effort
- 4 days over 3 weeks
- Cost
- Included for the 12 Premium users; see decision 3
4.Medium1,140 organisation-wide sharing links
- Evidence
- Links created over 6 years; 280 point to client folders.
- Business impact
- Old links widen access silently, and Copilot honours them.
- Fix
- Expire organisation-wide links older than 12 months; default new links to specific people.
- Effort
- 1 day
- Cost
- None
5.MediumYears of stale content
- Evidence
- 41% of files not opened in 3 years, including superseded policies and fee scales.
- Business impact
- Copilot may answer from out-of-date documents.
- Fix
- Apply a retention policy to archive closed client years; delete duplicates.
- Effort
- 2 days to set, ongoing
- Cost
- None
6.LowNo owner or measures
- Evidence
- Interest is high but nobody owns the rollout or its success measures.
- Business impact
- Licences get bought, usage fades, nobody can say if it worked.
- Fix
- Name an owner; agree 3 measures (time to draft a client letter, meeting notes, month-end commentary).
- Effort
- 1 workshop
- Cost
- None
5What Copilot would cost
| Option | First year |
|---|---|
| Copilot for all 60 staff (60 × £24.70 × 12) | £17,780 |
| Pilot with 18 staff (18 × £24.70 × 12) | £5,340 |
| Permission and labelling work (internal time, about 10 days) | Staff time |
| Saving from piloting first | £12,450 |
Approximate UK list price per user per month, annual term, excluding VAT. Confirm Microsoft's current price before ordering.
6Savings and costs to test
| Item | Range | Confidence |
|---|---|---|
| Licences not bought until the pilot proves value Arithmetic from the cost table | £12,450 in year one | High |
| Time saved by the 18 pilot users, at 1 to 3 hours a week and £40 an hour A hypothesis the pilot measures, not a forecast | £37,400 to £112,300 a year | Low |
The pilot exists to replace the hypothesis with measured numbers. If the pilot users save less than about 10 minutes a week each, Copilot does not pay for itself at this price.
7Your action plan
The fixes, sorted into three time buckets so nothing is overwhelming: quick wins first, then planned work, then longer-term improvements. Hand it to your IT provider, or to us, and say "do this, in this order".
First 30 days: quick wins
- Publish the AI use policy
- Restrict the 9 open sites
- Expire old organisation-wide links
- Name the Copilot owner and agree 3 measures
30 to 90 days: planned work
- Publish sensitivity labels; auto-label tax and payroll
- Archive closed client years
- Buy 18 licences; run a 10-week pilot with weekly measures
3 to 12 months: longer term
- Decide on wider rollout from pilot results
- Quarterly permission review
- Train the next wave by team
8Decisions for you to make
The few questions IT cannot answer alone, because they need budget or authority. Your owner or directors can settle them in one meeting.
- Pilot with 18 named people instead of buying 60 licences.
- Adopt the AI use policy now, before any Copilot licence is bought.
- Decide whether more staff need Business Premium for labelling and data loss prevention.
The report ends with a senior readout: a one-hour session to walk through the findings and these decisions with you and anyone else who needs to be there. The report, findings and plan are yours to keep and use with any supplier.