How to Find and Fix Deficiencies in Your Custom AI Stack

A private AI stack audit is a hardware-up exercise, not a policy review. The deficiencies that erode a deployment live at the GPU, the inference engine, the retriever, and the agent runtime long before they surface in a committee memo. RAND's work on AI project failure puts the base rate above 80% of initiatives, roughly twice the rate of comparable IT projects that do not involve AI. The sequence below is a self-assessment a CIO or CISO can run end to end before engaging an outside firm or walking into a renewal cycle. It names each checkpoint, the evidence to pull at each layer, and the order in which findings get fixed.

Begin at the Metal

Hardware is the first thing to measure because every deficiency downstream inherits its ceiling. The inventory to produce is dull and short: GPU model and count per node, VRAM per card, interconnect fabric (NVLink, NVSwitch, or InfiniBand), rack power envelope, CUDA and driver versions, and the KV-cache headroom at your working context window. A cluster that holds a 70B model in fp16 at 2k tokens may thrash at 32k. Pair that inventory with sustained-load thermal and power logs; a benchmark run in isolation hides the throttle curve the stack will hit during an all-hands demo. Document the physical and logical isolation of the hardware too, because autonomous workloads land on it before the paperwork catches up.

Measure the Serving Engine Honestly

The serving engine is where throughput, cost, and latency are decided, and where benchmarks diverge from marketing. vLLM, TensorRT-LLM, and SGLang handle continuous batching, prefix caching, and speculative decoding differently, and the right choice is workload-dependent, not vendor-ranked. Pull p50, p95, and p99 latency under realistic concurrency, not synthetic bursts, and record tokens-per-second per GPU at the batch size actually in production. MLPerf Inference v5.0 is a useful external yardstick: between v4.0 and v5.0, the median Llama 2 70B score doubled and the top submission ran 3.3x faster, which means a stack that has not been retuned in a year is almost certainly leaving capacity on the floor.

Test Retrieval, Not Just Generation

RAG failures do not announce themselves in the output text. They show up as confidently cited answers that cite the wrong paragraph. The right lead metric is Faithfulness as defined by Ragas, the share of claims in the response supported by the retrieved context on a 0-to-1 scale. A Stanford RegLab redo of its legal AI study found Lexis+ AI hallucinated on roughly 17% of queries and Westlaw AI-Assisted Research on roughly 33%, despite both being RAG-backed. Audit the retriever on a held-out query set, measure context precision and context recall alongside Faithfulness, and verify chunk boundaries, embedding model version, and re-rank thresholds. A secure RAG pipeline is where most retrieval deficiencies sit untouched.

Audit the Agent Layer Before Autonomy Spreads

Agents amplify every weakness below them. Gartner expects over 40% of agentic AI projects to be canceled by the end of 2027 on escalating costs, unclear business value, and inadequate risk controls. The audit targets at this layer are concrete: enumerated tool permissions per agent, a documented kill switch, retry and loop detection, cost per completed task rather than per LLM call, and a hard boundary between agents and systems of record. OpenTelemetry's GenAI Special Interest Group has drafted semantic conventions for agent instrumentation across CrewAI, AutoGen, and LangGraph, so trace schemas no longer have to be bespoke. On-prem isolation is the first mitigation when agent scope is unclear.

Instrument Everything with One Trace ID

Observability is the audit function that lives in production. Every user request, retrieval call, tool invocation, and model completion must share one trace ID, and that ID must land in an immutable store security owns, not the application team. Verify three things on sample: a trace exists for every completion, PII redaction happens before the span leaves the host, and the retention window matches whatever compliance clock applies (HIPAA six years, GLBA, SOC 2, CMMC Level 2). The deficiency to look for is the quiet unlogged path: a fallback model, a cached response, a batch job that bypasses the main pipeline. If a prompt or completion exists that the SIEM cannot replay, the audit is already incomplete before the auditor arrives.

Map Controls to a Named Framework

Every finding above must land in a control matrix tied to a framework a regulator recognizes. The OWASP Top 10 for LLM Applications 2025 is the shortest common language for the AI-specific layer. The ten categories to map against:

• Prompt Injection (LLM01)
• Sensitive Information Disclosure (LLM02)
• Supply Chain (LLM03)
• Data and Model Poisoning (LLM04)
• Improper Output Handling (LLM05)
• Excessive Agency (LLM06)
• System Prompt Leakage (LLM07)
• Vector and Embedding Weaknesses (LLM08)
• Misinformation (LLM09)
• Unbounded Consumption (LLM10)

Map each to the control stack the sector already uses: HIPAA for PHI, GLBA for financial, CMMC for defense, SOC 2 for anything crossing a customer boundary. Where an AI-specific risk has no clean equivalent in the sector framework, document the uncovered risk and the compensating control. An LLM security audit is where this matrix gets formalized and signed.

Sequence the Fixes

Findings do not get remediated in the order they are discovered. Fix hardware stability first, because every number collected on an unstable cluster is suspect. Retune the serving engine next; a 2x throughput gain often absorbs what looked like a capacity problem. Raise RAG quality on the worst-performing query class after that, since retrieval improvements compound into every downstream agent. Containment of agent scope follows: shrink tool permissions and add kill switches before adding capabilities. Observability closes the loop so the next audit cycle is a diff, not a rebuild. Governance mapping lands last because it codifies what the earlier fixes have already made true. A custom AI deployment built in this order rarely surprises an auditor.

What the Memo Looks Like When It Lands

The committee memo at the end of this exercise is thinner than the one that opened it, because the deficiencies worth reporting are the ones that remain after the first six sweeps. The audit still begins at the metal and still ends at the control matrix, but the GPU count, the inference engine choice, the Faithfulness score, and the agent trace IDs now have evidence attached. That is what an outside auditor expects to find on arrival, and what a renewal conversation benefits from before the first slide is shown. The stack has not stopped drifting; it has just been measured, and the next drift is now the one that gets caught early.