A software audit is an independent examination of a system you depend on: how it is built, how it is run, and how well it can carry what you are about to ask of it. You commission one for the same reason you commission a building inspection before you buy or renovate. You want someone with no stake in the answer to tell you what you actually have.
We call ours a System Evaluation. The industry uses a dozen names for roughly the same thing: software audit, code audit, technical assessment, architecture review. Here is what a good one covers, what you get back, and when it is worth doing.
What gets examined
A thorough audit looks at six things. Narrower reviews look at one or two, which is fine if you already know where the problem is.
- Architecture. How the system is put together, whether the design can carry what you are asking of it, and where it will break first.
- Code quality. Whether the code is readable, tested, and maintainable by someone other than the person who wrote it.
- Data. Where the data lives, whether it can be trusted, and what it would take to report on it or move it.
- Infrastructure and DevOps. Hosting, environments, how changes get from a developer’s machine to production, backups, and monitoring.
- Security. Access control, credentials, encryption, dependencies with known vulnerabilities, and the gap to whatever standard you have to meet.
- How work reaches users. How long a change takes, how often things break, and where the people who use the system route around it.
What you get back
Findings, not a lecture. A good audit produces three things you can act on:
- Written findings in plain language: what is sound, what is at risk, and what is already broken.
- A prioritized list. Not everything wrong is worth fixing. The list says what to do first, what can wait, and what to leave alone.
- A recommendation with a cost. Fix it, extend it, replace it, or connect it, and a fixed proposal for the next step if you want one.
Everything is yours to keep and to take anywhere, including to another firm or your own team.
When you need one
- You inherited a system. An acquisition, a departed vendor, a former employee’s project, or a tool built with AI coding assistants by one capable person. You depend on it and nobody can tell you how safe that is.
- A project is going sideways. Before you approve another invoice, find out what has actually been built. This is the first step of every project rescue.
- You are about to invest. Modernization, a major new feature, a migration, or scaling to a lot more users. An audit tells you whether the foundation can take it.
- Something keeps breaking and the fixes do not stick.
- You are buying or selling a company and the software is part of the value. That version is technology due diligence.
What it is not
A software audit is not a security scan, though it includes security. An automated scan finds known vulnerabilities in dependencies. It cannot tell you the architecture will not scale or that only one person understands the code.
It is also not a code review. A code review looks at a change. An audit looks at the whole system and how it is run.
What it costs and how long it takes
A System Evaluation is a fixed fee, scoped to the questions you need answered, and it starts at $3,500. A one-week read on a single small system sits at the low end. A full assessment of a large platform with several integrations runs three to four weeks. Either way you know the price before it starts. More on how we handle your money.
If a system you depend on is the reason you are reading this, here is how getting started works.