Who it's for
Some people call this a code audit or a software health check. Ours is written for the people who run the organisation, as well as for anyone technical.
The audit is for any organisation that depends on a bespoke system and isn't sure of its condition. That might be because the developer has left, because a version is going out of support, because you've inherited the system through an acquisition, or simply because nobody has looked at it properly for a while.
What we look at
- Support status. Whether the frameworks, platforms and components the system relies on still receive security fixes, and when that changes.
- Security exposure. Out-of-date components, known vulnerabilities, how secrets and credentials are handled, and who has access.
- How it's built and released. Whether the system can be built and released reliably, and by whom.
- Test coverage. Whether there are automated tests, and how much of the system they protect.
- Hosting and backups. Where the system runs, how it's backed up, and whether a restore has ever been tried.
- Dependency on individuals. What only one person knows, and what would happen if they weren't available.
- Documentation. What exists, and what's missing.
- Likely failure points. The parts of the system most likely to cause trouble, and why.
What you get
A plain-English report, written for the people who run the organisation as well as anyone technical. It typically includes:
- Summary. The overall condition of the system in a page.
- Risks, ranked. Each risk explained, with how likely it is and what it would affect.
- Support and security. What is out of support or exposed, and when.
- How the system is built and run. What we found, in plain terms.
- What it would take to look after it. The onboarding work needed, and what monthly care would involve.
- A fixed quote for onboarding and monthly software care.
What we need from you
- Read access to the code, wherever it's held today.
- Read access to the hosting, such as the cloud account or servers the system runs on.
- An hour with someone who uses the system, so we understand what matters most to the people who rely on it.
If some of this is missing, for example the code isn't in source control or nobody has the hosting passwords, tell us. Finding out what's missing is part of the audit.
An honest answer
If the audit shows a system we can't safely support, we'll say so, explain why, and set out your options. You'll still have a clear picture of where the system stands.