Code & documentation
We review code correctness, testability, dependencies and whether the documentation matches the system’s behaviour. We also audit code and documentation produced with AI assistance.
IT audit
IT audit: find the causes and plan the fixes.
Get an independent review of your code, architecture and system operations. We identify confirmed issues, their impact and the order of action. Use the report to plan your team’s work and decide on further investment.
When an audit helps
After a failure or before a major change.
After an incident, before modernisation or when taking over a project from another provider. We match the scope to the decision you need to make, from a single-module review to a full system audit.
Architecture & project
Module boundaries, data flows, failure points, decisions and delivery risks. We assess whether the solution fits its purpose.
Security
Access control, authentication, password and key management, dependencies and infrastructure configuration. We agree on the testing scope before the review.
Performance
Application profiling, database queries, behaviour under load and infrastructure costs.
Delivery process
Code reviews, tests, deployment automation and incident handling. We look for process gaps that increase error risks.
Monitoring & operations
Metrics, logs, alerts and response procedures. We assess whether the team can detect and diagnose failures.
Engagement scope
A full audit or a focused review.
- Format
- A written report and results presentation, or a shorter advisory review with an agreed summary.
- Timing
- A full audit usually takes 3–6 weeks. Focused review timelines are agreed individually.
- What we need
- Access to the agreed code, documentation and diagnostic data, plus time with the team. We sign a non-disclosure agreement (NDA) before materials are shared.
- Pricing
- Depends on the number of systems, selected areas, available materials and level of detail required. We provide the scope, cost and schedule before work starts.
Deliverables
Findings, priorities and a plan for your team.
The proposal defines the deliverables. A full audit includes the main report, prioritised findings, an architecture map, an executive summary and a results meeting.
Each finding includes evidence, its impact and a recommendation. We distinguish confirmed defects from questions that need further investigation.
RISK: HIGH
TR / 01
Retrying a payment may create a duplicate order.
- Observation
- In this example, retrying a request after a lost response creates a new operation.
- Impact
- Risk of duplicate charges and manual complaint handling.
- Recommendation
- Introduce an idempotency key and a retry test.
- Verification
- A retried request returns the same operation result, including under concurrent requests.
This example was prepared for this page and is not from a client audit. A report also includes evidence, context and an estimate of the work needed to resolve the issue.
Process
We validate findings with your team.
-
Scoping
We agree on the goal, access to materials, schedule and confidentiality.
-
Analysis
We review code and documentation, using measurements and team interviews.
-
Review of findings
We discuss preliminary findings with the team to check that we understand how the system works.
-
Report & discussion
We deliver priorities, recommendations and a plan for further action.
Do we have to hire you for remediation?
No. Your team or another provider can implement the recommendations. If you ask us to make the fixes, we will agree on a separate scope and price.
Does the audit cover the whole system?
Only within the agreed scope. We can focus on a module, process, documentation or risk. The report states the review boundaries and access limitations.