Technology audit & due diligence.

The Depth Behind Each Pillar

Our 5P Framework provides the structure for every assessment. Rather than a generic checklist, we evaluate each pillar in the context of your business stage, market, and ambitions. Read the full framework for detail on each pillar. For a practical overview of the ground we cover, our technology due diligence checklist sets out the key areas across all five pillars.

People: The Human Foundation

We start with People because the quality of the team determines everything else. We assess team structure, leadership depth, and whether decisions route through a single person or are shared. Key person risk is one of our most common findings — in roughly 40% of assessments, critical knowledge sits with one or two people, which directly affects valuation. We also evaluate hiring capability and whether technology choices are creating recruitment bottlenecks.

Process: How Work Gets Done

Process tells us whether talent and architecture translate into delivered value. We examine the full delivery pipeline: how work is prioritised, how code reaches production, and how the team learns from what it ships. Manual deployment is the single most reliable sign of broader process gaps — teams that deploy by hand almost always have weak testing, poor environment management, and limited observability. We look for pragmatic agile practices and continuous technical debt management, not annual "tech debt sprints."

Product: The Technology Itself

We examine architecture, code quality, and technical decisions that determine whether the platform can scale and evolve. In most assessments, we find architectural choices that will block growth within 18 months — a sync pipeline that cannot handle peak load, a schema that does not support the multi-tenancy sales are promising, or a monolith too coupled to extend safely. We also assess technology choices for pragmatism and flag unnecessary build-versus-buy decisions that drain engineering time.

Protection: Security and Compliance

No penetration testing is the single most common critical finding across all our assessments. We evaluate access control, data protection practices, and compliance posture — always calibrated to stage. Production data in dev environments, secrets in source control, and excessive production access appear far more often than they should. We assess whether the organisation holds the right certifications for its market and is building toward the ones it will need next. For companies in regulated industries, this extends to cybersecurity due diligence — evaluating whether security controls are genuinely effective or just ticking boxes. For a deeper look at how we approach each area, see what we assess in a technology due diligence.

Platform: The Operational Foundation

Cloud costs are almost universally neglected until they become a board-level problem. We assess Infrastructure as Code maturity, disaster recovery readiness, and monitoring coverage. Environments built by hand are not reproducible, not auditable, and not resilient. We look for tested recovery procedures with measured recovery times, and observability that lets the team detect issues before customers report them.

Patterns Across Our Assessments

Architecture constrains growth sooner than leaders expect. In most audits, we find architectural decisions that will block the company's scaling plans within 18 months — revealed by rising delivery effort, more frequent incidents, and declining team morale.

Key person dependency is endemic. 40% of the organisations we assess have critical knowledge concentrated in one or two people. The risk stays invisible until those people leave, fall ill, or become a bottleneck.

Security posture is weaker than leaders believe. The most common critical finding is no penetration testing. The pattern extends to excessive production access, secrets in source control, and no incident response procedures.

Process maturity predicts everything else. Teams with mature deployment practices almost always have better code quality, stronger security, and more resilient infrastructure. Manual deployment is a leading indicator of gaps across every pillar.

From Assessment to Action

Roughly a third of our audit clients go on to engage us for fractional CTO support to implement our recommendations. The partner who conducted the audit already understands the architecture, the team, and the root causes — so there is no ramp-up period. The transition from "here is what needs to change" to "here is how we are changing it" is seamless.

If you are preparing for a sale, our sell-side due diligence service uses the same methodology from the other side of the table — helping you identify and address what buyers will find before they arrive.

Stage-Appropriate Assessment

We do not compare a five-person seed startup to a hundred-person Series C company. We assess whether the technology organisation is where it should be for its stage and has the foundations for the next one. The same applies across sectors — IT due diligence for a SaaS platform looks different from a software due diligence on an embedded systems company, and we calibrate accordingly.

At seed stage, we expect speed and pragmatism — technical debt is acceptable if understood. At Series A, we look for deliberate hiring, processes that support delivery, and architecture designed for the next 12 months. At Series B and beyond, we expect autonomous teams, mature processes, proactive security, and fully automated infrastructure.

How We Differ from Other Technology Assessments

Versus Big 4 Technology Reviews

Big 4 firms deploy junior consultants running standardised checklists. Our assessors are practising CTOs who have built and scaled technology organisations. They catch risks that checklists miss — organisational dysfunction, architecture decisions that will fail at scale, and the subtle signs a technology leader is not delivering.

Versus Management Consultancy

Management consultancies assess through a strategic lens that often misses operational reality. Their reports may not reflect what is actually happening in the codebase or the deployment pipeline. Our recommendations are grounded in implementation experience — when we recommend a migration or a team restructure, we know what it involves because we have done it.

Versus Internal Assessment

The CTO cannot objectively assess their own decisions. The board cannot validate what they lack the technical depth to understand. We bring both independence and comparative perspective — having assessed organisations of all sizes and stages, we know what is normal, what is exceptional, and what is genuinely concerning.