Delivery Risk Audit — technical due diligence in ten working days

Technical due diligence, for the person who has to decide

Somebody is about to commit money to a codebase: an investor before a round, an acquirer before a deal, a founder before the next build phase, a board before a rescue budget. The question is always the same one — is this going to work, and if not, where does it break first, and what does that cost.

This is independent technical due diligence and code audit services delivered against a fixed price and a fixed date, by someone who is not bidding on the remediation.

What you get

A risk matrix

Every finding placed by impact and likelihood, on one page. Not a list of 200 lint warnings — the handful of things that decide whether this product survives contact with its next twelve months.

The three weakest areas, costed

For each: what it is, what happens if nothing is done, and what it costs to fix, in developer-days. A risk with no number attached is a risk nobody will act on.

A prioritised 90-day plan

What to do first, what can wait, and what to deliberately not do. Ordered by risk removed per day spent, not by how satisfying it would be to fix.

A code audit of the areas that matter

Structure, dependency health, test coverage where it counts, the obvious security exposures, and the parts of the codebase only one person understands.

One 90-minute readout

Live, with the people who have to act on it, so the questions get answered while the reasoning is still in the room.

How the ten days run

Days 1 to 2 — access and framing

Repository access, the deployment picture, and a conversation about what decision this audit is feeding. An audit with no decision attached is an expensive document.

Days 3 to 6 — code and process review

The codebase, the delivery process, the release history, and the gap between what the team says happens and what the commit log says happens.

Days 7 to 8 — findings and costing

Every finding gets an impact and a number.

Days 9 to 10 — the document and the readout

The written deliverable, then the 90-minute call.

I do not bid on the remediation

This is explicit, and it is the point of the offer: I am not a candidate for the work I recommend. An audit whose author wants to sell you the fix is not an audit, it is a proposal with a risk matrix stapled to the front. If you want help choosing who does the remediation, that is a separate conversation with no financial interest on my side.

A worked example

An investor asked for technical due diligence on a logistics SaaS before a bridge round. The code was better than expected. The risk was elsewhere: a single contractor held the only credentials to the production database and the deployment pipeline, and had not been paid in seven weeks. That is not a code finding, and no automated scanner reports it. It went at the top of the matrix, was resolved in four days, and cost the company nothing.

Who this is not for

• Anyone who wants the audit to say what they have already decided
• A security-only assessment — this is a delivery and code risk audit, not a penetration test
• A team that needs the fixes done rather than named

What is not included

Implementation, any obligation to hire me afterwards, rework after delivery, and penetration testing. Half the fee is due up front; the range is confirmed after scoping, before you commit.