Software audit: what an application review shows

If your business application is several years old, you probably have one question: is it worth developing further, or is it time to build something new? Decisions worth tens of thousands of euros are often made on that question without anyone having looked inside the code.

A software audit is what should come before the decision. It is not development or repair work, but an independent overview of what state the application is in and what makes sense to do with it.

When a review is needed

• The developer or agency has left and nobody knows exactly how the system works. That situation is covered in more detail in the post your developer left: what happens to your software?
• Adding new features has become slow and expensive.
• You have a quote for rewriting the application and want to know whether it is really necessary.
• The framework or server is out of support and security updates no longer arrive.
• You plan to sell the application, show it to an investor or hand it over to a new team.

What the review covers

1. Code and component review. What the application is made of: programming language, frameworks and their versions, database, external libraries and services. Which of them are outdated, which are out of support and which have known security vulnerabilities.

2. Security risk mapping. Access, password storage, outdated dependencies, server configuration. Security issues go first on the list, because they don't wait.

3. Technical debt mapping. Where there is copied code, missing tests, undocumented logic and places nobody dares to touch. What this is and why it costs money is explained in the post on technical debt.

4. Infrastructure. Where the application runs, whether backups are made and whether they have ever been restored. It often turns out that the server configuration is as undocumented as the code.

5. A step-by-step plan. What to do now, what within the next six months and what can wait. Each step comes with its impact, risk and estimated effort.

6. An honest assessment. Modernise or rebuild. If the existing system is so old that building from scratch is cheaper, I say so directly.

What the review is not

The review is not development work. No code or server is changed during it; things are only looked at and written down. This is a deliberate choice: the assessment has to stay independent of who does the work later. You can take the plan to any developer.

Nor is the review a formal security audit for a certificate. If you need compliance with a particular standard, that is separate work.

What you need before the review

• Access to the code repository (GitHub, GitLab or another) or a copy of the code.
• Access to the server or hosting where the application runs, at least read-only.
• A short description of what the application does and who uses it.
• If available: old documentation, a list of bugs, earlier quotes.

If some access is missing, that is already the first finding. During the review I help work out how to get it back.

What the review costs

An application review with a modernisation plan starts at €390. The exact price depends on the size of the application and how many separate systems are connected to each other. After the review, modernisation can be done in stages, and the price of each stage is known before work begins. The packages are listed on the pricing page.

Summary

A review is the cheapest step you can take with an old application. It answers the question "modernise or rebuild" based on facts rather than gut feeling, and gives you a plan to move forward with.

See how I handle software modernisation and further development, or order a review. Describe in a couple of sentences what kind of application it is.