Contents
- The four artifacts
- Week by week
- $18K vs $35K: what moves the number
- The walk-away clause
- Audit or free review — which do you need?
- FAQ
- Book it
$18,000 to $35,000. Two to three weeks. Fixed price against fixed scope, with a walk-away clause.
Most firms selling this won’t print a number, which puts you in the position of asking for a quote before you know what you’d be buying. So this article does it backwards: here is exactly what you receive, then the price, then what moves it.
The four artifacts
An audit is not a report. A report is a document somebody reads once and files. These four artifacts are things your team uses for the next two years.
1. Architecture map
What the system actually is, as opposed to what the documentation claims and what any individual believes.
Contains: every service, datastore and external dependency; the real call paths including the ones that bypass the documented ones; data flows with ownership; the boundaries that exist in practice versus the ones that exist on paper; and — usually the most valuable single page — an explicit list of what we could not determine and why.
That last page is the one people photograph. “Unknown” written down and attributed is more useful than a confident diagram that’s wrong.
2. Risk register
Every risk found, scored, with an owner and a consequence stated in business terms.
Each entry carries: what the risk is in one sentence; likelihood and impact scored on a stated scale; the business consequence if it lands (revenue, compliance, availability, data loss); what it would take to remediate; and what it costs to leave alone.
The format matters because the register is the thing that goes to your board, your insurer and your acquirer. A risk written as “insufficient test coverage in the billing module” is an engineering complaint. The same risk written as “no automated verification that invoices are correct; a pricing change carries an unbounded chance of mis-billing customers, with no detection before the customer notices” is a board item.
3. Remediation plan
The risks in an order, with dependencies and effort, and a stated rationale for the sequence.
Sequencing is the part that takes expertise. Most risks cannot be fixed in the order of their severity, because the highest-severity item often depends on a safety net that doesn’t exist yet. The plan says what has to come first and why — which is usually observability and tests, and which is usually unwelcome news.
It also names what we recommend not doing. Every audit finds things that are genuinely suboptimal and genuinely not worth fixing. Saying so is part of the deliverable.
4. Fixed-price build proposal
A price and scope for the remediation work, produced from the map and the register rather than from a conversation.
This is the artifact that justifies the audit’s own cost. Any firm can quote a rebuild off a discovery call, and that quote will be padded with the risk of not having read the code. A quote built from an architecture map doesn’t need that padding. [INTERNAL LINK: /insights/fixed-price-vs-time-and-materials “why a paid diagnostic is what makes fixed-price quoting possible”]
You are under no obligation to accept it. See below.
Week by week
Week 1 — Read. Codebase access, repository history, infrastructure, monitoring, ticket history. We interview your engineers, including the ones who have been there longest and the one who joined most recently — the new hire’s confusion is diagnostic data, and it expires within a few months.
Week 2 — Map and score. The architecture map takes shape; findings enter the register with preliminary scores. Mid-week there is a checkpoint call: we show you what we have, you tell us what looks wrong. Audits that skip this produce documents with an avoidable error in them.
Week 3 — Sequence, price, hand over. Remediation sequencing, the build proposal, and a live walkthrough with your team where they can argue with the findings. We hand over source files, not just a PDF — the map is yours to maintain.
A two-week audit compresses weeks 2 and 3. Three weeks is right when there are multiple systems, regulated data, or an active incident load that makes engineer time hard to get.
$18K vs $35K: what moves the number
The band is honest, not a negotiating range. Five things determine where you land.
Number of systems in scope. One application is the bottom of the band. Four services with unclear boundaries between them is not four times the work, but it is meaningfully more, because the boundaries themselves are the finding.
Regulated data. HIPAA, SOC 2, PCI. Requires a compliance-specific pass and different evidence, and the register needs a control-mapping column. [INTERNAL LINK: /insights/legacy-modernization-compliance “modernizing regulated systems”]
Availability of your engineers. The single biggest variable, and the one you control. If the people who know the system are firefighting, interviews get rescheduled and reconstruction takes longer. A team that can give us six focused hours across three weeks lands near the bottom of the band.
Documentation state. Not whether documentation exists — whether it’s true. Confidently wrong documentation costs more than none at all, because each claim has to be checked.
Whether there’s an active incident. If production is currently on fire, people are unavailable and the system is a moving target. Consider [INTERNAL LINK: /insights/software-project-rescue “stabilizing first”] and auditing after.
The walk-away clause
You own all four artifacts whether or not you hire us afterward.
Not licensed. Owned. Hand them to a competing firm, use them for an acquisition process, act on the remediation plan with your own team, or do nothing at all. There’s no clawback and no conditional pricing.
This is unusual and the reason is commercial, not charitable. A diagnostic that can’t be taken elsewhere is a better sales funnel, and a worse product. A client who feels locked in negotiates like a hostage; a client who could walk and stays actually believes the plan. The second kind of relationship is the only one worth having for a six-to-twelve month program.
It also disciplines the work. An audit that might be read by a rival firm looking for holes is a more careful audit.
Audit or free review — which do you need?
| Code & Risk Review | Systems Audit | |
|---|---|---|
| Cost | Free | $18K – $35K |
| Duration | 90 minutes | 2 – 3 weeks |
| Who’s on it | Two of our engineers, no salespeople | A named team |
| Depth | One problem, examined properly | The whole system |
| You receive | Findings from the session | Four artifacts, owned outright |
| Good for | “Something’s wrong and I can’t name it” | “I need a defensible answer” |
Start with the free review if you can’t yet articulate the problem, or if you want to see how we work before spending anything. [INTERNAL LINK: /insights/what-two-engineers-find-in-90-minutes “what happens in those ninety minutes”]
Go straight to the audit if you already know what’s wrong and need it documented to a standard that survives contact with a board, an acquirer, an insurer or a lender. Ninety minutes cannot produce that and shouldn’t pretend to.
[INTERNAL LINK: /insights/legacy-system-modernization-cost “where the audit sits in our full price ladder”]
FAQ
$18,000 to $35,000 at WebFix, fixed price against fixed scope, delivered in two to three weeks. Where you land in the band depends on the number of systems in scope, whether regulated data is involved, how available your engineers are, and whether existing documentation is accurate.
Four: an architecture map of what the system actually is, a risk register scored with business consequences, a remediation plan with sequencing and rationale, and a fixed-price proposal for the remediation work. If a proposed audit doesn’t include all four, ask what you’ll be holding at the end.
Two to three weeks. Two when scope is a single system with available engineers. Three when there are multiple services, regulated data, or an incident load competing for your team’s attention.
Yes — all four, outright, with no clawback or conditions. You can hand them to a competing firm.
Often yes, for a reason that has nothing to do with discovery: you may know, but you can’t yet prove it to the people who control the budget. An audit converts an engineering opinion into a document a board, an insurer or an acquirer will accept.
After, if production is actively failing. An audit during an incident produces a document about a moving target, and your engineers won’t be available to answer questions. Stabilize, then audit.
Book it
Two to three weeks from now you could own an architecture map, a scored risk register, a sequenced remediation plan and a fixed-price build proposal — regardless of what you decide to do next.
Book a Systems Audit, or start with the free 90-minute Code & Risk Review if you’d rather see how we work first.
