Curated List of Technical Due Diligence Questions

Technical due diligence process is used to capture a snapshot to develop a thorough understanding of the technological state of a business to be able to make accurate and effective valuations for fundraising and investment rounds.

In this list, you will find a series of questions that range from human resources to disaster recovery where each one addresses a specific aspect of what makes a technology company. The way how handled with these topics is what makes a company unique in its own way.

To get the most out of this document, put your best effort into answering as honestly and openly as possible* *all the questions that apply to your business. In any case, you will gain a different perspective over the current state of your business.

For a professional follow-up evaluation report on your answers or for further technical auditing services please contact me.

Business

• Briefly introduce your company.
• Briefly introduce yourself. What's your role in the company?
• Which industry is your business in?
• Which phase of funding are you in right now?
• Who are your direct competitors with similar products?
• Do you have domestic/foreign patents/utility models/licenses of the technology / IP you have created?
• How compliant is your business with regional laws such as GDPR / KVKK technology wise?

Product / Service

• Briefly describe the product. What does it do and what problems does it solve?
• What is your target market?
• How far ahead do you have your product roadmap written down?
• How do you do the planning? What do you take into consideration? Who else contributes to the process?
• Have you or someone from your team built a similar product in the past? What was it?
• Do you or your team use your product regularly?
• How do you collect user/ customer feedback about the product? How do you utilize all the feedback?
• Are there any customized versions of your product deployed to some clients that are billed separately from the standard payment methods?

Team / Hiring / Human resources

• How many people are there in your team? How many have shares in the company?
• Briefly explain existing roles and their responsibilities in your team.
• Who are the team key players? Briefly explain.
• How many of them worked for / with you (elsewhere) in the past?
• Is the person who wrote the initial version still one of the main developers?
• How often do you do one-on-ones with your team?
• How does the team communicate and make decisions?
• How do you do the onboarding of new team members? How long does it take for a new member to get into actual coding?
• How do you make sure that the whole team is on the same page?
• What are the values of your engineering organization? Do all your team share those values?
• Do you have a list of missing roles / talent in your organization?
• How do you find and attract new talents?
• How does your interview process work? Who else contribute to the process? Who decides on the hiring?
• What is your career development plan for your team members?
• Last year, how many people have left and how many have joined? What was the main reason for them to leave?
• How do you keep the talent from leaving? How do you keep your team motivated?
• Do you have a list of possible contractors / service providers / former team members at hand if immediate need rises?
• How would you improve the development team?
• How would you improve the hiring process?

Technology / Code

• How do you keep yourself and your team up to date with the latest technologies?
• What technologies (frameworks/languages) do you use for the product? How do you decide on them?
• What are the new technology transformations you are planning?
• Has all the software been coded in the house? How do you choose build vs buy?
• How well is your code documented?
• How well is your product documented?
• How much are you aware of your code's dependencies? What happens if for some reason a dependency is not accessible anymore?
• Do you have anything hardcoded in the code? How do you show certain features to a limited number of users?
• What development methodology do you use? Briefly explain.
• How do you keep a consistent coding style? Briefly explain.
• How do you keep a consistent development / release environment across all involved systems, including developers’?
• How do you evaluate your code's quality?
• How much of your code is reusable?
• How do you use bug / issue trackers?
• How many open issues/defects are there? How old is the oldest? How many of them did you close last month?
• How do you use source / version control?
• How do you do code reviews?
• How do you test your code? How much of your code is covered?
• How do you test your product?
• How much technical debt do you have? What is your pay back strategy?
• What do you optimize for?
• How often do you ship new releases of your product? What is your releasing strategy?
• How do you deliver new releases? Briefly explain your integration and delivery process.
• How accurate is your release timelines? Briefly explain the reasons.
• How often do you find yourself shipping products with known bugs?
• How do you deploy new releases? Briefly explain your deployment process.
• How often do you find yourself carrying out manual tasks on servers? Briefly explain.
• What happens when a deployment task fails?
• Does the software automatically notify you of errors?
• How do you measure the effects / outcomes of each new release?
• How would you improve the development processes?
• How would you improve the deployment processes?

Architecture and Infrastructure

• How much of your architecture and infrastructure is documented?
• How many vendors (AWS, Azure, etc) is your service/ product scattered across? Briefly explain.
• Which 3rd party systems (payment, invoicing, others) do you use? Briefly explain.
• How dependent are you to a specific vendor? What happens if they go down / halt operations?
• What are the possible bottlenecks of your architecture? What keeps you awake at night?
• How do you measure the current max capacity of the system?
• Do you know how much it can support? How close are you to the limits right now?
• Are you able to easily scale up / down your infrastructure on a few clicks?
• What metrics do you use to determine if you are not scaled appropriately?
• What aspects of the system do you think might not scale well?
• Are you able to easily shift your services to other locations / providers? Briefly explain.
• What isn't automated that should be?
• Are there any single points of failure? Briefly explain.
• What would you have to change to accommodate x10, x100, x1000 more users?
• How would you improve maintainability?

Security, Continuity, Monitoring

• What are you monitoring? Briefly explain.
• Which monitoring tools are you using?
• How do you measure usage/user statistics?
• How do you measure the value of users?
• Are there any parts in the system that are understood by only one person?
• What requires admin privileges? Who has it?
• What kind of security measures are taken against standard stuff like SQL injection, XSS, etc?
• In the case of a security breach, how much data/business would be at risk?
• Have you ever had a data breach? What do you think the reason was?
• How do you test your product security wise?
• How would you know if any kind of security breach happens?
• How would you make the system more secure?
• What's your backup strategy? Briefly explain.
• Would a DDoS attack put you out of business? Briefly explain.
• Do you have an IT Disaster Recovery Plan? Briefly explain
• Do you have a Business Continuity Plan? Briefly explain

Budgeting

• What is the technology team budget (ie. %x of total annual) and how is it allocated?
• Are the allocations always used as planned? Briefly explain.