CTO Audit

Overview

Produce a rigorous, CTO-level audit of a software system, focusing on architecture, implementation quality, performance, security, and operational readiness. Deliver evidence-backed findings with clear priorities and pragmatic improvements.

Audit Workflow

1. Clarify scope and constraints

   • Identify repositories, services, environments, and time constraints.
   • Capture business goals, scale targets, SLAs/SLOs, and regulatory constraints.
   • Ask for missing inputs (architecture docs, infra diagrams, deployment details).

2. Map the system

   • Inventory components: services, data stores, queues, third-party dependencies.
   • Trace critical flows: request path, data lifecycle, and failure modes.
   • Identify system boundaries and ownership.

3. Inspect architecture and design

   • Evaluate modularity, separation of concerns, and dependency direction.
   • Identify overengineering, premature abstraction, or tight coupling.

4. Assess implementation quality

   • Verify correctness in critical paths; check error handling and edge cases.
   • Identify incomplete features, TODOs, stubs, or silent failure points.
   • Note code smells that degrade maintainability.

5. Evaluate performance and efficiency

   • Identify hot paths, heavy I/O, N+1 patterns, and memory pressure.
   • Assess scalability limits (CPU, database, cache, network).
   • Recommend targeted optimizations with expected impact.

6. Review security and reliability

   • Check input validation, authn/authz, secrets handling, and data exposure.
   • Evaluate resiliency: retries, timeouts, backoff, circuit breaking, idempotency.
   • Note incident response readiness and observability coverage.

7. Review tooling, testing, and ops

   • Inspect test coverage and critical gap areas.
   • Check CI/CD, build reproducibility, dependency hygiene, and release safety.
   • Assess runtime monitoring, alerting, and runbooks.

8. Synthesize and prioritize

   • Group findings by severity and theme.
   • Highlight what works well and why.
   • Produce a prioritized roadmap of fixes and upgrades.

Evaluation Dimensions

• Architecture and system design
• Implementation quality and correctness
• Performance and efficiency
• Code quality and maintainability
• Security and reliability
• Tooling, testing, and DevOps
• Elegance and simplicity

Evidence Standards

• Cite concrete evidence: file paths, line numbers, configs, or logs.
• Separate confirmed issues from hypotheses; state assumptions clearly.
• Avoid ungrounded claims; request missing data when needed.

Output Format

Summary:

• State purpose and scope.
• Summarize the system overview (1-2 sentences).
• List key strengths (2-4 bullets).
• List top risks (2-4 bullets).

Findings (ordered by severity):

• Use severity buckets: Critical, High, Medium, Low.

For each finding, include impact, evidence, and a crisp fix direction.

Recommendations (prioritized):

1. List immediate fixes (safety and correctness).
2. List near-term improvements (quality, performance, maintainability).
3. List strategic investments (architecture, platform, scale).

Overall Assessment:

• State readiness for scale and operational risk.
• Provide a short rationale and confidence level.