IT audit, part 2: Three more areas you can’t afford to overlook in a system evaluation

The maintainability of a software system and the resources required for further development are not only influenced by its size and complexity but also by the quality of its implementation. A well-designed, high-complexity system may demand fewer resources than a moderate-complexity system with poor implementation quality.

But what exactly defines software quality? How can it be measured? These are the key questions we will address in the following sections.

As technical debt accumulates, maintaining and enhancing the system becomes more resource-intensive. Increased technical debt also means more time spent on daily operations and bug fixes, reducing the capacity available for developing new features.

Static code analysis tools play a crucial role in detecting and measuring technical debt. These tools scan the codebase and identify code smells—problematic coding patterns that can indicate deeper structural issues.

Architectural debt arises from deficiencies in the system’s modular design and overall architecture.

A poorly designed modular structure can significantly impact a system’s scalability, maintainability, and future development costs. For example, a monolithic architecture, where all components function as a single, tightly coupled unit, makes it challenging to scale, maintain, and introduce new features. Similarly, even in a modular system, if components are overly interdependent, changes to one module can have unintended consequences elsewhere. This increases the likelihood of regression errors and raises long-term development costs.

To identify architectural flaws, the following key metrics can be useful:

When business logic and data handling (such as database queries, file operations, or API calls) are tightly coupled, modifications to one component can inadvertently affect multiple areas of the system. This lack of separation complicates automated testing, technology upgrades, and system scalability, ultimately resulting in a fragile and difficult-to-maintain architecture.

To ensure proper structure and maintainability, the following design patterns can be applied:

A system lacking these design principles is a strong indicator of poor code structure and may require refactoring to enhance maintainability and long-term scalability.

Beyond assessing architectural design, evaluating source code quality is a critical aspect of an IT audit. Poorly written code significantly increases maintenance difficulty.

To assess code quality, static code analysis tools can be utilized. Additionally, the following key aspects should be closely examined.

Inconsistent naming conventions and poorly formatted code contribute significantly to technical debt, reducing code clarity and increasing maintenance costs. If variable, class, or method names are unclear or misleading, it becomes difficult for new developers to understand the system. Likewise, inconsistent or improperly formatted code decreases readability and leads to inefficiencies in debugging and development.

To eliminate these issues, teams can adopt coding standards and best practices to ensure consistency, automated formatting tools such as Prettier (JavaScript, TypeScript) or Black (Python) or linting rules to enforce proper formatting and naming conventions.

Duplicated code increases maintenance efforts, as any modification must be updated in multiple places, raising the risk of inconsistencies and errors. This redundancy reduces code clarity and maintainability, making future development more complex.

To detect and measure code duplication, the following key metrics can be used:

Excessively high cyclomatic complexity (CC), especially when widespread across the codebase, indicates that the code is difficult to understand and modify. A high CC value suggests that a function or module has too many decision paths, making it harder to test, debug, and maintain.

The SOLID principles serve as fundamental guidelines for maintainable and scalable software design. Violating these principles can contribute to technical debt, increasing maintenance costs, complexity, and regression risks.

Failing to apply well-established design patterns (e.g., Factory, Service Locator, Strategy, Command, Adapter, Decorator, Observer) can lead to code inconsistencies, high coupling, and low cohesion. This issue becomes particularly problematic in larger projects, where a consistent structure and scalability are essential for long-term maintainability.

During an IT audit, it is crucial to assess the presence and appropriate use of design patterns, as they significantly contribute to code sustainability, scalability, and ease of development.

The quality of exception handling is critical to ensuring system stability. Poorly implemented exception management can lead to hidden errors, unexpected crashes, and difficult-to-trace issues.

Common pitfalls include:

To mitigate these risks, systems should implement:

> Try-catch-finally for managing expected errors.

> Circuit Breaker Pattern to prevent cascading failures in distributed systems.

Hardcoded values and configurations reduce flexibility and increase maintenance costs. Storing database credentials, API endpoints, or configuration parameters directly in the code makes modifications cumbersome and raises the risk of errors and security vulnerabilities.

Best practices for handling configurations include:

During an IT audit, it is essential to assess whether standard frameworks and libraries have been utilized for non-business-specific tasks (e.g., logging, PDF generation, email handling) or if custom implementations were developed instead.

Leveraging widely used, well-documented libraries provides several advantages:

The stability and quality of a system are significantly enhanced when key business logic is well-covered by automated tests. During an IT audit, it is crucial to evaluate test coverage, both at the system-wide level and for individual modules.

Higher test coverage reduces the risk of introducing defects when making changes, as tests serve as an early warning system for potential issues.

Last but not least, the presence of up-to-date and relevant documentation is a key factor in system maintainability and knowledge transfer. High-level architectural and process documentation provides a clear understanding of system design and workflows. API and interface documentation ensures that system functionality is transparent and accessible to developers and integrators.

If documentation is outdated or incomplete, updating it may require significant effort. In such cases, tools such as static code analysis platforms and AI-driven solutions can assist in automatically generating documentation from the source code, at least partially.

The aspects discussed above contribute to a realistic assessment of software quality and associated risks. A thorough IT audit not only maps out the current state of the system but also enables organisations to take proactive steps to ensure that the software remains stable, sustainable, and cost-effective in the long run.

The foundation of efficient software operation lies in having the right infrastructure, a well-defined development workflow, and proper tooling to support it. Assessing the current setup in these areas can be a critical part of the audit process.

As a first step, it is crucial to determine whether the system currently runs on physical servers, in a virtualized environment (VMs), on a cloud platform, or within a containerized setup. This distinction has significant implications for operations, as well as for any potential migration or scaling plans.

It is important to assess the system’s resource demands - including CPU, GPU, memory, storage, and bandwidth - as well as the available capacity and the actual utilization ratio. If the system is already operating near the limits of its current infrastructure, scaling or expansion will likely become necessary in the near future.

Scaling physical servers typically involves higher costs and more complex changes. In contrast, expansion in a virtualized environment is generally more flexible and easier to implement.

In the context of scaling, the quality of the codebase and its readiness for scalability also become critical factors—an aspect previously addressed during the software quality assessment.

A robust monitoring and alerting system is essential for the stable and efficient operation of any software environment. As part of the audit, it is important to evaluate:

If monitoring and alert systems are missing or insufficient, their implementation must be factored into the operational transition plan.

In the event of hardware failures, software issues, or unexpected incidents, the presence of reliable backup and recovery procedures is critical. When taking over the operation of a system, the following aspects must be reviewed:

If these procedures are missing or incomplete, establishing proper backup mechanisms will require additional effort and cost.

It is also essential to define and assess the system's:

If the current backup and recovery setup does not meet these requirements, appropriate solutions must be planned and implemented to ensure operational resilience.

The tools used for version control (such as Git), along with the applied branching strategy and development workflow, play a vital role in streamlining both development and operations. As part of the audit, it's important to assess:

Well-implemented CI/CD systems enable fast, reliable deployments and support the integration of automated testing, reducing the risk of human error and ensuring higher code quality.

If these practices or tools are missing, their implementation - along with the associated costs and effort—must be considered during the operational transition.

Existing operational data can provide valuable insight into the current condition and maintainability of a software system.

By analyzing information from bug tracking systems and version control platforms, it is possible to identify patterns and trends that reveal the types and frequency of past issues, areas with high defect concentration, the pace and nature of recent development activities.

If the software uses a bug tracking system (such as Jira, Bugzilla, GitHub Issues, etc.) and issues are consistently recorded, it can serve as a rich source of operational insight. Key aspects to examine include:

The history stored in the version control system (e.g., Git) can reveal a great deal about the state of the software and the development process. By examining commit patterns and metadata, it is possible to identify problematic components or code areas using the following methods:

The insights gained from this data can help estimate the scope of future operational and development tasks, while also highlighting potential weaknesses or risk areas within the system. As part of the audit, it is therefore strongly recommended to thoroughly review both bug tracker and version control data in order to make informed decisions regarding future maintenance and development strategies.