The Technology Due Diligence Checklist: What to Ask and Where Answers Live

How to Use This Checklist

Twenty questions, five areas. Each one names where the answer can be verified, because the operating principle of good technology diligence is simple: the deck is testimony, the systems are evidence. An answer that can't be traced to a log, a report or a record is a claim, and claims are what diligence exists to test.

Use the list to focus interviews rather than replace them. Verify what can be verified first. Then spend interview time on the questions the records raised, not on the ones the records already answered. For the wider workstream, see the technology due diligence guide.

Delivery and Execution

Delivery is where the roadmap meets reality. Four questions:

• How often does code reach production? Where the answer lives: deployment logs or pipeline history for the trailing six months. Weekly or better is the working bar for SaaS.
• How long does a change wait for review? Where the answer lives: pull request timestamps, opened to merged. Watch the median, not the best case.
• What share of engineering work is unplanned? Where the answer lives: ticket categories in the tracker. Past roughly 40 percent, strategic work is being crowded out.
• Can the team ship a fix within one business day of deciding to? Where the answer lives: the timelines of the last three urgent fixes, end to end.

Codebase and Technical Debt

Debt determines how much of the team the buyer is really getting. Four questions:

• What share of engineering time goes to maintenance versus new capability? Where the answer lives: sprint composition and branch types. For reading the ratio, see technical debt assessment.
• Which files change in nearly every release? Where the answer lives: repository change-frequency history. A handful of ever-churning files marks the fragile core.
• How far behind are the dependencies? Where the answer lives: the manifest versus current versions, and the cadence of update commits.
• Do the tests actually gate releases? Where the answer lives: pipeline configuration, plus the recent history of skipped or overridden checks.

People and Knowledge

Knowledge concentration is the risk that resigns with two weeks' notice. Four questions:

• Which systems have a bus factor of one? Where the answer lives: contributor distribution per module. One name on the billing system is a finding.
• Who alone can deploy, restore, or run billing? Where the answer lives: access lists, runbook authorship, the on-call rota.
• How long until a new engineer's first production change? Where the answer lives: first-deploy dates for recent hires. Two weeks is strong. Six or more points to undocumented systems.
• Are the big decisions written down? Where the answer lives: architecture decision records, dated and referenced. The valuable part is why, not what.

Infrastructure and Scalability

Growth assumptions live or die on infrastructure headroom. Four questions:

• Can the production environment be rebuilt from code? Where the answer lives: infrastructure definitions in the repository, and the date they were last exercised.
• How much headroom exists at current load? Where the answer lives: utilization trends, cost trajectory, response times at peak.
• What breaks at twice the load? Where the answer lives: load-test evidence. Its absence is also an answer.
• What did the last outage cost, and what changed after it? Where the answer lives: incident reports and the follow-up work they generated.

Security and Compliance

Security liabilities transfer at close, priced or not. Four questions:

• When was the last penetration test, and what got fixed? Where the answer lives: the report plus retest evidence. Open criticals age badly.
• Who can touch production data today? Where the answer lives: access review records and offboarding evidence for recent departures.
• Which certifications exist, and what do they exclude? Where the answer lives: the report's scope section and exceptions, not its cover page.
• Which vendors hold customer data? Where the answer lives: data-processing agreements checked against the live vendor list. For the deeper workstream, see cybersecurity due diligence.