Skip to content
Ameen Abozaid
Englishالعربية
STF-010

Technical due diligence

  • 8 Lessons
  • 3.5 h practice (estimate)
Start module
On this page 9 topics

Overview

Topics

  • Assessing architecture
  • risk
  • team capabilities
  • modernization needs

Learn first

3.5 h of practice (estimate)

Learning outcomes

  1. Assess an unfamiliar organization's architecture, code health, operations, security, and team capability quickly.
  2. Separate deal-breaking risks from fixable debt and estimate remediation cost.
  3. Produce a due-diligence report for acquisitions, vendor selection, or internal modernization.
  4. Recommend a modernization plan sized to the findings.

Lessons

  1. 01When due diligence is needed
  2. 02Assessing architecture and code health
  3. 03Assessing operations and security
  4. 04Assessing team capability and key-person risk
  5. 05Risk severity and remediation cost
  6. 06Writing the report
  7. 07Demo: a two-week due diligence of an acquisition target
  8. 08Demo: presenting findings to a deal team

Lab and exercises

Lab

STF-010-LAB1 · Acquisition review

Outcomes: 1–4 · Time: ~2.5 h

  1. Review the payments start-up's architecture docs, repository sample, incident history, and team interview notes (case materials).
  2. Assess architecture, code health, operations, security, and team capability with a common checklist.
  3. Build a risk register separating deal-breakers from fixable debt with costed remediation.
  4. Write the report with a go/no-go recommendation and conditions, plus a modernization outline sized to the findings.
  5. Present to a role-played deal team and answer challenges.

Acceptance: top risks costed; recommendation stated with conditions.

Exercises (case-based; six exercises)

IDOutcomeTask
STF-010-EX011Given a one-page description of a target, list the ten questions and evidence requests you would send in day one.
STF-010-EX021Review a sample repository summary (no tests, two-year-old dependencies, one deployer) and rate each area.
STF-010-EX032Classify six findings as deal-breaker or fixable debt and estimate cost ranges with confidence.
STF-010-EX042A colleague criticizes the target's code style. Redirect the review to risk with three better findings to look for.
STF-010-EX053Write the summary page of a due-diligence report with recommendation, conditions, and unknowns.
STF-010-EX064For a target with a fragile monolith and strong team, outline a modernization plan sized to the findings.
Show solutions
  • EX01 Examples: last three incidents, backup restore test, access list, vulnerability scan, payment-compliance evidence, architecture diagram, deployment process, team structure, key-person map, customer concentration.
  • EX02 Test gaps are high risk for change; old dependencies medium to high (security); single deployer is key-person risk; give ratings and fixes.
  • EX03 Deal-breakers: unlicensed core code, no way to meet required scale. Fixable: missing tests, dependency upgrades. Costs in engineer-months with ranges.
  • EX04 Style rarely drives risk; check change failure history, data protection, recovery capability.
  • EX05 Lead with go with conditions or no-go; top three risks with costs; unknowns and extra access needed.
  • EX06 Stabilize with tests and monitoring, then strangle the riskiest modules behind interfaces; retain the team; stage the investment.

Outcome coverage: all four outcomes are covered by exercises and lab.

Workplace evidence: an assessment you produced that informed an acquisition, vendor, or modernization decision.

Quiz

Outcomes: O1 rapid assessment · O2 deal-breakers versus fixable debt · O3 the report · O4 modernization plan.

A self-check for you: nothing is graded, saved or sent anywhere. Choose an answer, then check it. You can try again as often as you like.

  1. 1Due diligence should focus on:O1
  2. 2Which evidence best shows recovery capability?O1
  3. 3Key-person risk means:O1
  4. 4A deal-breaker is a finding that:O2
  5. 5Remediation estimates should include:O2
  6. 6Dependencies two years out of date are usually:O2
  7. 7A report should begin with:O3
  8. 8Why list what you could not verify?O3
  9. 9A modernization plan should be:O4
  10. 10When challenged on confidence, you should:O3

Practical part

Six case exercises STF-010-EX01 to EX06 plus the lab, with the report presented to a role-played deal team. Pass: at least five of six exercises correct, quiz at least 8/10, and a report whose top risks are costed and whose recommendation states conditions.

Common mistakes

Judging style instead of risk; missing people risks; findings without cost estimates.

Assessment

Report and presentation to role-played deal team.

Workplace evidence

An assessment you produced that informed an acquisition, vendor, or modernization decision.

Career relevance

Vendor evaluation (ARC-040) and legacy modernization (ARC-010).

Type to search levels, phases, modules and lessons.