1. Agree the decision
We establish the transaction context, the investment thesis and the questions that would change your decision. The scope records the systems included, the access required and the delivery date.
2. Build the evidence set
We review architecture documents, repositories, deployment and recovery procedures, security evidence and relevant commercial dependencies. Interviews help explain how the system actually behaves. Documents alone do not establish that a control works.
3. Test the important claims
We trace selected risks to source evidence. A recovery claim needs a test record; a scalability claim needs a workload and a measurement. We distinguish observed behaviour, reported information and assumptions.
4. Make the findings usable
Every significant finding includes its evidence, likely consequence and recommended action. Uncertainty is recorded. An executive summary supports the investment decision; a technical annex supports execution.
5. Read out and hand over
We walk through the findings, resolve factual questions and agree what remains open. You retain the report and decide who implements the recommendations.