Before making a substantial change to an inherited software product, establish how it is built, tested, deployed, and used—and what risks or unknowns could affect that change. A code audit is a baseline for informed decisions, not proof that the product is defect-free. Its scope should reflect the product’s architecture, data, privileges, exposure, deployment model, and business impact.
What an inherited-code audit should tell you
A code audit examines how well code follows coding practices and design specifications. For a new maintainer, it also asks whether the system is understandable and safe to change. NIST’s Guidance on Software Maintenance says a code review or audit determines how well code adheres to coding standards, practices, and design specifications, and notes that understandability becomes critical when someone other than the original developer must maintain it.
As an Amazon Associate I earn from qualifying purchases.
Use the audit to answer three practical questions: Is the code easy to change? Can you get timely, meaningful feedback when you change it? Do you understand how the system behaves and what depends on it? A successful build alone cannot answer those questions or establish that the software is secure or correct.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Clear out junk files and repair common Windows errors3Scan for outdated or missing drivers - takes under a minute1. Establish ownership and operating context
First identify what you are responsible for and how the product operates. A repository is only one part of the system: production behavior may depend on deployment configuration, external services, credentials, data, and permissions that are not obvious from source code.
#1 Best Overall
- Identify repositories, maintainers, supported branches, releases, and any components owned by another team or vendor.
- Locate the documented build, test, deployment, and rollback instructions. Record runtime environments and the toolchain they require.
- Map external services, integrations, scheduled jobs, and other systems that depend on the product.
- Understand what data the product handles, how sensitive it is, and which user roles or service accounts can access it.
- Find out how secrets and credentials are stored, provisioned, rotated, and restricted.
- Review available change and incident history, and note what access or operational knowledge still needs to come from the previous owner.
Do not assume that the repository contains the full operational picture. Mark missing access and undocumented behavior as open questions rather than filling gaps with guesses.
2. Reproduce a baseline before changing code
Follow the documented setup in an isolated, authorized environment. Capture enough detail that another maintainer can distinguish a product failure from a local setup problem.
- Record the repository revision, environment, and relevant compiler, runtime, build-tool, and dependency versions.
- Run the documented build and test commands without first altering the code. Save the outcomes, warnings, and failures.
- Record steps that cannot be repeated, unavailable services, missing credentials, and tests that require a particular environment.
- Compare results with any documented expectations or known-good build. If no expectation is documented, record that uncertainty explicitly.
A passing build or test suite only reports what those checks cover under the conditions in which they ran. NIST’s recommended minimum standards for vendor or developer software verification describe multiple complementary verification activities; they do not make one successful check a universal guarantee.
Recommended Free Tools
3. Review design and code for changeability
Arrange for someone other than the original author, where possible, to review the code. An independent reviewer may notice assumptions the author no longer sees. NIST’s maintenance guidance suggests examining whether comments are meaningful and consistent, names and labels are clear, constants are used appropriately, formatting is consistent, and code is readable.
Relate that review to the product’s design and likely change paths. Depending on the system, inspect:
- Architecture, module boundaries, and places where responsibilities or dependencies are unclear.
- Error handling, configuration, and assumptions about environment or service availability.
- Authentication and authorization paths, input validation, and sensitive data flows where relevant.
- Logging and operational signals, including whether they help diagnose problems without exposing sensitive information.
- Comments, naming, constants, labels, and formatting that affect a new maintainer’s ability to reason about behavior.
Readable code is useful, but readability review is only one part of risk assessment. It does not replace testing, security review, or verification of actual runtime behavior.
Rank #3
4. Inventory dependencies and check their status
Third-party software can introduce security and continuity risks even when the application’s own code is unchanged. Inventory direct and transitive packages, libraries, services, build tools, and, where feasible, their versions and origins. Include dependencies used to build or deploy the product, not just those visible at runtime.
Check whether components are maintained and whether known vulnerabilities remain unaddressed. NIST’s Secure Software Development Framework (SSDF) discusses verifying third-party components and planning for modules or services that are no longer maintained or available. NIST’s software supply-chain guidance addresses acquisition, use, and maintenance of third-party software and services. CISA’s open-source software guidance highlights component inventory, vulnerability management, and patch management.
For an unsupported or unavailable dependency, record the affected product area and decide whether to update, replace, isolate, or accept it with an explicit rationale. Component status and vulnerability information change, so verify them against current sources during the audit.
5. Combine verification methods that fit the risk
No single scan provides a complete audit. Choose methods according to the product’s technology, architecture, exposure, and potential impact. NIST’s verification guidance names these complementary categories:
- Manual review: Adds design and product context that an automated finding may lack.
- Static analysis: Examines source without executing the program; results need interpretation and validation.
- Dynamic analysis and testing: Examine behavior while the product or a component runs, within the scenarios and environments covered.
- Software composition analysis: Helps assess third-party components and their known vulnerability status.
- Penetration testing: Probes applicable exposed attack surfaces; it does not establish that untested paths are safe.
When comparing tools or methods, consider language and framework coverage, whether the method examines source or runtime behavior, integration with the existing build and release flow, how explainable its findings are, and the human effort needed to validate them. NIST identifies technique categories but does not establish a universal ranking or endorse a particular vendor.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware match6. Record findings so the team can act
Keep confirmed defects, unverified concerns, and maintainability observations distinct. A static-analysis warning is not automatically an exploitable vulnerability: confirm the affected code path and product context before describing its impact or assigning priority.
Best Value
For each finding, capture:
- The affected file, component, dependency, or behavior.
- The evidence observed and the steps or conditions needed to reproduce it, if known.
- Plausible impact, confidence, and affected versions or environments, where established.
- The next action, an owner, and a priority based on product context rather than a tool label alone.
- Any missing access, testing, or operational information needed to resolve uncertainty.
There is no universal time estimate, defect yield, or risk-reduction percentage for auditing an unspecified inherited product. Treat the audit as a decision baseline: its useful result is a traceable account of what is known, what remains uncertain, and what should happen next.
7. Make the first change under control
Choose a small, reviewable change that addresses a real need and, where possible, improves understanding or adds a safety net. Before release:
- Run the existing checks and record the baseline results.
- Where feasible, add or improve tests around the behavior being changed.
- Run the checks again and review the complete change, including configuration or dependency updates it requires.
- Obtain the approval required by the product’s change-control and release process before installation or deployment.
If a check cannot be run or a behavior cannot be tested, make that limitation visible in the change review instead of implying it passed. NIST’s maintenance guidance places review and approval in software change control before installation.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
