Architecture Review Report
A shortened example of the report you get at the end of an architecture review. Real reports have the same sections; the findings are backed by code samples, query plans and screenshots.
This is an example. The company, the system and all the numbers are made up; none of it is based on any client’s data. The scenario: a company that builds B2B order and stock management software, with a software team of 8.
1. Executive Summary
- The system carries today’s load, but once the number of customers doubles, reporting and the order flow are expected to become bottlenecks.
- The most urgent risks are in security and continuity: the database backups have never been tested with a restore, and the admin panel is open to everyone.
- There is no need for a rewrite. The recommended path is to split the existing monolith into modules and harden it step by step over 6 months.
2. Scope and Method
- Duration
- 5 business days
- Reviewed
- The main application’s codebase (~120k lines), the database schema, the server and deployment infrastructure
- Interviews
- 4 interviews with the tech lead, two developers and the operations lead
- Tools
- Code review, query plans (EXPLAIN ANALYZE), dependency and security scans, load profiling
3. Findings
Ranked by impact and urgency.
- #1CriticalContinuityEstimated effort: 1 day
Daily backups are taken but have never been tested with a restore; the backups sit on the same server.
Impact: A disk failure would lose both the data and the backups.
Recommendation: Move the backups to a separate location and run a restore test every month.
- #2CriticalSecurityEstimated effort: 2 days
The admin panel is open to the internet, with no two-factor authentication and no limit on login attempts.
Impact: A brute-force attack could reach all customer data.
Recommendation: Put the panel behind a VPN or an IP restriction and add 2FA and rate limiting.
- #3HighPerformanceEstimated effort: 3 days
The monthly report query scans an unindexed table from start to finish (38 s on average).
Impact: The order screens slow down while the report runs.
Recommendation: Two composite indexes, and reading the report from a summary table prepared overnight.
- #4HighArchitectureEstimated effort: 4-6 weeks
The order, stock and billing code writes directly to each other’s tables.
Impact: A change in one module breaks the others; new features are getting slower.
Recommendation: Draw the module boundaries and route communication between modules through a single service layer.
- #5MediumMaintenanceEstimated effort: 2 weeks
The framework is two major versions behind; 14 dependencies have known vulnerabilities.
Impact: Security updates cannot be applied, and the upgrade gets harder every month.
Recommendation: Upgrade the dependencies first, then the framework, one version at a time.
- #6MediumTeamEstimated effort: 2-3 weeks
Automated test coverage is 8%; deployment is manual and depends on one person.
Impact: Nothing can go live while that person is away; bugs are noticed by customers.
Recommendation: E2E tests for the critical flows and an automated deployment pipeline.
4. Target Architecture
- It stays a single application (a modular monolith); orders, stock, billing and reporting are separate modules.
- Reporting reads from summary tables that do not load the main database.
- The admin panel is on the internal network; deployment is automated and can be rolled back.
5. Migration Plan
First 30 days
Close the risks
- Backups and a restore test
- Admin panel security
- Speeding up the report query
1-3 months
Harden the foundation
- Dependency and framework upgrades
- Tests for the critical flows
- Automated deployment pipeline
3-6 months
Split into modules
- Separating the order and stock modules
- Moving billing to the service layer
- Architecture documentation and handover to the team
Would you like this report for your own software? An architecture review takes 5-7 business days.