Tech Stack Audit Template
The format I use when I audit a company's technology: one row per system, six layers of questions, four possible verdicts. It is all on this page, with no download form and no email required. Copy it into a spreadsheet and fill it in with your team.
A tech stack audit is a structured inventory of the full technology stack a company runs — application code, infrastructure, databases, SaaS subscriptions, and AI services — with every system scored for cost, health, risk, and ownership. This template is the format Oleg Sotnikov uses on client engagements: six columns per system, six layers of probing questions, and four possible verdicts (keep, upgrade, replace, kill). It is published in full on this page, with no email gate. Two or three people who know the systems can complete it in an afternoon.
One Row Per System, Six Columns
Every system in the company gets a row. A system with no row has no owner, and finding those is worth the afternoon on its own.
| System | Owner | Monthly cost | Health | Risk if it fails | Verdict |
|---|---|---|---|---|---|
| [Example] CRM | Ops | $400/mo | Yellow | Sales blind for a day | Replace |
Example row, fictional and shown for shape only.
Health, in three states
- Green: it works, someone owns it, the price is fair. Leave it alone.
- Yellow: it works, but something is off, whether the price, the version, or the single person who understands it.
- Red: failing, unsupported, or already costing you customers. Fix or remove it this quarter.
System
The name people actually use, not the vendor's product name. One row per system, including the ones bought on somebody's personal card.
Owner
A person, not a department. If two names go in the cell, write both and treat it as a finding. Shared ownership usually means no ownership.
Monthly cost
What it costs this month, seats nobody uses included. Annual contracts get divided by twelve. Internal systems get an honest estimate of hosting plus the hours spent keeping them alive.
Health
Green, yellow, or red. One word, no half-shades. Force the call. The argument about which color applies is where the real information comes out.
Risk if it fails
What breaks tomorrow morning if this system is gone, in one sentence a non-engineer understands. "Sales blind for a day" and "we cannot bill anyone" belong in different places on the priority list.
Verdict
Keep, upgrade, replace, or kill. Every row ends in one of the four. "We'll see" is not a verdict, and rows without one quietly stay forever.
Work Through It Layer by Layer
Take one layer at a time, with the people who run it in the room. A question nobody can answer is already a finding.
Frontend & clients
Everything a user touches: web, mobile, admin panels.
- Which framework versions are in production, and when was each last upgraded?
- How long does a one-line copy change take to reach users?
- Which admin panels exist, who can log into them, and when was that list last reviewed?
- What is the mobile app's crash rate, and who looks at it?
- If the person who built the front end left tomorrow, who ships the next release?
Backend & APIs
The services, jobs, and integrations behind the product.
- How many services are running, and how many of them are documented?
- Which third-party integrations would break the product if the vendor disappeared?
- What happens to a request when the slowest dependency times out?
- Which jobs run overnight, and who notices when one silently stops?
- Can a new engineer run the whole backend locally on day one?
Data & storage
Databases, warehouses, buckets, and every copy taken out of them.
- When did you last restore a backup, rather than just take one?
- Where does customer personal data live, and how many copies exist?
- Which reports does the business trust, and which numbers do two dashboards disagree about?
- What is the largest table, and what is the plan when it doubles?
Infrastructure & CI/CD
Hosting, pipelines, monitoring, and the path from commit to production.
- How long does a deploy take, and how long does a rollback take?
- What is the monthly cloud bill, and who sees it before finance does?
- Which environments exist, and which of them run around the clock for nobody?
- When production breaks at 3am, who gets paged and what do they open first?
- Could you rebuild the whole environment from a repository, or only from memory?
SaaS & internal tools
Everything on a card: subscriptions, seats, and the spreadsheet a department runs on.
- Pull the last three card statements. Which subscriptions surprised you?
- How many seats are paid for, and how many were used last month?
- Which tools hold data you would need back if you cancelled tomorrow?
- Which critical process depends on one person's spreadsheet or personal account?
AI & LLM services
Models, agents, and the token bill nobody reviews.
- Which models are in production, at which versions, and who chose them?
- What did AI cost last month, and which feature spent the most?
- Who owns output quality, and how does a bad answer get reported and counted?
- What data leaves the company inside prompts, and under whose terms?
- If a provider raised prices or retired a model next month, how long would switching take?
Every Row Ends in a Verdict
Four outcomes, one per system. This column is the reason the exercise exists.
Keep
It works, it costs what it should, and someone owns it. Write the verdict down anyway. A deliberate keep is not the same as a system nobody has looked at in three years.
Upgrade
The choice was right; the version or the configuration is not. Cheapest verdict to act on, and the easiest one to postpone forever.
Replace
It does a real job badly. Replacement costs a migration, so it needs a name, a date, and a budget. Otherwise it becomes a keep by default.
Kill
It costs more than it returns and nothing important depends on it. Cancel the contract, shut the service down, delete the DNS record.
Most audits find at least one kill, usually a tool nobody admits to owning, still billing monthly, still holding a copy of your customer data.
Frequently Asked Questions
What is a tech stack audit?
A tech stack audit is a structured review of every system a company runs (application code, infrastructure, databases, SaaS subscriptions, and AI services), with a record of who owns each one, what it costs, how healthy it is, and what breaks if it stops. The output is a list of systems, each with a verdict attached: keep, upgrade, replace, or kill. Most companies find they own more systems than they thought, and that several have no owner at all.
How often should we audit our tech stack?
Once a year is enough for a stable company, and after the first pass the review takes a few hours per layer. Run it out of cycle when something changes the shape of the business: a funding round, a merger, a rewrite, a doubling of headcount, or the departure of the person who knew how everything fit together. Investors and acquirers ask these questions anyway, so having the answers ready costs less than assembling them under a deadline.
Who should fill in a tech stack audit template?
The people who run each system, not one architect working alone from memory. An architect can list the services; only the engineer on call knows which job fails quietly every third night, and only the ops lead knows which subscription renews next month. Give each layer to its owner, then review the finished rows together. The disagreements about a health color are usually the most useful hour of the day.
What do we do with the results?
The verdict column is the roadmap. Sequence the kills first, because they are savings with no migration attached, then the replaces, which need a budget and a date, then the upgrades, which fit inside normal sprints. Put the whole list in front of the leadership team with the monthly costs beside it; the argument about priorities gets much shorter once the numbers sit on one page.
The Same Audit, Run by Me
Five business days across every layer above, plus the payroll and LLM numbers your team has nothing to benchmark against. You get a prioritized plan, not another spreadsheet to maintain.
At least $50,000/year in identified savings — payroll, cloud, and LLM bills — or the audit is free.
Related reading
Architecture, cost, and the systems companies forget they own.
