How much does a code audit cost?
A CodeFirst code audit costs £1,950 at a fixed price and takes 1 to 2 weeks. If you go on to commission follow-on work from us, the audit fee is credited against it, and the report is yours whatever you decide.
- Code audit, fixed price
- £1,950
- Time taken
- 1 to 2 weeks
- .NET upgrade assessment, fixed price
- £2,500
Our published prices, excluding VAT.
What the price covers
The audit is a review of an application’s code, database, hosting and release process. It ends with a written report in plain English and a call to walk through the findings. The report says what state the system is in, where the risks are and what we would do about them, in order of priority.
The price is fixed. It is confirmed in writing before the audit starts and does not change if the code turns out to be harder to read than expected. Fixing what the audit finds is separate work, quoted once you have decided what to act on. The code audit page lists everything the report covers.
What moves the price
Size and number of applications. One application with one database is a smaller job than several applications that share data. If your system is much larger than usual, or is really several systems, we say so on the first call and confirm the price before any work starts.
Access. With access to the hosting environment and database as well as the code, we can check server versions, backups and how a release reaches production. With the code alone there is less to examine, and the report says plainly what could not be checked.
Unusual or mixed technology. A system that combines several generations of technology, or relies on components that are no longer sold, needs extra investigation.
If your only question is whether an application can move from .NET Framework to modern .NET, the narrower .NET upgrade assessment answers it.
How to compare audit quotes
Audits vary more in what they include than in what they cost, so compare the scope before the price.
- Does the auditor build the code? Reading code shows how it is written. Building it shows whether the copy you hold is complete and matches what is running.
- Are hosting and backups included? Many of the serious risks in a business system sit outside the code: a server that no longer receives security fixes, a backup nobody has tried to restore, an account in a former employee’s name.
- Who is the report written for? A list of technical findings is of little use to the person making the decision. Ask to see the structure of the report before you commission one.
- Is it independent? In our view, an audit offered free is usually paid for by the work it recommends. Check that the report will be yours to take to anyone.
An audit is not a penetration test or a compliance certification. Those are specialist services, and an insurer or customer who asks for one will not accept a code audit in its place.
After the report
Some clients take the report to their existing team and act on it themselves. Others ask us to deal with the priority items or to take the system over. If you commission follow-on work from us, the audit fee is credited against it.
Related questions
Can you audit a system if we do not have the source code?
Not usefully. An audit works from the source code, so the first step is to obtain a copy from whoever holds it. If the code cannot be found, that is the main finding in itself and the options are different.
Is a code audit the same as a penetration test?
No. A penetration test is a controlled attack on the running system by a security specialist, and we do not provide one. A code audit looks at how the system is built, hosted, backed up and released, and reports known vulnerabilities in the components it depends on.
What if we use another company for the work afterwards?
The report is yours and is written so that any competent team could act on it. The credit for the audit fee applies only to work you commission from us.
How much of our time does an audit take?
A short call at the start to explain what the system does and what prompted the audit, the time needed to arrange access, and a walk-through call at the end. The review itself does not need your staff.
Want the answer for your system?
Tell us what the software does and what you are trying to decide. We will reply with a straight answer and what we would need to know to be more precise.