Technical due diligence: a complete guide for investors / What to assess
Assessing technical debt
Technical debt is the extra work created by quick solutions a company chose to move fast, plus the ongoing cost they add later as slower, riskier changes. Assessing it in technical due diligence means telling acceptable debt from debt that will stop the roadmap, measuring it well enough to price, and checking whether the team has a plan to fix it. Every real codebase has debt, so the finding is never that debt exists. The finding is where it is, whether the team can name it, and whether releases are getting slower because of it.
Published July 27, 2026. Updated September 17, 2026. Editorial.
Key takeaways
- Technical debt is the quick solutions chosen to move fast plus the ongoing cost they add, a comparison with borrowing money that Ward Cunningham created in 1992.
- Some debt is prudent and deliberate. Martin Fowler's quadrant separates that from the reckless kind, and reckless, inadvertent debt is the kind that causes the most damage.
- The clearest sign of dangerous debt is a team that releases more slowly over time, visible in DORA lead time and change fail rate trends.
- Price the debt as the work to fix it, and check that fixing debt is part of how the team plans rather than something it never gets to.
Every company that moved fast has technical debt. It is the quick solutions chosen to release on time: the quick fix instead of the clean one, the feature added on top instead of designed into the system, the cleanup postponed to meet a deadline. Often it is a sign of a team that made sensible trade-offs to get to market. The problem is only the ongoing cost of those quick solutions, which grows until someone fixes them.
What is technical debt, and where did the term come from?
Technical debt is the extra cost of maintaining a system that comes from choosing the quick solution over the better one. Ward Cunningham created the comparison in 1992 while explaining to his employer why a rewrite was needed, and his explanation still contains the whole idea: releasing first-time code is like going into debt, and a small amount of debt speeds development so long as it is paid back promptly with a rewrite. He added that the danger comes when the debt is not repaid, because every minute spent working around imperfect code counts as interest on that debt.
That explanation is why the review treats debt as a number rather than a mark against the team. As we have argued, execution speed is the moat, and speed sometimes means choosing quick solutions on purpose and accepting extra work later. So the question is "is there debt that will slow or stop the growth in the thesis, and does the team have a plan to handle it", which is the approach the main guide uses for the whole review.
Reveneau's technical debt assessment asks the team to list its own debt, and where it is, before the reviewer does, because a team that can point to its worst debt and say why it took the shortcut has a plan waiting to be funded, and a team that cannot see its own debt cannot plan for what it cannot name.
Why does every codebase have debt, and why is that acceptable?
Every codebase has debt because software is built under deadlines by people who learn as they go. A review that criticises a company for having debt is measuring the wrong thing, the same as criticising it for having outages. Taking a shortcut to validate a product, with a plan to fix it once the product shows it works, is good judgment.
Stripe's 2018 survey of developers and executives, by its own account, found the average developer spending 13.5 hours of a 41.1-hour week on technical debt and 17.3 hours on maintenance work such as debugging and refactoring. Those are vendor figures from a single survey, but they give a reference point: a team that reports numbers in that range is describing a normal codebase. A team that reports far higher numbers, or that cannot say, is describing something else.
How do you tell healthy debt from dangerous debt?
Acceptable debt is limited to one area, known, and cheap to maintain. Dangerous debt spreads, is often hidden until you look, and makes the whole system slow and risky to change. Martin Fowler's technical debt quadrant, published on 14 October 2009, gives a reviewer a way to sort what the team describes.
| Quadrant | Fowler's example | What it looks like in diligence | How to treat it |
|---|---|---|---|
| Prudent and deliberate | "We must ship now and deal with the consequences" | The team can name the shortcut, the reason, and the plan to fix it | Price the repair; this is normal |
| Prudent and inadvertent | "Now we know how we should have done it" | Design lessons learned after the fact by a good team | Expect it; Fowler calls it inevitable for excellent designers |
| Reckless and deliberate | "We don't have time for design" | Shortcuts with no plan and no owner, across the codebase | A team and culture finding, priced with the repair |
| Reckless and inadvertent | "What's layering?" | Messy code from people who did not know better | The costly category; the fix is usually people as much as code |
The quadrant matters because the same amount of debt costs different amounts depending on which category it is in. Prudent debt has an owner and a plan. Reckless debt has neither, and its cost keeps growing. Ask the team to place its own worst debt in one of the four categories and listen to the reasoning; the placement tells you about the debt and the reasoning tells you about the team, which is why the assessing the engineering team page and this one are read together.
Another sorting question is where the debt is. Debt in a minor feature is cheap to ignore. Debt in the core system that everything depends on is expensive, because it adds cost to every future change. Ask where the debt is, as well as how much there is.
What are the signs that debt has started to slow the team down?
The clearest sign is a team that releases more slowly over time. When features that used to take days start taking weeks, and when small changes keep breaking unrelated things, the debt has reached the point where every change to the code is hard. This connects to assessing code quality, because debt is the main thing that makes code hard and slow to change, and the DORA delivery metrics on that page are the way to see it in numbers.
Ask for the trend rather than the current state. DORA's change lead time (the time from a commit to production) rising over twelve months, deployment frequency falling, and change fail rate (the share of deployments needing immediate intervention) rising is the typical pattern of debt slowing the team down. A company can still be growing from past work while this happens, which is why it is easy to miss. Ask the team directly: is it getting harder to release changes, and which part of the code is hardest to change. An honest team will tell you exactly where.
How do you size debt on a deal timeline?
You cannot count technical debt precisely, but you can size it well enough to price in a few structured conversations.
- Ask for the three-month question. What would the team fix if it had three months to do nothing but fix debt? The answer tells you where the worst debt is and whether the team understands its own system.
- Ask for the split of time. How much of the team's effort goes to working around problems in the codebase rather than building new things? Compare the answer with the pull request history: a high share of "fix" and "hotfix" changes against "feature" changes is the same answer in data.
- Ask for the debt register. Does one exist, who owns it, and when was it last updated? A register that exists and is out of date is a finding; one that is used in planning is a strength.
- Ask how debt repair is scheduled. A healthy organisation fixes debt deliberately, in small steps, alongside new work. A risky one lets it grow until it becomes a crisis. Ask whether debt repair is part of how the team plans its work or something it never gets to.
- Check the core. Take the single most important service and ask how long a small change there takes, who can make it, and what has broken there in the last year. Debt in the core is the debt the thesis pays for.
The founder-side view of the same questions is in how to prepare for technical due diligence, and the technical due diligence questionnaire includes them as a request list.
What is agent debt, and why does it appear in AI-written codebases?
Agent debt is technical debt that accumulates when code is generated faster than anyone reads it. It is the modern form of Fowler's reckless and inadvertent category: nobody chose the shortcut, and nobody knows it is there. Google's October 2024 DORA report associated a 25 percent increase in AI adoption with a 1.5 percent decrease in delivery throughput and a 7.2 percent decrease in delivery stability, which is what debt slowing teams down looks like in survey data.
In a generated codebase the specifications are often the only surviving record of intent, so ask whether they exist and are kept up to date. Ask what checks ran on generated code before it merged, and whether an evaluation suite covers the behaviour the specification promised. The agent debt when generation outpaces review page in the evals guide explains how it happens, and the diligence on an AI-written codebase page covers the review.
How do you price it against the thesis?
Once you understand the debt, price it as work. Some of it you will fund on purpose, because fixing it gives the team the speed the thesis needs. Some of it you will accept, because it does not affect the parts of the system the growth depends on.
| Finding | What it costs | Where it goes |
|---|---|---|
| Known, contained debt with an owner and a plan | The plan, as written | First-hundred-days plan |
| Debt in the core service, team can name it | Months of focused work by the senior people | Price, and the first-year plan |
| Releases slowing each quarter, team cannot say why | Discovery first, then a repair the review cannot size yet | Price as unmeasured risk; a warning sign |
| Honest answer is a partial rewrite | A rewrite of the affected parts, with the product still running | Price and timeline, and a team question |
| Team cannot see its own debt | Cannot be planned by this team | Terms, and a team finding |
| Generated code with no specification and no evaluation suite | Specification recovery, then an evaluation suite | Price as unmeasured risk |
The judgment is whether the debt is a manageable cost or a structural problem. Manageable debt is a known amount of cleanup by a team that understands it. A structural problem is debt so large that the honest answer is a partial rewrite, or debt the team does not see. A strong senior team turns debt into a manageable cost; a weak team lets it become the thing that stops the company. For a fund with several companies carrying debt at once, the technical debt across a portfolio page covers how to prioritise, and how to take over a codebase you did not write covers what the repair work looks like for the team doing it.
Best for
- Treating debt as priced work when the team can name it, explain it, and still releases steadily
- Funding deliberate repair when fixing specific debt allows the growth the thesis needs
- Accepting some debt as-is when it is outside the parts the growth depends on and costs little to maintain
Avoid if
- The team releases more slowly every quarter and cannot say why, which is a warning sign rather than a priced repair
- The worst debt is in the core system and the team has no plan for it
Check before you decide
- Confirm the DORA lead time and change fail rate trend over twelve months rather than the current values
- Confirm a debt register exists, who owns it, and when it was last used in planning
- Confirm how long a small change to the most important service takes and who can make it
Common questions
What is technical debt in due diligence?
Technical debt is the quick solutions a company chose to move fast, plus the ongoing cost they add. Ward Cunningham created the comparison in 1992: a small amount of debt speeds development so long as it is paid back promptly with a rewrite, and every minute spent on imperfect code counts as interest. The job of diligence is to find the debt that will slow the growth in the thesis and price the work to fix it.
How do you tell acceptable technical debt from dangerous debt?
Acceptable debt is limited to one area, known, and cheap to maintain, and the team can point to it and keep releasing. Dangerous debt spreads, is often hidden, and makes the team release more slowly over time. Martin Fowler's technical debt quadrant (14 October 2009) sorts debt by prudent or reckless and deliberate or inadvertent; prudent-deliberate debt has an owner and a plan, while reckless-inadvertent debt has neither and keeps growing.
Is technical debt a reason to leave a deal?
Rarely on its own. Most debt is manageable cleanup you price and plan for. It becomes structural only when the honest fix is a partial rewrite or when the team cannot see its own debt and therefore cannot plan to fix it. Stripe's 2018 survey, by its own account, found the average developer spending 13.5 hours a week on technical debt, so a team reporting figures in that range is describing a normal codebase.
Is having technical debt a warning sign by itself?
No. Every real codebase has some technical debt, and a review that criticises a company for having it measures the wrong thing. Taking a shortcut to validate a product, with a plan to fix it once the product shows it works, is what Fowler's 2009 quadrant calls prudent and deliberate debt. The question is whether the debt threatens the growth in the thesis, where it is, and whether the team can name it.
What is the clearest sign that technical debt has become dangerous?
A team that releases more slowly over time. When features that used to take days start taking weeks and small changes keep breaking unrelated things, every change to the code has become hard. DORA's delivery metrics show it in numbers: change lead time rising, deployment frequency falling, and change fail rate rising over twelve months. Ask the team directly whether it is getting harder to release changes and which part of the code is hardest to change.
How do you measure technical debt on a deal timeline?
You estimate its size rather than count it. Ask what the team would fix with three months of only debt repair, how much of its time goes to working around problems in the codebase, whether a debt register exists and who owns it, how paydown is scheduled, and how long a small change to the core service takes. Stripe's 2018 survey baseline of 17.3 hours a week on maintenance, by its own account, gives you something to compare the answers against.
Where does technical debt matter most, in a minor feature or the core system?
In the core. Debt concentrated in the system everything else depends on adds cost to every future change, while debt in a minor feature is cheap to ignore. Ask where the debt is, as well as how much exists. Ward Cunningham's original 1992 explanation applies: the interest is paid on every minute spent working around imperfect code, and the core is where the most minutes are spent.
Does a company need a formal plan to pay down technical debt?
A healthy engineering organisation fixes debt deliberately, in small steps, alongside new work, rather than letting it grow into a crisis. Ask whether debt repair is part of how the team plans or something it never gets to, because the answer predicts whether the debt grows or shrinks after you invest. Fowler's 2009 quadrant is a practical planning tool: prudent-deliberate debt is the kind a team can schedule.
What is agent debt in an AI-written codebase?
Agent debt is technical debt that builds up when code is generated faster than anyone reads it, so nobody chose the shortcut and nobody knows it is there. Google's October 2024 DORA report associated a 25 percent increase in AI adoption with a 7.2 percent decrease in delivery stability. The review asks whether specifications still exist and are kept up to date and whether an evaluation suite checks generated code before it merges.
How do you price technical debt in a deal?
Price it as work. Known, contained debt with a plan goes into the first-hundred-days plan at the plan's cost. Debt in the core service goes into the price and the first-year plan as months of senior effort. Debt the team cannot see, or that needs a partial rewrite, is priced as unmeasured risk and raises a team question. Cunningham's 1992 comparison gives the reason: debt that is not fixed adds cost to every future change.
References
Related reading
Speed of execution is the moat now
Being first used to be an advantage you could protect. When any capable team can build the same thing in a week, the advantage goes to the team that releases, learns, and releases again fastest.
How to take over a codebase you did not write
Someone hands you a working system and leaves. The instinct is to read it. The better first step is to find out what it guarantees, because the code will tell you what it does and never what it was supposed to do.
More in What to assess
How to assess code quality
Code quality in technical due diligence means one thing: whether the software is safe and cheap to change. If small changes are slow and risky, the roadmap in the deal deck will not be delivered on time. The most reliable evidence comes from how the team releases software today, measured with the five DORA delivery metrics, a live run of the test suite, and the pull request history, rather than from how the code looks in a screenshot. This page explains what to measure, what to ask, and how to judge quality when you cannot read the code yourself.
Assessing architecture and scalability
Architecture is the way a software system is built and organised, and scalability is whether that design keeps working under the growth the deal is paying for. Assessing both in technical due diligence means asking the team to explain the system as it is today, finding the specific parts that will break first as users, data, or traffic multiply, reading the incident history for whether root causes get fixed, and checking whether running costs rise faster than revenue. Most scaling problems are repairs with a price. The warning sign is a team that cannot answer the questions.
Assessing the engineering team
Assessing the engineering team in technical due diligence means judging whether the people can produce every future version of the software the deal is paying for. Code shows the system at one moment; the team is what turns it into the next release. The review measures seniority, the bus factor (how many people would have to leave before the project stops), tenure and turnover, how the team explains its own decisions, and how it works with AI tools. A strong senior team can fix weak code. Excellent code with too few engineers stops improving as soon as the work gets hard or a key person leaves.
Assessing security and compliance
Assessing security and compliance in technical due diligence means working out what liabilities come with the company and what it costs to reduce them. A breach or a regulatory gap can remove the value of a deal, and some of these problems take months to fix. The review does not need a penetration test to find the largest risks. It checks basic security practices (who can access production, where secrets are stored, whether systems are patched), compares the target's controls with the OWASP Top 10 and the NIST Cybersecurity Framework, reads the incident history, and confirms which certifications are current rather than planned.