What to assess

Assessing the engineering team

Assessing the engineering team in technical due diligence means judging whether the people can produce every future version of the software the deal is paying for. Code shows the system at one moment; the team is what turns it into the next release. The review measures seniority, the bus factor (how many people would have to leave before the project stops), tenure and turnover, how the team explains its own decisions, and how it works with AI tools. A strong senior team can fix weak code. Excellent code with too few engineers stops improving as soon as the work gets hard or a key person leaves.

Published July 27, 2026. Updated September 17, 2026. Editorial.

Key takeaways

  • The team is the asset that produces every future version of the software, so the team assessment is the most important part of the review.
  • Bus factor, the number of people who would have to leave before the project stops, is low in most software: 65 percent of 133 systems studied had a bus factor of two or fewer.
  • Brooks's law explains why hiring cannot bring a late roadmap back on schedule: adding people to a late software project makes it later.
  • Seniority, tenure and how people explain their own decisions can be judged in a few conversations without running a full hiring process.

The most common mistake in technical due diligence is treating it as a review of code and forgetting that the code is made by people. The code you see shows the system at one moment. The team produces the next version, and the one after that. If you are investing in a roadmap, you are investing in the team that will build it, so assessing the people is the most important part of the review.

Why is the team the real asset?

The team is the real asset because it is the only part of the company that can produce the next version of the software. A strong senior team with mediocre code is a manageable situation, because good engineers fix code. They see what is wrong, they know how to improve it, and they do. A small or junior team with excellent code is a hidden risk, because as soon as the work gets hard, or a key person leaves, progress stops.

This is why seniority matters more than headcount. A small senior team builds more than a larger junior one, because experience is what lets people move fast and avoid the mistakes that cause rework, an argument we make in full in a small senior team outbuilds a big one. So when you count the team, count the seniority too, and check that the senior people are working on the core of the product rather than working only in management, away from the code. The main guide explains why this finding matters more than any single code finding.

Reveneau's team assessment asks one question of every senior engineer it meets: explain the last decision you got wrong and what you changed afterwards, because how a team handles being wrong predicts how it will behave after close far better than how it presents itself when things are going well.

What is key-person risk, and how do you measure it?

Key-person risk is the situation where one engineer is the only person who understands the core system, so the company's most valuable knowledge can leave with two weeks' notice. The measure is the bus factor: the minimum number of team members who would have to suddenly disappear before the project stops for lack of knowledgeable people.

It is low in most software. A study by Avelino, Valente and Hora of 133 open source systems, cited on the Wikipedia entry for the term, found that 65 percent had a bus factor of two or fewer, and fewer than 10 percent had a bus factor above ten. Commercial codebases built fast around one founder-engineer are often worse, because nobody outside the founder ever needed to know how the core worked.

Question What a healthy answer sounds like What a risky answer sounds like
If this one person left tomorrow, what would happen? "We would slow down on X for a month; Y and Z have both released changes there." "We would be in trouble."
Who else has changed the most critical part of the system in the last quarter? Two or more names, with pull requests to show it One name, or "nobody needs to"
Where is the knowledge written down? A design document, runbooks, a specification that is kept current "It is all in the code" or "ask her"
Who is on call for the core service? A rotation of three or more One person, always
Who can deploy to production? A documented process anyone on the team can run One person with the access

Ask the questions directly, then check the answers against the repository: the commit history for the core service will show whether two people have changed it. This finding is serious enough that it is first on the warning signs page, because it can move a deal from "price the fix" to "reconsider the terms". At the earliest stage, where one developer is the norm, the single developer risk page in the angel guide covers what to ask instead.

Why can hiring not fix a late roadmap?

Hiring cannot fix it because of Brooks's law. Fred Brooks stated it in his 1975 book The Mythical Man-Month: adding manpower to a late software project makes it later. The reasons he gave still apply. New people take time to become productive and need the existing team to teach them, which reduces the existing team's output. The number of communication paths grows faster than the number of people. And some work cannot be divided, which Brooks illustrated with the observation that nine women cannot make a baby in one month.

This matters in diligence because the fix for a small team is often written in the deal model as "hire ten engineers in the first year". Brooks's law says that plan slows the roadmap before it speeds it up, and the why adding engineers can slow you down page in the scaling guide covers the reasons in detail. The realistic plan adds senior people slowly, in areas where the work can be divided, and expects productivity to fall for a time while it happens. Price that fall.

How do you assess seniority without running interviews?

You form a judgment from a few conversations and the artifacts, without a full hiring process. Four approaches work.

  1. Ask for a hard decision, explained in plain language. Strong engineers explain the options, the choice, and the trade-off clearly. A team that answers with jargon or cannot explain its own decisions is a warning. Clear explanation comes from clear thinking, which is what you are testing.
  2. Ask how they handle being wrong. What did they do the last time a plan turned out wrong mid-project? A mature team treats that as normal, catches it early, and adjusts. A team that hides problems, or argues against every change, will do the same after you invest.
  3. Read the pull request history for who reviews whom. Senior engineers appear as the people whose reviews change other people's code. If nobody's review changes anything, nobody is acting as the senior engineer, whatever the titles say.
  4. Ask an outside reference how the work performed over time. Someone who inherited or maintained the code will tell you whether it stayed cheap to change, which is the outcome that seniority produces. This is the same standard we apply when we measure engineers by outcomes rather than output.

For a target whose technical founder is the team, the evaluating a technical founder page covers the version of this that fits a one-hour conversation, and what to look for in a CTO hire covers the profile itself.

What does the org structure tell you about the system?

It tells you how the software will be structured. Conway's law, stated by Melvin Conway in 1968, observes that organisations that design systems are constrained to produce designs that are copies of their own communication structures. Three teams that do not communicate will produce three components that do not communicate. A single team that owns everything will produce a single system with no clear divisions.

In diligence this works in two directions. If the architecture assessment found a disorganised system, look at whether the teams are disorganised too, because the fix may be organisational rather than technical. If the deal plan splits one team into several, expect the system to split along the same lines, and check that the boundaries in the plan match boundaries that exist in the code. The structuring engineering teams page covers the organisation side.

What do tenure and turnover tell you?

They tell you whether the culture works. High turnover in engineering is a signal worth understanding, because people are leaving for reasons that will repeat after close. A team that has stayed and grown together usually means the culture works. Ask how long the key people have been there, why past engineers left, and whether any of them left in the last six months. Ask whether anyone is on notice or negotiating.

Engineering culture sounds hard to measure, but it has measurable effects. A culture that releases often, tells the truth about problems, and writes things down produces good software over time. A culture that skips necessary steps, hides bad news, and depends on a few people working extra hours to save each release produces the opposite, no matter how talented the individuals. You can judge culture from how the team answers your questions: openly and specifically, or defensively and vaguely.

How does the team work with AI, and what should you check?

Check whether the team has a method for catching what the model got wrong, because almost every team uses the tools and the risk is in the checking. Stack Overflow's 2025 survey of more than 49,000 developers found 84 percent using or planning to use AI tools, 46 percent distrusting the accuracy of the output against 33 percent trusting it, and 66 percent naming "almost right" solutions as their biggest frustration. Google's October 2024 DORA report associated a 25 percent increase in AI adoption with a 7.2 percent decrease in delivery stability.

Ask who reads the generated code before it merges, what tests or evaluations run against it, and whether the specifications the code was generated from still exist. A team that can show an evaluation suite running is a team that has solved the problem; the eval-driven development hub explains what to look for, and the assessing code quality page covers the repository-level checks. A team that says the model writes it and the team releases it, with nothing in between, has an unmeasured risk rather than a fast process.

How do you put the team finding in the deal?

Use it in two places: the confidence you have in the roadmap, and the plan for the first hundred days.

Finding What it means for the roadmap What goes in the plan or the terms
Senior team on the core, bus factor of three or more The ambitious plan is believable Retention for the people the plan depends on
Bus factor of one on the core system One resignation could stop the roadmap Knowledge transfer as a condition, retention terms, a second engineer on the core in ninety days
Junior team with good process The plan works if the senior hires join Senior hires or a partner team priced into year one
Plan depends on doubling headcount in a year Brooks's law says the roadmap slows first Slower hiring plan, a priced fall in productivity
Turnover in the last six months among seniors Ask why before believing the roadmap Exit interviews or references before close
AI-written code with no verification method Speed claims are unmeasured An evaluation suite in the pipeline, priced

If the plan is to grow the team after close, the scaling engineering teams guide covers how to do it without breaking what works, and the technology after the deal guide covers how the team plan becomes the hundred-day plan. The technical due diligence checklist lists the team questions in a form you can take into the meeting.

Best for

  • Venture deals where the thesis depends on a small team continuing to release software
  • Any target built around one founder-engineer or one long-tenured lead
  • Deals whose model assumes rapid hiring after close

Avoid if

  • The target is a single developer at pre-seed, where the angel guide's version applies
  • You are assessing a vendor's team rather than a target's, which is a different question

Check before you decide

  • Confirm at least two people have released changes to the core service in the last quarter, from the commit history
  • Confirm tenure and any departures among senior engineers in the last six months
  • Confirm what checks generated code before it merges, and see it run

Common questions

Why is the engineering team more important than the code in due diligence?

Because code shows the system at one moment and the team produces every future version. A strong senior team can fix weak code, but excellent code with a small or junior team stops improving as soon as the work gets hard or a key person leaves. The bus factor study by Avelino, Valente and Hora, cited on Wikipedia and read on 17 September 2026, found 65 percent of 133 systems had a bus factor of two or fewer.

What is key-person risk in technical due diligence?

Key-person risk is when one engineer is the only person who understands the core system, so the company's most valuable knowledge can leave with two weeks' notice. It is measured as the bus factor, the minimum number of people who would have to disappear before the project stops. Ask what would happen if that person left, who else has changed the core in the last quarter, and where the knowledge is written down.

How do you assess an engineering team without interviewing them?

Ask them to explain a hard technical decision in plain language, ask how they handled a plan that turned out wrong, read the pull request history for whose reviews change other people's code, and ask an outside reference how the work performed over time. Stack Overflow's 2025 survey found 66 percent of developers frustrated by AI output that is almost right, so also ask who reads generated code before it merges.

Why does a small senior team matter more than a large junior one?

A small senior team builds more than a larger junior one because experience lets people move fast and avoid the mistakes that cause rework. Brooks's law, from The Mythical Man-Month (1975), adds the second half: adding people to a late software project makes it later, because new people need time to learn the system and communication paths grow faster than headcount. Look at seniority more than at headcount.

What is Brooks's law and why does it matter in a deal?

Brooks's law, stated by Fred Brooks in his 1975 book The Mythical Man-Month, is that adding manpower to a late software project makes it later. It matters in a deal because the fix for a small team is often written in the model as rapid hiring, and the law says that plan slows the roadmap before it speeds it up. Price the fall in productivity and plan slower, senior hiring instead.

What questions uncover key-person risk?

Ask what would happen if one specific person left tomorrow, who else has changed the most critical part of the system in the last quarter, where the knowledge is written down, who is on call for the core service, and who can deploy to production. Then check the answers against the commit history. The Wikipedia bus factor entry, read on 17 September 2026, records that fewer than 10 percent of 133 studied systems had a bus factor above ten.

How does team turnover affect a technical due diligence review?

High turnover in engineering is a signal worth understanding, because people leave for reasons that repeat after close. A team that has stayed and grown together usually means the culture works. Ask how long the key people have been there, why past engineers left, whether anyone senior left in the last six months, and whether anyone is on notice. Conway's law (1968) is a reminder that the org chart also affects the software you are buying.

Is engineering culture something you can assess in due diligence?

Yes. A culture that releases often, tells the truth about problems, and writes things down produces good software over time, while a culture that skips necessary steps and hides bad news does the opposite whatever the individual talent. Culture shows in how the team answers questions: openly and specifically, or defensively and vaguely. Google's 2024 DORA report found unstable organisational priorities cut productivity and raise burnout even in well-led teams.

What does Conway's law mean for assessing a target's team?

Conway's law, stated by Melvin Conway in 1968, is that organisations that design systems produce designs that copy their own communication structures. For a reviewer it means a disorganised architecture may have an organisational cause, and a deal plan that splits one team into several will split the system along the same lines. Check that the boundaries in the plan match boundaries that already exist in the code.

How should you assess a team that writes most of its code with AI?

Ask what catches what the model got wrong. Stack Overflow's 2025 survey of more than 49,000 developers found 84 percent using or planning to use AI tools and 46 percent distrusting the accuracy of the output. Google's October 2024 DORA report associated a 25 percent rise in AI adoption with a 7.2 percent fall in delivery stability. A team that can show an evaluation suite running has solved the problem; a team with nothing between the model and production has not.

What should you do if the team assessment finds gaps?

Put the finding into the first-hundred-days plan and, where it is structural, into the terms. A bus factor of one on the core system calls for knowledge transfer as a condition, retention terms, and a second engineer on the core within ninety days. A junior team with good process calls for senior hires or a partner team priced into year one. Brooks's law (1975) says to add those people slowly and expect lower output while they learn the system.

More in What to assess

How to assess code quality

Code quality in technical due diligence means one thing: whether the software is safe and cheap to change. If small changes are slow and risky, the roadmap in the deal deck will not be delivered on time. The most reliable evidence comes from how the team releases software today, measured with the five DORA delivery metrics, a live run of the test suite, and the pull request history, rather than from how the code looks in a screenshot. This page explains what to measure, what to ask, and how to judge quality when you cannot read the code yourself.

Assessing architecture and scalability

Architecture is the way a software system is built and organised, and scalability is whether that design keeps working under the growth the deal is paying for. Assessing both in technical due diligence means asking the team to explain the system as it is today, finding the specific parts that will break first as users, data, or traffic multiply, reading the incident history for whether root causes get fixed, and checking whether running costs rise faster than revenue. Most scaling problems are repairs with a price. The warning sign is a team that cannot answer the questions.

Assessing security and compliance

Assessing security and compliance in technical due diligence means working out what liabilities come with the company and what it costs to reduce them. A breach or a regulatory gap can remove the value of a deal, and some of these problems take months to fix. The review does not need a penetration test to find the largest risks. It checks basic security practices (who can access production, where secrets are stored, whether systems are patched), compares the target's controls with the OWASP Top 10 and the NIST Cybersecurity Framework, reads the incident history, and confirms which certifications are current rather than planned.

Assessing technical debt

Technical debt is the extra work created by quick solutions a company chose to move fast, plus the ongoing cost they add later as slower, riskier changes. Assessing it in technical due diligence means telling acceptable debt from debt that will stop the roadmap, measuring it well enough to price, and checking whether the team has a plan to fix it. Every real codebase has debt, so the finding is never that debt exists. The finding is where it is, whether the team can name it, and whether releases are getting slower because of it.