"Architecture review" sounds like something only large organisations with IT departments need. In practice, it is a simple idea: an experienced, independent person looks at how your technology fits together, tells you plainly what is working, what is risky and what is costing more than it should, and gives you a prioritised list of what to do about it.
This article explains what a review covers, how the process works, what you actually receive at the end, and how to tell whether you need one. It describes how we run reviews at Quorum Digital, but the principles apply whoever you use.
Why small businesses ask for one
Most small businesses did not design their technology; it grew. A website from one agency, a booking tool someone signed up for, a shared drive, a few spreadsheets doing important jobs, and a supplier or two who look after parts of it. That is normal. The trouble is that nobody has the whole picture, so problems tend to be found by accident, usually at the worst moment.
Common triggers are:
- A supplier has proposed a large rebuild or a new platform, and you want a second opinion before signing.
- Monthly software and cloud bills have crept up and nobody can say exactly why.
- A key person or supplier is leaving and you are not sure what they knew that nobody else does.
- You are about to grow, launch something new or bid for work that asks about your security and data handling.
- Something went wrong, such as an outage, data loss or a security scare, and you want to know what else might.
What gets looked at
A review is shaped around your questions, but it normally covers:
- Business fit. What the business needs its technology to do, now and over the next few years, and whether the current setup supports that.
- The systems themselves. What you have, how the pieces connect, and where information is typed in twice or copied by hand.
- Hosting and running costs. Where things run, what you pay for, and whether you are paying for things you do not use.
- Security basics. Who has access to what, how accounts are protected, whether former staff and suppliers still have access, and how software is kept up to date.
- Data and UK GDPR. Where personal data lives, who can see it, which suppliers process it, and whether that is written down.
- Resilience. What happens if a system, a supplier or a person is unavailable, and whether backups exist and have ever been tested.
- Suppliers and lock-in. What you depend on each supplier for, what your contracts say about support and exit, and how hard it would be to move.
How the process works
- Introductory call. A short conversation about what prompted the review and what you most want answered.
- Scope. A written note of the questions the review will answer, the systems in and out of scope, and the cost: £995 fixed, credited against any follow-on work.
- Discovery. Reading whatever documentation exists (often not much, which is fine), looking at systems with read-only access where that is appropriate, and talking to the people who use and support them, including your suppliers if you are happy for us to.
- Assessment. Working out how things really fit together, comparing that with what the business needs, and identifying risks, waste and opportunities. Gaps lead to follow-up questions rather than guesses.
- Report. A written report, described below.
- Walk-through. A session to go through the findings, answer questions and agree priorities.
- Your choice. You can act on the recommendations yourself, hand them to your existing supplier, or ask for help. There is no obligation either way.
What you get
The report is written for the people who run the business, not just for technical staff:
- A one-page summary in plain English: the headline findings and the few things that matter most.
- A diagram of your current setup, showing your systems, suppliers and how information flows between them. Many businesses find this alone worth having.
- Prioritised findings, each with why it matters, how urgent it is and roughly how much effort it would take to fix.
- Recommendations and a simple roadmap: quick wins, things to plan for, and things to leave alone.
- Questions to put to your suppliers, so you can hold them to account without needing to be technical yourself.
Where something is unknown, the report says so rather than filling the gap with assumptions.
What a review is not
It is worth being clear about the limits. An architecture review is not a penetration test, a formal security certification, a legal opinion on compliance or an accountancy audit. It will often tell you whether you need one of those, and help you brief the right specialist. Nor is it a sales exercise for a particular product: the recommendation is frequently to keep what you have and use it better.
What you need to provide
Not much: a contact who knows the business, whatever documentation and supplier contracts you have, access to the people involved, and read-only access to systems where that helps. You do not need to tidy anything up first. Seeing things as they really are is the point.
Checklist: would a review help?
If two or three of these ring true, a review is likely to pay for itself in avoided mistakes and clearer decisions.
Talk it through
If you are weighing up a supplier proposal, worried about a fragile setup or simply want an honest view of where you stand, Quorum Digital offers independent architecture reviews for small businesses: plain English, clearly scoped and with no pressure to buy anything else. get in touch for a short, informal chat about whether a review would help.