Technical Due Diligence: Confirming code status

CatalystOne is a leading provider of HCM (Human Capital Management) software, such as solutions for management of HR master data, performance, onboarding and learning. The company was founded in Norway in 2003. Today, it has grown to include offices in Sweden, Denmark and India as well.

Chief Technology Officer at CatalystOne, Thomas Schjerpen, says:

“The system we deliver to our customers is large and complex, with millions of lines of code. And since we are handling employee data, the demands on security and GDPR compliance are high. Our solution is cloud-based, but has been developed over a longer period of time. We have a good idea about how we want to renew and improve our current code base. At the same time, we felt it would be prudent to get a review through the eyes of an external expert. That way, we could make sure we’re on the right track and confirm we’re making the right priorities.”

This is where System Verification’s Technical Due Diligence* came in handy. By combining human expertise with AI-driven software, this service offers an easy and efficient way to analyze a code base.

“We follow an established, smooth and semi-automated process,” says David Svensson, Sales Manager at System Verification. “It starts with a meeting where our consultants meet the customer’s IT team. They discuss the code base and the customer can let us know which areas they want us to focus more on. We can access the customer’s system remotely without compromising security – we use a number of different state-of-the-art tools and choose what’s best for every specific case.”

The System Verification consultants then analyze the code base and benchmark with other cases. The Technical Due Diligence can be done as part of an internal review, or when a company is about to look for new investors and want a quality stamp on its code base.

Thomas Schjerpen feels the setup was perfect for CatalystOne’s needs.

“A traditional and full technical due diligence is complicated. It requires a lot of time, meetings and communication going back and forth. System Verification’s process, on the other hand, demanded very little of us. And this kind of ‘lighter version’ of a technical due diligence was exactly what we wanted.”

The outcome from a Technical Due Diligence is always an easy-to-read report, where the findings and recommendations from the analysis are summarized. System Verification also hosts a walkthrough of the report to provide a deeper explanation and straighten out any question marks.

“An important point is that the report is not just technical. It’s not only for developers and IT specialists. We give suggestions on what measures the customer should prioritize. Basically, it functions as a tangible to-do list – and we include cost estimates on as much as possible, which is valuable information for both the company itself and its potential investors,” says David Svensson.

Thomas Schjerpen, Chief Technology Officer at CatalystOne

Thomas Schjerpen adds:

“The report includes an executive summary. That overview makes it easy for us to communicate the report’s findings internally. And it’s valuable to us that an external, unbiased party verifies things we already know or suspect. For example, the report clearly shows how and why it’s worthwhile to invest in reducing technical debt. And while it’s both understandable and useful to non-tech people, it is also technical enough to be relevant for systems architects and development managers in the work they do.”

So what’s next? Thomas Schjerpen and David Svensson agree that a Technical Due Diligence is a good springboard for an even closer cooperation between the two companies.

“It naturally depends on how fast we can work with the issues we’ve identified, but the way I see it, the lifespan of the report is roughly a year. And then, I definitely see a need for a new catch-up,” concludes Thomas Schjerpen.

* The Technical Due Diligence service was previously called ‘Software Due Diligence’.