What an application architecture review should actually tell you
Most modernisation projects start with a decision that was never examined. A good review is not a list of technologies — it is a costed roadmap you can take to a board.
AppNet Solutions · 21 April 2026 · 5 min read
By the time a business asks for an architecture review, someone has usually already decided what the answer is. Move it to the cloud. Break it into services. Replace it. The review is expected to supply the justification.
That is not a review. A review is the work you do before the decision, and its job is to make the decision cheaper to get right.
Four questions, in this order
Is it secure? Not “does it have a firewall” — where does authentication actually happen, what can an authenticated user reach that they should not, and what is in the logs that should not be.
Does it scale where it needs to? Almost no system needs to scale uniformly. Find the two or three paths that carry real load and measure those. Everything else is a distraction.
What does it cost to run, and why? Infrastructure spend is usually concentrated in a small number of decisions made years ago by people who have left. Naming them is often the fastest saving available.
How fast can it change? This is the one that predicts everything else. If a one-line change takes three weeks to reach production, no amount of re-platforming will help until that is fixed.
The output is a roadmap, not a report
A review that ends in a document describing the current state has done half the job. What the business needs is an ordered list: what to do first, what it costs, what it unblocks, and what happens if you do nothing. Each item should be small enough to fund on its own.
We write these so they survive contact with a board. That means no technology names in the headline items — a board does not approve “adopt Kubernetes”, it approves “reduce time-to-production from three weeks to two days”.
When we recommend doing nothing
Sometimes the answer is that the system is unremarkable, adequately secure, and cheaper to keep than to replace. That recommendation is worth paying for too, and it is the one an incumbent vendor will almost never give you. Reviewing as an independent party — rather than as the team who would be paid to do the rebuild — is the only way that answer stays available.
