These three get used interchangeably and they are not the same. Picking the wrong one wastes money or leaves you with the wrong answer. The quick version: a review improves the business, due diligence supports a transaction, and an audit checks compliance against a standard.
Here is how to tell which you need.
Technology review
An independent, senior assessment of whether your technology can carry the plan, run to improve the business. It is broad, covering architecture, security, delivery, team and technical debt, and it comes back with a ranked, costed list of what to fix. You commission one when something feels off, when a new leader wants a baseline, or before you scale. The audience is your own board.
Technical due diligence
The same rigour, but framed around a specific event, usually a transaction. Buy-side diligence tells an investor or acquirer what they are taking on. Sell-side diligence gets your technology story straight before buyers look. The difference from a review is the deadline and the audience: it answers the questions the deal raises, for the people on the other side of it.
Technology audit
A check against a defined standard or control set, Cyber Essentials, ISO 27001, a specific security or compliance framework. It answers “do we meet this bar”, pass or fail, rather than “is our technology healthy and will it scale”. You commission one when a customer, regulator or certification requires it.
Which do you need
Want an honest health check because something feels off, or you are about to invest in growth? A review.
Buying, selling or raising, and technology is part of the decision? Due diligence, on the relevant side.
Need to prove you meet a named standard for a customer or regulator? An audit, against that standard.
They overlap in method, so a good partner can flex between them, but naming the real question up front gets you the right answer for the right money. A review dressed up as an audit will not get you certified; an audit will not tell you whether you can scale.
Where ScaleAround fits
We run independent technology reviews and technical due diligence, and we prepare businesses for security and compliance audits such as Cyber Essentials as part of wider technology work.
Our founder, Oliver Smith, has more than 20 years leading technology and quality, from CTO and VP Engineering roles to hands-on assessment work. He is a Fellow of the British Computer Society. Our engagements are led by senior practitioners with at least 15 years of relevant experience.
Frequently asked questions
What is the difference between a technology review and due diligence? The rigour is the same. A review is run to improve the business, for your own board. Due diligence sits around a transaction and answers the questions a deal raises.
What is a technology audit? A check against a defined standard or control set, such as Cyber Essentials or ISO 27001, answering whether you meet that bar.
Which do I need before a fundraise? Technical due diligence, so the technology story is straight before investors scrutinise it.
Which do I need if a customer demands proof of security? An audit against the specific standard they require.
Can one engagement cover more than one? Often, because the method overlaps, but naming the primary question up front keeps it focused and cost-effective.
Not sure which you need? Tell us the decision you are trying to make and we will point you to the right one. Start with our technology review, or book a 30-minute scoping call.