# Pre-Build Architecture Review Checklist

Use this checklist before committing budget to a new platform, automation, or
commerce build. It is the same review GrowBig IT runs before we quote a fixed
scope.

## 1. Business and scope

- [ ] The primary business outcome is written as one measurable sentence.
- [ ] The first release has a named owner and a decision-making sponsor.
- [ ] Must-have, should-have, and out-of-scope items are separated.
- [ ] Success metrics have baselines, not just targets.
- [ ] The cost of doing nothing is documented.

## 2. Users and journeys

- [ ] Primary personas are listed with the job they are trying to complete.
- [ ] The top three journeys are mapped end to end, including failure states.
- [ ] Permissions and roles are defined per journey.
- [ ] Empty, loading, error, and offline states are designed.
- [ ] Accessibility requirements (WCAG target) are agreed.

## 3. Data and integrations

- [ ] Every system of record is identified.
- [ ] Data ownership, retention, and deletion rules are documented.
- [ ] Integration contracts list direction, frequency, and failure handling.
- [ ] Sensitive fields are classified and mapped to their storage location.
- [ ] A migration and rollback plan exists for imported data.

## 4. Architecture

- [ ] The simplest viable architecture is documented first.
- [ ] Synchronous versus asynchronous boundaries are explicit.
- [ ] Idempotency and retry behaviour are defined for write paths.
- [ ] Caching strategy includes invalidation, not just TTLs.
- [ ] Observability includes logs, metrics, traces, and alert ownership.
- [ ] A single region or environment is not a hidden single point of failure.

## 5. Security and compliance

- [ ] Authentication and authorization model is reviewed.
- [ ] Secrets live in a managed store, never in source control.
- [ ] Backups are encrypted and a restore has been tested.
- [ ] Dependency and container scanning is part of CI.
- [ ] Vendor subprocessors and data transfer mechanisms are listed.
- [ ] Incident response has a named owner and a severity ladder.

## 6. Delivery

- [ ] Scope is sliced into increments that can ship independently.
- [ ] Environments (dev, staging, production) are defined.
- [ ] CI checks cover lint, types, tests, and a production build.
- [ ] Rollback is a one-step, documented procedure.
- [ ] Handover includes architecture decision records and runbooks.

## 7. Commercial

- [ ] Fixed-scope items have acceptance criteria.
- [ ] Ongoing support, hosting, and licence costs are separated from build cost.
- [ ] The client owns source code, infrastructure, and accounts.
- [ ] A warranty window and change-request process are agreed.

---

GrowBig IT · growbigit.com · hello@growbigit.com

This checklist is provided for general guidance. It is not a substitute for a
security or compliance audit of your specific environment.