Had an interesting call last week.
A client came to us after spending 13 months waiting for a CRM that never got finished. The original deadline was 5 months. At month 5 the vendor said the scope was bigger than expected and doubled the price. The client had already paid a chunk, so they agreed. Then the team got replaced. Eight months after that they were still hearing 'almost ready.'
We got access to the code and spent two days going through everything.
The database had no access controls on it — customer records were essentially exposed. The modules weren't properly connected. Realistically the thing was about 20% done.
The client terminated the contract based on our report and didn't make the final payment — saved around 30% of the total budget.
Honestly the saddest part isn't the technical mess. It's that this person trusted someone with their money and their time for over a year and got nothing back. They weren't naive — they had a contract, they asked for updates, they followed the process. It just didn't matter.
The thing about software development is that the client almost never has visibility into what's actually being built. You get demos, you get status updates, you get reassurance. But unless someone with no stake in the project looks at the actual code, you're largely taking the vendor's word for it.
That's what an independent audit is. It's not a complicated thing — it's just someone who isn't getting paid by your vendor telling you what's actually there.
In this case it took two days and saved the client from making another large payment on a product that would've needed to be rebuilt from scratch anyway. The security issues alone — an exposed database handling private client data — would've been a serious problem if the thing had ever gone live.
If you're in the middle of a development project and something feels off — deadlines slipping, answers getting vague, demos that never quite show the thing working end to end — it's worth getting a second opinion before the next invoice lands.
Not because every vendor is operating in bad faith. Most aren't. But because by the time something is clearly wrong, you've usually already paid for most of it.