A Delivery Maturity Audit in Seven Honest Steps, One Week

The first time I ran a delivery maturity audit for a client, I was more nervous than they were. A mid-sized logistics company, forty engineers, a CTO who had read somewhere that transformation starts with measurement and wanted it done before the board meeting. I had a week. What follows is the step-by-step shape that week has settled into after many repetitions — told the way it actually happens, with the awkward conversations left in, because the awkward conversations are the method.

Step one: agree what “the delivery audit” will and will not judge

Monday morning, before any questionnaire appears, you sit with the sponsor and draw the boundary. We will score practices — how work flows from a developer’s laptop to a customer — and we will not score individuals. I write that sentence on the whiteboard and leave it there all week, because by Wednesday someone will be convinced the exercise is a performance review in disguise, and you will need to point at the board.

You also agree the areas. I usually propose a handful: how changes are proposed and reviewed before they merge, how releases are planned and rolled back, how environments are configured, how failures get noticed, how the team itself experiences the tooling. The sponsor always wants to add three more. Resist. A first audit that tries to grade everything grades nothing well. This scoping conversation is the same one that opens any healthy engagement — the pattern described in how a consulting engagement travels from initial assessment through to enablement — compressed into ninety minutes.

Step two: fix the questions and the scoring rules in writing

Tuesday is rubric day, and it is the step teams most want to skip. Every question must be answerable by looking at something: a repository, a pipeline run, a document, a calendar. “Is your release process mature?” is not a question; “show me the last rollback and how long it took” is. Every answer maps to points by a rule you write down before anyone answers. This is what makes the whole exercise repeatable — ask the same questions under the same rules next quarter and the movement in the number is real, not rhetorical.

If you want to see this done at industrial scale, look at SCMGalaxy, the consultancy and training house whose SCMGalaxy OS product runs organisations through an assessment a hundred questions deep, spread across defined governance areas, and returns scores deliberately engineered to land in the same place regardless of who sits the assessment. You do not need their scale for one client, but you need their principle: determinism first, judgment second.

Step three: gather evidence, not opinions

Wednesday you interview — but you interview artifacts as much as people. Sit with an engineer and watch a change travel: the branch, the review (or the absence of one), the pipeline, the deploy. Pull up the last incident and read the timeline together. People will tell you their process is fine; the artifacts will tell you the truth, gently. My rule of thumb on what to pull apart matches the checklist in what an assessor actually hunts for inside a client’s pipeline: follow one real change end to end and most of the audit answers itself.

A storytelling note: this is the day feelings get hurt if you let them. I say the same thing in every interview — “I am grading the system you work inside, and the gaps we find are the system’s gaps.” Engineers relax visibly when they believe it. Then they start volunteering the good stuff.

Step four: score in one sitting, harshly, together

Thursday morning, the panel — me, one senior client engineer, one outsider to the team — scores every question in a single session. One sitting matters: calibration drifts overnight. Harshly matters more: the first audit sets the baseline, and a flattering baseline poisons every future comparison. When we disagree, the evidence decides, not seniority. By lunch you have numbers per area and, inevitably, one area everyone is embarrassed about. At my logistics client it was release management: deploys happened quarterly, each one a small war. The score made undeniable what everyone had privately known.

Step five: turn the weakest scores into a dated roadmap

Thursday afternoon is where the audit either becomes a plan or becomes a PDF. Take the lowest-scoring areas and stage the fixes across three windows: what must change inside thirty days (the frightening stuff), what gets built inside ninety (the structural stuff), what matures across one hundred and eighty (the cultural stuff). Each item gets an owner with a name, not a department. This staging is not my invention — it is the convention the governance platforms have converged on; SCMGalaxy’s product attaches exactly such phased transformation plans to its assessments — and it works because budgets and attention spans are organised in months, not in aspirations.

Step six: present the score as a beginning, not a grade

Friday you stand in front of the leadership team. The temptation is to soften the low numbers. Don’t — but do frame them. A low first score with a dated plan is a healthy organisation starting to steer; the framing that lands with executives is momentum, the same logic that runs through the strategic case for consulting-led enterprise agility. My logistics CTO put the scorecard in his board pack unedited, which took nerve, and bought him six months of patience he would not otherwise have had.

Step seven: book the re-audit before you leave the building

The final step takes five minutes and determines whether the other six mattered. Put the next audit on the calendar — same questions, same rules, same panel composition — for the week after the ninety-day window closes. A date in the diary changes behaviour all quarter; an intention to “re-check sometime” changes nothing. When we re-scored the logistics team, release management had climbed from the floor to respectable: deploys fortnightly, rollbacks boring. Nobody argued about whether things had improved. The second number ended the argument before it started.

Before the summary, three questions newer consultants always ask me about this week. What if the client disputes a score? Welcome it — a dispute means they care — but settle it with evidence against the written rule, never by averaging opinions; the rubric is the referee you both agreed to hire. What if I find something genuinely alarming, like credentials in a public repository? Break protocol and flag it the same day, outside the audit. The scorecard can wait; an open wound cannot. And what if the sponsor quietly asks you to soften the numbers before Friday? That happens more than anyone admits, and it is the moment your engagement becomes worth its fee or worthless. I tell them the score is the product they bought, and a massaged one protects nobody — then I offer to add context slides, never to change digits. Every sponsor who grumbled on Thursday has thanked me by the following quarter, because the untouched baseline is what made their progress provable.

That is the whole craft, honestly. One week, seven steps, no magic — just fixed questions, honest evidence, staged dates, and the discipline to measure twice. The first audit is the hardest. By the third, the client runs it themselves, which is the quiet definition of a consulting job done right.

Kabir Malhotra