Auditing an outsourced HR data platform before its first pilot

An HR data company was building its platform with an outside team and needed to know what was really done before showing it to a federal government department and a design partner. I reviewed the code against the specs and ranked the risks. Then I helped settle the specs that contradicted each other and prepared the platform for the design partner's employee data.

HR data platform · Apr 13, 2026 · 4 min read

Context

The company builds a platform that checks how much HR data can be trusted. It scores each record and keeps a history of every change. An outside development team writes most of the code, and the founder is not technical.

The founder brought me in as a part-time technical advisor. They needed a clear view of what was built and what to fix first before a demo for a federal government department and a first data test with a design partner.

What I did

Code review against the specs. I checked six core areas of the platform against what the specs asked for. Each one was partly built, so I wrote down what existed and what was still missing.
Ranked the risks. I listed the five biggest risks in order. The top one was that some sensitive values were stored without encryption, even though working encryption code was already in the codebase and only needed to be connected.
Build plans checked against the specs. I compared 87 build plans with 145 spec documents and found 160 places where they did not match. All 160 were then fixed in the plans.
Settled five spec contradictions. Some specs disagreed with each other, including four different trust score formulas. I laid out each choice with a recommendation, and the founder decided all five so the team could move.
First design partner data. I worked on bringing a design partner's employee file into the platform. That meant matching their column names to ours and fixing a bug that merged different employees into one record.

Results

Before
The founder could not see how much of the platform matched the specs.
After
A written review of six core areas, with the top risks ranked.
Before
Some sensitive values were stored without encryption.
After
The fix is known and is the first item on the roadmap.
Before
160 mismatches between the build plans and the specs.
After
All 160 fixed in the plans.
Before
Four trust score formulas in the specs and three in the code.
After
One formula chosen, with a clear path to the long-term version.
Before
No record of past changes that could prove nobody tampered with it.
After
A change history where any edit after the fact shows up.
Before
A design partner's employee file could not be loaded cleanly.
After
The merge bug is fixed, so each employee gets their own record.

What comes next

This engagement is ongoing. Next: connect the encryption fix, run the design partner's full data test from upload to trust scores, and finish the remaining features planned for the partner, such as trust scores in the graph view and alerts when incoming data changes shape.

Your developers are busy and the product is stuck?

Book a free 25-minute call to see whether working together makes sense.

Prefer writing? Email me at hello@nicolascava.com. I'll reply within one business day.