Tech Due Diligence ARCH-4: Scalability and Performance Engineering
What This Control Requires
The assessor evaluates the system's ability to scale horizontally and vertically, load testing practices, performance benchmarks, caching strategies, and whether the architecture can handle projected growth without fundamental redesign.
In Plain Language
Scalability directly impacts the investment thesis. If the growth plan calls for 10x current load, investors need confidence that the technology can support it without a costly rebuild. Assessors look at both the theoretical scalability of the architecture and hard evidence from load testing. Key areas under scrutiny include horizontal scalability (can you add more instances to handle more load), vertical scalability (can individual components be upgraded), identified bottlenecks (database, application server, external services), caching strategy and effectiveness, asynchronous processing for heavy operations, and performance under concurrent load. Assessors also look for performance discipline as a cultural signal. Are there performance budgets for key user journeys? Are regressions caught in CI/CD? Is there regular load testing? Teams that invest in performance engineering build systems that scale smoothly. Teams that react to user complaints build systems that break at the worst possible time.
How to Implement
Design for horizontal scalability from the start. Application servers should be stateless (session state stored externally in Redis or similar), database connections pooled, file uploads directed to object storage (S3, GCS) rather than local disk, and background jobs processed through a queue (SQS, RabbitMQ, Redis) consumed by multiple workers. Build a caching strategy across multiple levels: CDN caching for static assets and frequently accessed content, application-level caching (Redis, Memcached) for computed results and query responses, database query caching for repeated lookups, and HTTP caching headers for cacheable API responses. Monitor cache hit rates and tune TTLs based on data freshness requirements. Run regular load tests using tools like k6, Locust, or Gatling. Define scenarios that mirror real-world usage patterns and projected growth. Establish performance baselines and detect regressions by running load tests in CI/CD or on a regular schedule. Set performance budgets for key user journeys. Define acceptable thresholds - for example, p95 API response under 200ms, page load under 2 seconds - and alert when they are exceeded. Move time-consuming operations to asynchronous processing: email sending, report generation, data processing, webhook delivery, notification dispatch. Use a reliable job queue with retry mechanisms and dead-letter queues for failed jobs. Identify and document known scalability limits honestly. Cover the maximum concurrent users tested, database row counts where performance degrades, external service rate limits that constrain throughput, and how costs scale with load (linearly, sub-linearly, or super-linearly). Create a scalability roadmap that addresses bottlenecks and projects when they will be hit based on growth forecasts. Proactive planning impresses assessors far more than reactive firefighting.
Evidence Your Auditor Will Request
- Load testing reports with performance metrics under various load levels
- Performance budgets for key user journeys with monitoring dashboards
- Caching strategy documentation with cache hit rate metrics
- Scalability assessment identifying bottlenecks and growth limits
- Scalability roadmap addressing projected growth requirements
Common Mistakes
- No load testing performed; scalability is assumed rather than proven
- Application stores session state on local disk, preventing horizontal scaling
- Database is the bottleneck with no read replicas, caching, or optimisation plan
- Synchronous processing of time-consuming operations blocks request handling
- Scalability limits unknown; team will discover them when they hit production issues
Related Controls Across Frameworks
| Framework | Control ID | Relationship |
|---|---|---|
| SOC 2 | A1.1 | Related |
Frequently Asked Questions
What load should we test to?
Is auto-scaling sufficient for scalability?
Track Tech Due Diligence compliance in one place
AuditFront helps you manage every Tech Due Diligence control, collect evidence, and stay audit-ready.
Start Free Assessment