How much does a code audit cost in Australia? (2026)

Why do businesses commission a code audit?

Most code audits are triggered by a decision that depends on the state of the code: whether to keep building on it, invest in it, launch it or dispute it. The trigger shapes the scope, and the scope shapes the price.

Trigger	The question the audit answers	Typical scope
Inherited codebase (developer left, agency changed, acquisition)	Can we safely keep building on this, and what will it cost to fix?	Full audit with remediation estimate
Investor or buyer due diligence	Does the technology match what we are being told, and what are the risks?	Full audit plus ownership, licences and team practices
Pre launch security check	Are there serious security problems we should fix before real users arrive?	Security focused review, ideally followed by a penetration test
Dispute with a developer	Does the delivered code meet what was agreed?	Targeted audit against the contract and specification
Performance or reliability problems	Why is it slow or failing, and what is the fix?	Focused review of architecture, queries and infrastructure

If the audit is for an investment or acquisition, our guide to technical due diligence covers the wider process.

What do code audits cost?

Published Australian price lists for code audits are hard to find, so these are worked estimates: reviewer days multiplied by an assumed agency day rate of $1,100 to $1,500 ex GST. That assumption starts from Re:Sourced’s 2026 figures for senior Sydney contractors ($800 to $1,100 a day for software, $950 to $1,200 for cyber) and adds the management and quality review an agency day carries.

Scope	What’s covered	Typical effort	Worked estimate (AUD, ex GST)
Health check	One application: structure, dependencies, obvious security issues, test and deployment setup, short report	2 to 5 days	$2,200 to $7,500
Security focused review	One application reviewed against selected OWASP ASVS requirements, secrets and dependency scanning, authorisation logic	5 to 15 days	$5,500 to $22,500
Full audit, mid sized codebase	Architecture, code quality, security, dependencies and licences, infrastructure, delivery practices, remediation estimate	8 to 20 days	$8,800 to $30,000
Large or multi repository audit	Several services or apps, cloud infrastructure, data handling, compliance mapping	25 to 55 days	$27,500 to $82,500

Specialist security firms may bill above that range. Compliance Council’s Australian penetration testing bands imply roughly $2,000 a tester day, so a security focused review from a specialist firm may sit near the top of the band or above it. These are market estimates, not AWLabs prices; we don’t publish day rates.

What drives the price?

Days drive the price, and these are the things that add days. Lines of code matter less than how many separate systems and technologies the reviewer has to understand.

• Number of repositories and services. Each one needs orientation, a build check and its own dependency review.
• Languages and frameworks. A single TypeScript stack is quicker to review than one mixing PHP, Python and an old mobile framework.
• Infrastructure. Infrastructure as code can be read in hours; a cloud account configured by hand takes longer to review.
• Documentation. An architecture diagram and a working local setup save a day or more.
• Access. Read only access to repositories, cloud and staging on day one is the biggest saving you control.
• Audience. A report for a board or investor takes longer to write than notes for a development team.
• Compliance mapping. Mapping findings to a framework adds days. That might be ASD Essentials, which ASD published on 15 October 2026 to evolve the Essential Eight, the Essential Eight’s patching and application control strategies where a contract still names them, or an enterprise customer’s security questionnaire.

Worked example: an inherited SaaS application

Estimating the days yourself gives you a check on quotes before they arrive. This illustration uses the assumed day rate, not a quote.

The scenario: a business has taken over a SaaS product from a departed agency. It has a React front end and a Node.js API in two repositories, a PostgreSQL database and an AWS account. The new owners want to know whether to keep building on it.

Activity	Estimated days
Access, local build and orientation	1
Architecture and data model review	2
Security review against selected ASVS chapters (authentication, access control, input handling)	3
Dependencies, licences and secrets scan	1
AWS configuration, deployment and backups	1.5
Tests, CI pipeline and delivery practices	0.5
Report, remediation estimate and debrief	1.5
Total	10.5 days

At $1,100 to $1,500 a day, that is about $11,550 to $15,750 ex GST, plus GST of 10%. If the audit finds the code is sound, the business continues with confidence. If it finds deep problems, the remediation estimate tells the owners whether fixing is cheaper than rebuilding, which is often a six figure decision.

What should the report contain?

A useful audit report lets a non technical owner make a decision and gives developers enough detail to act. Ask for a redacted sample report before you commission an audit. It should include:

1. An executive summary with an overall view: keep building, fix first, or consider replacing.
2. Findings ranked by severity (critical, high, medium, low), each with evidence, business impact and a recommended fix.
3. Security findings mapped to a recognised standard, such as OWASP ASVS (version 5.0.0, published May 2025, at the time of writing).
4. Dependency and licence findings, including outdated or unsupported packages and any licences that conflict with how you sell the software.
5. Infrastructure and backup findings: can the system be restored, and who has access?
6. A remediation estimate in days or dollars, grouped so you can fix the critical items first.
7. What was not reviewed, so nobody assumes coverage that wasn’t there.

Code audit vs penetration test vs technical due diligence

These three overlap, but they answer different questions and are bought by different people.

	Code audit	Penetration test	Technical due diligence
Looks at	Source code, configuration, infrastructure, practices	The running system, from an attacker’s point of view	Technology, team, ownership, scalability and risk
Finds	Hidden secrets, unsafe patterns, technical debt, unsupported dependencies	Exploitable vulnerabilities and what an attacker could reach	Whether the technology supports the business case
Bought by	Owners, new CTOs, boards	Security teams, customers who require it	Investors and acquirers
Typical output	Ranked findings and remediation estimate	Exploited findings with proof of impact	Risk report for a transaction

Our penetration testing cost guide covers the testing side.

How do you prepare so the audit costs less?

Every hour an auditor spends waiting for access or working out how to run the code is an hour you pay for. A day of preparation on your side can take a day or two off the bill.

1. Grant read only access to every repository, including infrastructure as code and any scripts kept outside the main repository.
2. Provide read only access to the cloud console and a staging environment with realistic, non production data.
3. Share whatever documentation exists, even if it’s out of date: architecture notes, the original specification, deployment steps.
4. Name a contact who knows the system and can answer questions within a day.
5. Say what decision the audit supports, so the reviewer spends time on what matters to it.
6. List known problems up front. Auditors shouldn’t be paid to rediscover issues you already know about.

How often should you audit?

Audit when a decision depends on the code, not on a calendar. Common moments are taking over a codebase, before raising money or selling, before a major launch, and before committing to a large new feature on old foundations. Between audits, automated dependency and secrets scanning on every change catches much of what a health check would, at little cost. A second, lighter audit a year after a big remediation effort is a reasonable way to confirm the fixes held.

What to do with the findings

Fix the critical and high findings first, then decide on the rest against your roadmap. A sensible order:

1. Rotate any exposed secrets and close critical security findings immediately.
2. Make sure backups work and can be restored.
3. Update unsupported dependencies that carry known vulnerabilities.
4. Add tests around the areas you plan to change next.
5. Fold medium and low findings into normal releases.

If the audit shows the project is in serious trouble, our software project rescue service covers stabilising it. For the long term cost of keeping the system healthy, see our software maintenance cost guide.

How AWLabs approaches code audits

We review code, architecture, dependencies, security, infrastructure and delivery practices, and produce a severity rated report with a remediation estimate. We work under NDA, read only where possible, and report to whoever commissioned the audit. AWLabs is not CREST accredited, and where a customer or contract requires an accredited penetration test, we help scope it and refer the testing to a specialist firm. Senior engineers lead every build and every audit.

Security review is where independent eyes matter most. Nat, who runs an online health and fitness coaching business, described what that looked like in a client story: “They even tried to break into our systems themselves looking for weaknesses like a real attacker would and they found a security hole, fixed it and put monitoring in place to keep an eye on things moving forward.”

The first step is a Development Consult, a 15 minute call. Our code audit service explains scope and timing. If the audit leads to a build with us, that build is priced as a fixed price Schedule of Work with three options: The Minimum, The Recommended and The Complete.