Small & Growing Businesses systems built around real operations.

It varies with what the system does, but a common planning figure is fifteen to twenty-five percent of build cost annually — and budgeting nothing is how working software becomes unsupportable. That covers dependency and security updates, defect response, monitoring, backups with tested restores, and the small changes every system needs as the business changes around it. Software that sits untouched for a year usually needs significant remedial work before it can ship again, because dependencies move, platforms deprecate APIs and security disclosures accumulate. Continuous small maintenance is consistently cheaper than periodic catch-up.

Usually, and it starts with an audit rather than a quote. That means establishing what it runs on, whether the source is complete, whether it can be built and deployed from scratch, what the dependency and version state is, whether backups actually restore, and what is undocumented. The audit is chargeable work and produces a written risk picture. The complications that matter are undocumented modifications, dependencies that can no longer be installed, and environments nobody can reconstruct — each of those needs a decision before an ongoing arrangement means anything.

As a build requirement rather than a review at the end. Server-side authorisation on every request regardless of what the interface prevents, validated input at every boundary where untrusted data enters, parameterised queries, secrets in encrypted storage with a documented rotation procedure, and dependency scanning in the pipeline. Beyond the code: least-privilege access to environments, audit logging on consequential actions, and a tested restore path. The gaps that show up most often in real systems are not exotic — they are missing authorisation checks on endpoints nobody expected to be called directly, and credentials that were committed once and never rotated.

Not if the project is set up correctly, and you should treat that as a requirement rather than a courtesy. Standard technologies with a real hiring pool rather than an unusual stack only we understand. Documentation written for someone who was not in the conversations. Accounts and repositories in your name throughout. No proprietary framework you would have to keep paying for. The measure is simple: if you decided tomorrow to move to another developer, how long would it take them to become productive? If the answer is more than a couple of weeks, something was built wrong.

Weeks rather than months, if the project is sequenced properly. Building in vertical slices means each release completes one journey end to end — genuinely usable rather than a layer that does nothing on its own. That matters because it lets you correct direction while correction is still cheap, and because a working thing generates far better feedback than a specification does. Projects that reveal everything at the end are the ones that overrun, since every misunderstanding compounds silently until it is expensive to unpick.

They will, and that is normal rather than a failure of planning. What matters is that changes are decided rather than absorbed. Each one gets assessed for its effect on scope, timeline and cost, then explicitly accepted or deferred. Projects overrun not because requirements changed but because they changed invisibly — a small addition here, a reasonable extra there, none individually worth a conversation, collectively consuming the budget. Making the trade visible each time keeps both sides in control of it.

For anything customer-facing, usually yes, and the cost of skipping it appears later as support tickets and abandoned journeys. For internal tools the answer is more nuanced — a competent developer working from a component library often produces something perfectly usable, and paying for bespoke visual design on a screen five staff use daily is rarely the best allocation. What cannot be skipped either way is thinking about the task: what the user is trying to finish, what information they need at each step, and what happens when something goes wrong.

By testing the conditions that occur in reality rather than the path that was demonstrated. Permissions and roles, invalid and malicious input, third-party services failing or timing out, weak networks, real devices, accessibility with keyboard and screen reader, and data quality on representative records rather than clean samples. Automated tests cover the paths that would cost money if they broke. Manual testing covers what automation cannot judge. The happy path is the easiest thing to get right and the least useful thing to test exclusively, which is why demos are a poor proxy for readiness.