Odoo Audit Checklist: Warning Signs, Severity Score, Scope and Cost

Odoo rarely fails loudly. It slows down, grows custom code nobody remembers writing, misses one upgrade and then another, and ends up trusted by fewer people each quarter. An Odoo audit catches that drift early, and our Odoo ERP support services usually start with one.

This checklist is for owners, CFOs, IT leads and operations managers who run Odoo today and suspect it is costing more than it should. If your real problem is being stuck on an old version, read our guide to over-customized Odoo upgrade options alongside this one.

What is an Odoo audit, and how is it different from a health check?

An Odoo audit is a scoped, human-led review of how your Odoo system is built, secured and used, while a health check is a fast, automated read of what is visible from the outside. You need both, in that order.

Question	Free Odoo health check	Full Odoo audit
Who runs it	An automated read-only tool	A senior consultant and a developer
Access needed	Your Odoo address only	Read-only database and code access under NDA
What it sees	Version, edition, hosting, modules, security headers, TLS	Everything behind the login: data, rights, code, workflows
Time	About ten seconds	A few days to two weeks
Output	A score, support status and an indicative upgrade range	A findings register, roadmap and written estimate
Cost	Free	Scoped per system, often US$1,500 to US$4,500 on the market

Our free Odoo Health Check tool reads eight public things from your instance: version and edition, support status, hosting, installed modules, custom module count, security hygiene, availability and the TLS certificate. It never logs in and never writes.

What are the signs your Odoo system needs an audit?

The clearest signs are rising support costs with no process change, repeatedly delayed upgrades, slow screens, admin rights for everyone and numbers people double-check in Excel. The table ranks the twelve we see most often.

Sign	What it usually means	Severity
Your version is out of standard support	No more security fixes; legacy surcharge risk	Critical
Upgrade postponed more than twice	Custom code nobody wants to touch	High
Nobody can list your custom modules	Undocumented code, former vendor knowledge	High
Database manager open on the internet	Missing list_db and master password hardening	Critical
Most users are in the Administrator group	No segregation of duties, no audit trail value	High
Sales or Inventory lists take seconds to load	Heavy computed fields, missing indexes, bad queries	Medium
Reports differ from the accountant's spreadsheet	Data quality or configuration drift	High
Staff keep side spreadsheets for core tasks	Process not modeled, low adoption	Medium
Scheduled actions fail or run for hours	Cron contention, broken integrations	Medium
App Store modules installed and never reviewed	Unknown sudo() calls and ORM bypasses	High
Every small change needs the vendor	Studio changes and patches with no documentation	Medium
Integrations retry or duplicate records	Weak error handling, deprecated API use	Medium

Two of these sit on the critical row for a reason. Odoo supports three major versions at a time, and Odoo 17.0 standard support ended in September 2026, so a database on 17 or older no longer receives security fixes. Our post on unsupported Odoo version security risks explains the exposure.

How do you self-assess your Odoo system in ten minutes?

Score each of the ten questions below from 0 (fine) to 3 (severe), add them up, and read the band. The weighting is our own and is illustrative, but it mirrors what a paid audit finds first.

1. Version: 0 if you run Odoo 19 or 20; 1 for 18; 2 for 17; 3 for anything older or unknown.
2. Custom modules: 0 for none; 1 for one to five documented modules; 2 for six to fifteen; 3 for more than fifteen or an unknown count.
3. Documentation: 0 if every customization has a written spec and owner; 3 if the only record is the code itself.
4. Access rights: 0 if administrators are two or fewer and roles are reviewed yearly; 3 if most users are administrators.
5. Hosting hygiene: 0 if HTTPS, HSTS and a hidden database manager are confirmed; 3 if you do not know.
6. Performance: 0 if common lists open in under two seconds; 3 if users complain weekly.
7. Data trust: 0 if finance closes from Odoo alone; 3 if the close depends on spreadsheets.
8. Integrations: 0 if every connection has an owner, logs and alerts; 3 if failures are found by customers.
9. Backups and test environment: 0 if daily off-server backups and a staging copy exist; 3 if neither does.
10. Upgrade readiness: 0 if a test upgrade ran in the last year; 3 if nobody has tried one.

Read the total like this: 0 to 6 is healthy, keep patching and plan the next upgrade inside the support window. 7 to 14 needs attention, usually one or two fixes. 15 or more is at risk, and the audit should happen this month, not next quarter.

The free health check scores the outside view the same way: version currency and security hygiene carry 30 points each, customization load 20, availability and TLS 10 each. The self-assessment fills in the inside view.

What does an Odoo system audit checklist cover?

A complete Odoo system audit checklist covers eight areas, and skipping any of them leaves a blind spot that shows up at the next upgrade. Each area has a clear question, evidence to collect and a severity rule.

Audit area	Key question	Evidence collected	Typical finding
Version and support	Is the version supported and upgradeable?	Version, edition, hosting, support dates	Two versions behind, surcharge due
Security hardening	Is the server deployed the way Odoo recommends?	Config file, proxy, headers, admin accounts	Database manager exposed
Custom code	Is each module needed, documented and upgrade-safe?	Module list, repo, tests, overrides	Duplicated standard logic
Third-party apps	Are App Store and OCA modules current and safe?	Versions, licenses, sudo() and SQL use	Abandoned module blocks upgrade
Data quality	Can finance and operations trust the numbers?	Duplicates, unreconciled items, stale stock moves	Hundreds of open transfers
Access rights	Who can see and change what?	Groups, record rules, portal and API users	Admin group used as default
Performance	Where does time go?	Profiler sessions, slow query log, cron runtimes	One computed field on every list
Process and adoption	Does Odoo run the business or record it afterwards?	Interviews, side spreadsheets, manual re-entry	Quotes never followed up

The cost driver across all eight is custom code. Every custom module has to be ported and tested at every upgrade, which is why our guide to third-party Odoo module costs treats each one as a recurring bill, not a one-time purchase.

What does an Odoo code audit look for?

An Odoo code audit checks whether each custom module is still needed, whether it follows Odoo's framework rules, and how much work it adds to the next upgrade. The reviewer reads the code, but the first question is always functional: could standard Odoo do this now?

Odoo's own guidance for customized databases says to stop the developments and challenge them before any upgrade, then make every custom module installable on an empty database of the target version. A good code audit does that challenge for you. These are the checks that matter most:

• Redundancy: features that Odoo 19 or 20 now ship as standard, so the module can be retired.
• Overrides: standard methods replaced instead of extended, which break silently on each version.
• Privilege use: sudo() calls, missing access checks and record rules, and raw SQL that bypasses the ORM.
• Framework currency: deprecated API patterns, removed fields, moved xpaths and renamed methods.
• Tests and docs: whether the module has automated tests and a written spec with a named owner.

Integrations get the same treatment. XML-RPC and JSON-RPC are deprecated in Odoo 20, not removed yet, with removal scheduled for Odoo 22, so connectors built on them go into the findings register with a migration note.

Where does Odoo performance really go wrong?

Most Odoo performance problems trace back to custom code, missing database indexes and server settings, not to Odoo itself. An Odoo performance audit measures before it tunes.

On the Odoo forum, a user who upgraded to Odoo 17 and saw a significant slowdown was pointed to missing PostgreSQL indexes, outdated custom modules and worker settings. An older thread put it plainly: custom modules can hinder performance a great deal if not written properly.

The audit works through a fixed sequence:

1. Baseline: record load times for the five screens users complain about most, on production and on a clean test copy.
2. Profile: use Odoo's integrated profiler to capture SQL and stack traces for those requests (not available on Odoo Online).
3. Inspect the database: slow query log, missing indexes, table bloat and the size of mail and attachment tables.
4. Check the server: worker count against Odoo's rule of thumb of (CPU x 2) + 1, memory limits, cron threads and proxy timeouts.
5. Fix in order of payoff: one heavy computed field on a list view often beats a bigger server.

How do you audit Odoo security and access rights?

A security audit checks the server against Odoo's deployment guidance, then reviews who can do what inside the database. Both halves matter, and the second is the one most companies skip.

Odoo's deployment security checklist is explicit: set a strong master password and restrict the database manager, set dbfilter and list_db to False, never use admin as a login, and keep demo data off internet-facing servers.

It also calls for HTTPS with a valid certificate, multi-process mode with memory and time limits, and daily backups copied to a remote server. The audit checks each line against your config file and proxy.

Inside the database, the audit reviews groups, record rules and portal users, starting from Odoo's rule that only an administrator can change access rights. Typical findings: a dozen people in the Settings administrator group, API keys tied to real employees, and departed staff still active.

What are the deliverables of an Odoo audit?

An audit that ends with a slide deck has failed; the deliverables should be a findings register you can act on, a roadmap with costs and a written upgrade estimate. Ask for these five items before you sign.

• Findings register: every issue with area, evidence, severity (critical, high, medium, low), effort and owner.
• Module inventory: each custom, OCA and App Store module with its purpose, author, version status and a keep, replace or retire decision.
• Prioritized roadmap: quick wins for the first 30 days, then upgrade preparation, then process fixes.
• Upgrade estimate: version path, effort per module and a cost range tied to your hosting.
• Leadership read-out: a one-hour session with the people who own the budget, in plain business language.

The roadmap should name a verification plan too. Many upgrade problems only appear at month-end, which is why our guide to Odoo upgrade verification exists.

How much does an Odoo audit cost, and how long does it take?

Start free, then expect a paid audit to take a few days for a small system and two weeks or more for a heavily customized one. The price depends almost entirely on the number of custom modules and integrations.

Published market prices for Odoo audits run from about US$1,500 for a short health check with quick wins to around US$4,500 for a deep dive with a roadmap (industry estimate, October 2026). Treat these as a reference, not a quote, and insist on an agreed scope.

The audit is a small fraction of what it protects. Our Odoo upgrade cost guide puts a 19 to 20 upgrade at US$1,500 to US$3,000 and a 17 to 20 jump at US$3,500 to US$10,000 (industry estimates), with heavy customization reaching US$30,000 or more.

Delay has its own price. Odoo's subscription agreement adds a 25% legacy surcharge once a year for databases older than the three most recent major versions. An audit that gets you upgraded in time can pay for itself in licence fees alone.

Which industries get the most from an Odoo audit?

Industries with high transaction volume, regulated records or heavy customization see the fastest return from an Odoo audit. The table shows where findings usually cluster.

Industry	Pain or cost driver	Odoo approach	How iVentureTeam helps
Manufacturing	Custom MRP flows that block upgrades	Challenge custom code against standard MRP and Quality	Code audit, module retirement, staged upgrade
Wholesale and distribution	Thousands of stale transfers hide real delays	Data cleanup, routes review, barcode adoption	Data quality audit and warehouse process fixes
Retail and eCommerce	Slow POS and connector duplicates	Performance profiling, integration error review	Performance audit and connector rebuild
Professional services	Timesheets and billing kept outside Odoo	Process audit, project and invoicing setup	Adoption review and training
Finance and accounting firms	Entries edited after close, weak access control	Lock dates, audit trail, role redesign	Security and access rights audit
Healthcare and SaaS	Portal users with wide rights, API keys on staff	Record rules, service users, key rotation	Security hardening and integration review

Audit, refresh or rescue: what should you do with the results?

The audit score tells you which of three paths you are on: keep and refresh, fix then upgrade, or rescue first. Choosing the wrong one wastes the most money.

• Refresh (healthy or low needs-attention): the system is sound but behind. Clean data, retire redundant modules, retrain users and book the upgrade inside the support window.
• Fix then upgrade (needs attention): critical security findings and blocking modules get fixed first, then a test upgrade follows the steps in Odoo's upgrade documentation, including a neutralized test database.
• Rescue (at risk): wrong stock counts, untrusted ledgers or production stoppages. Stabilize data and processes before touching the version, and consider a partner change if the current one built the problem.

How iVentureTeam helps with an Odoo audit

iVentureTeam built the free health check and runs the audits, fixes and upgrades that follow it, on systems implemented by anyone. We have delivered 150+ ERP projects across 35+ countries with 40+ Odoo specialists over 13+ years.

• Free health check: run the read-only tool, then ask for the written report and a senior consultant reads your findings.
• Scoped audit: read-only access under NDA, eight-area review, findings register, module inventory and roadmap.
• Upgrade planning: our Odoo upgrade services turn the estimate into a tested upgrade with a verification plan.
• Advisory: our Odoo consulting services handle process, role and data design when the findings are organizational rather than technical.
• Ongoing support: monitoring, patching and a yearly re-audit so the score does not slide back.

Odoo audit case study: EvoLogics

A German subsea technology company jumped three Odoo Enterprise versions after an audit mapped every custom module and business flow first. EvoLogics, based in Germany, had been running Odoo 12 Enterprise with significant custom business-flow code.

Odoo 12 was three major versions behind, cutting the company off from newer features, performance gains and security patches. As an operating manufacturer with live orders, it could not absorb meaningful ERP downtime, and a straight database upgrade would have broken years of custom workflow code.

iVentureTeam treated the migration as a planned engineering project. It began with a comprehensive audit of the existing Odoo 12 system, mapping every custom module and business flow in scope, followed by a staged plan that sequenced database conversion, code migration, testing and cutover.

The custom code was ported and refactored for Odoo 15 Enterprise, end-to-end testing validated data and workflow behavior, and go-live completed with under a day of cutover downtime across a 12-week project. Read the full EvoLogics Odoo 12 to 15 Enterprise migration case study.

The bottom line on an Odoo audit

If you cannot list your custom modules, name your administrators and state your support end date from memory, your Odoo system is due for an audit. The cost of finding out is low, and the cost of not knowing arrives with the next upgrade.

Run the free health check, score yourself on the ten questions above, and book a scoped audit if you land at 15 or more. Fix critical findings first, then upgrade inside the support window.

Ready to find out what your Odoo system is really costing you?

Get a read-only audit from the team that built the free health check. Request a scoped Odoo audit, call +91-90235-15208, or email business@iventureteam.com.