Executive Summary

The target operates a mature, single-currency (USD) NetSuite OneWorld production instance supporting full order-to-cash and procure-to-pay cycles, light manufacturing, and multi-location inventory across 15 locations. Transaction volume is modest (≈7,900 lifetime transactions) but the customization surface is not: 1,169 scripts, 438 custom record types, 151 custom lists, and 1,203 released-or-scheduled script deployments (with a further 626 deployed-not-scheduled that remain invocable).^{E1 E3}

The verdict in one panel

Severity distribution — 12 registered risks (post-review)

Second-edition comparison: 1 Critical · 5 High · 2 Medium · 3 Low. The High-band count fell because independent review found two risks over-scored and one scored on invalid evidence; one new Medium risk was added. Amendment log in Appendix D.

The Asset — Instance Footprint

Risk Matrix & Register

Severity = likelihood × impact, each scored 1–5 against the anchor definitions in Section 8. Scores marked amended were revised following independent review (Appendix D). Blind spots are deliberately not scored — they appear as Unassessed Areas in §7.

Severity ranking — all 12 risks (scale 0–25)

Register — measured severities with evidence citations

Customization Debt & Key-Person Exposure

Only nine distinct owner identities exist across all 1,169 scripts.^E1 The finding here is a bus-factor, stated precisely (and amended after independent review): the owner metadata cannot attribute 87.8% of bespoke code, and of what it can attribute, nearly everything maintainable rests with two or three active individuals.

Local script ownership — 459 scripts^E2

Deployment surface — 1,915 deployment records^E3

Vendor Lock-In & License Posture

52.7% of the customization estate (847 of 1,607 objects) is owned by installed SuiteApps.^E18 Four are structurally core — tax computation, fixed-asset depreciation, warehouse execution, shop-floor data capture. Object count is a proxy for runtime criticality (per review note), but tax and fixed assets are load-bearing by construction. Migration cost concentrates here.

Bundle footprint — customization objects (record types + scripts)

License-tier signals^{E14 E15 E16 · A9}

Data Quality Scorecard

Underlying measurements — all reproducible via Appendix B

Recommended Actions & Unassessed Areas

Unassessed areas — disclosed blind spots, deliberately not scored

Per the independent review, blind spots must not be converted into scored findings. These areas could not be assessed by this method and require the listed follow-up. Absence from the register is not evidence of absence of risk.

Scoring Model

Severities are the product of two 1–5 scores assigned against the anchors below, applied to measured evidence — and, in this edition, stress-tested by independent review with all disagreements published (Appendix D). Reasonable professionals may re-score; the inputs are all in Appendix B.

Likelihood anchors (probability the risk manifests as loss within 12 months post-close)

Impact anchors (consequence if it manifests)

Bands

Severity = L × I. Critical ≥ 17 · High 12–16 · Medium 7–11 · Low ≤ 6.

Data-quality score formulas (A3, A11)

Assumptions Register

Evidence & Queries

Canonical, re-runnable forms of the evidence queries, rendered to this account's house SuiteQL conventions. Execute in the SuiteQL Query Tool under an administrator role. Results shown as measured 2026-08-18; live re-runs will drift with normal activity. This account's SuiteQL does not support REGEXP_LIKE — prefix matching uses LIKE chains throughout. All arithmetic derived from these results was verified by independent review (Appendix D).

SELECT
    s.owner,
    e.entityid           AS owner_name,
    e.isinactive         AS owner_inactive,
    COUNT(*)             AS script_count
FROM script s
LEFT JOIN employee e ON e.id = s.owner
GROUP BY s.owner, e.entityid, e.isinactive
ORDER BY script_count DESC

SELECT
    s.owner,
    e.entityid           AS owner_name,
    COUNT(*)             AS local_scripts
FROM script s
LEFT JOIN employee e ON e.id = s.owner
WHERE LOWER(s.scriptid) NOT LIKE 'customscript_fam%'
  AND LOWER(s.scriptid) NOT LIKE '%ncfar%'
  AND LOWER(s.scriptid) NOT LIKE '%_ste_%'
  -- ... repeat NOT LIKE for all 16 bundle prefixes listed in A1
GROUP BY s.owner, e.entityid
ORDER BY local_scripts DESC

SELECT
    sd.isdeployed,
    sd.status,
    COUNT(*)             AS deployments
FROM scriptdeployment sd
GROUP BY sd.isdeployed, sd.status
ORDER BY deployments DESC

SELECT
    w.releasestatus,
    COUNT(*)             AS workflows
FROM workflow w
GROUP BY w.releasestatus
ORDER BY workflows DESC

SELECT
    COUNT(*)                                                    AS total_customers,
    SUM(CASE WHEN c.email IS NULL THEN 1 ELSE 0 END)          AS missing_email,
    SUM(CASE WHEN c.terms IS NULL THEN 1 ELSE 0 END)          AS missing_terms,
    SUM(CASE WHEN c.salesrep IS NULL THEN 1 ELSE 0 END)       AS missing_salesrep,
    SUM(CASE WHEN c.defaultbillingaddress IS NULL THEN 1 ELSE 0 END) AS missing_bill_addr,
    SUM(CASE WHEN c.isinactive = 'T' THEN 1 ELSE 0 END)        AS inactive_customers
FROM customer c

SELECT COUNT(*) AS duplicate_names
FROM (
    SELECT c.companyname
    FROM customer c
    WHERE c.isinactive = 'F'
      AND c.companyname IS NOT NULL
    GROUP BY c.companyname
    HAVING COUNT(*) > 1
)

SELECT
    COUNT(*)                                             AS total_vendors,
    SUM(CASE WHEN v.email IS NULL THEN 1 ELSE 0 END)   AS missing_email,
    SUM(CASE WHEN v.isinactive = 'T' THEN 1 ELSE 0 END) AS inactive_vendors
FROM vendor v

SELECT
    COUNT(*)                                             AS total_contacts,
    SUM(CASE WHEN ct.email IS NULL THEN 1 ELSE 0 END)  AS missing_email,
    SUM(CASE WHEN ct.company IS NULL THEN 1 ELSE 0 END) AS unattached
FROM contact ct

SELECT
    COUNT(*)                                                  AS total_items,
    SUM(CASE WHEN i.class IS NULL THEN 1 ELSE 0 END)        AS missing_class,
    SUM(CASE WHEN i.description IS NULL THEN 1 ELSE 0 END)  AS missing_description,
    SUM(CASE WHEN i.isinactive = 'T' THEN 1 ELSE 0 END)      AS inactive_items
FROM item i

SELECT
    COUNT(*)                                                  AS open_sales_orders,
    SUM(CASE WHEN t.trandate < TO_DATE('2026-05-20','YYYY-MM-DD')
        THEN 1 ELSE 0 END)                                   AS open_over_90_days
FROM transaction t
WHERE t.type = 'SalesOrd'
  AND t.status NOT IN ('G', 'C', 'H')  -- G=Billed, C=Cancelled, H=Closed

SELECT
    COUNT(*)                                                  AS open_purchase_orders,
    SUM(CASE WHEN t.trandate < TO_DATE('2026-05-20','YYYY-MM-DD')
        THEN 1 ELSE 0 END)                                   AS open_over_90_days
FROM transaction t
WHERE t.type = 'PurchOrd'
  AND t.status NOT IN ('G', 'H', 'C')

SELECT COUNT(DISTINCT t.id) AS txns_with_deptless_lines
FROM transaction t
JOIN transactionline tl ON tl.transaction = t.id
WHERE t.posting = 'T'
  AND t.trandate >= TO_DATE('2026-01-01','YYYY-MM-DD')
  AND tl.mainline = 'F'
  AND tl.department IS NULL   -- second run: tl.location IS NULL

SELECT
    COUNT(*)                                                  AS total_journals,
    SUM(CASE WHEN t.trandate >= TO_DATE('2026-01-01','YYYY-MM-DD')
        THEN 1 ELSE 0 END)                                   AS journals_2026
FROM transaction t
WHERE t.type = 'Journal'

SELECT
    COUNT(*)                                                  AS active_employees,
    SUM(CASE WHEN e.giveaccess = 'T' THEN 1 ELSE 0 END)      AS provisioned_users
FROM employee e
WHERE e.isinactive = 'F'

SELECT
    CASE WHEN r.id >= 1000 THEN 'CUSTOM' ELSE 'STANDARD' END AS role_class,
    COUNT(*)                                                  AS role_count
FROM role r
GROUP BY CASE WHEN r.id >= 1000 THEN 'CUSTOM' ELSE 'STANDARD' END

SELECT
    la.oauthappname,
    COUNT(*)             AS login_events
FROM LoginAudit la
WHERE la.oauthappname IS NOT NULL
GROUP BY la.oauthappname
ORDER BY login_events DESC

SELECT COUNT(*) AS restlet_count
FROM script s
WHERE s.scripttype = 'RESTLET'

-- Example: Fixed Assets family. Repeat with each family's prefixes
-- against BOTH script and customrecordtype tables.
SELECT COUNT(*) AS fam_scripts
FROM script s
WHERE LOWER(s.scriptid) LIKE 'customscript_fam%'
   OR LOWER(s.scriptid) LIKE '%ncfar%'

SELECT COUNT(*) AS saved_searches
FROM savedsearch

Sources & Reconciliation

Source documents

Reconciliation — live measurement vs 2026-08-03 survey

Methodology & limitations (consolidated)

All figures were measured directly against the production instance on August 18, 2026, via read-only SuiteQL under an administrator session, supplemented by prior verified survey work (S-2), then independently reviewed (S-5). Severity scores are likelihood × impact per Section 8. Limitations: (i) bundle attribution is prefix-based (A1); (ii) the integration record is not exposed to SuiteQL here — external-caller inventory is a lower bound (A8, U2); (iii) script ownership reflects the owner field, a known-weak authorship proxy (A5); (iv) no code-level review of the 577 residual scripts — phase-two workstream; (v) the AI-login data includes this assessment's own tooling traffic (A7); (vi) license conclusions are feature-inferred (A9); (vii) consolidation integrity, SoD, and saved-search/workflow ownership were not assessed (U1, U3, U4).

Independent Review & Dispositions

Review protocol

On 2026-08-18, the complete evidence base (all 19 measurements), the computed metrics with formulas, and the 16 claims of the second-edition register — stated neutrally, with the assessor's recommendations withheld — were submitted to an independent reviewing model operating under an adversarial-review charter: verify all arithmetic; flag claims where evidence does not support the language; flag over/under-scored risks with proposed rescores; identify material risks the register missed. The reviewer's verdicts are reproduced below verbatim in substance, followed by the assessor's disposition of each. Where a disposition is "accepted," the body of this report has been amended accordingly; nothing was silently changed — the amendment log at the end of this appendix is complete.

Verdict summary — 16 claims

Claim-by-claim verdicts and dispositions

Reviewer's missed-risk sweep — dispositions

Reviewer's bottom line (verbatim)

All four weakness classes have been remediated in this edition as documented above. No reviewer verdict was rejected outright; one (C2) was accepted in part with a documented, reasoned divergence on the likelihood score.

Amendment log — second edition → third edition