7 Architecture Red Flags We Find in Almost Every Review

The same handful of issues shows up in almost every architecture review I run, no matter the company size or stack. Here are the seven I flag most often.

1. A single managed database with no read replicas carrying both transactional and analytical load.
2. IAM roles granted at the project or account level instead of least-privilege, resource-scoped access.
3. No documented RTO or RPO: nobody has actually tested a restore from backup in over a year.
4. A "temporary" cron job or VM running a critical process, unmanaged by infrastructure as code.
5. Synchronous calls between services that should be event-driven, creating cascading failure risk.
6. No load-shedding or circuit breakers at the edge, so one slow dependency can take down everything upstream.
7. Architecture diagrams that do not match reality. The documentation describes the system as it looked 18 months ago.

The diagrams-vs-reality problem shows up most often. Bring in a fresh set of eyes twice a year. Don't wait for something to break.