What a Legal Health Check Covers, and What It Usually Finds

Picture the first week with a new lawyer. You send over a folder: the formation papers, a spreadsheet of who owns what, a dozen signed contracts, some offer letters, the privacy policy from launch. Somewhere in that folder is the answer to a question you have not thought to ask yet. The Legal Health Check is how we find it before it finds you.

We call it a review rather than an audit on purpose. An audit tests a company against an outside standard. This tests the company against its own intentions. You meant to own your code. You meant to cap what you could owe a customer. You meant that stock grant to vest over four years. The review finds the places where the paperwork says something else.

The five areas we read

The company itself. Formation documents, the operating agreement or bylaws (the internal rulebook), the current capitalization table (the record of who owns what), every equity grant and the approval that should stand behind it, board minutes, annual filings, and any change everyone agreed to by email and nobody wrote up properly.

Contracts in force. Your standard customer agreement and every negotiated change to it, vendor agreements, reseller and partner contracts, confidentiality agreements, and, where most surprises live, the renewal and termination terms in all of them.

Intellectual property. Agreements in which founders, employees and contractors hand ownership of their work to the company, use of open-source code, trademark filings and how the marks are actually used, and whether the company or an individual owns the domain, the code repository, the design files and the brand accounts.

People. Offer letters, employment agreements, whether people treated as contractors are really contractors, restrictions such as non-solicitation promises, the handbook and policies, and the paperwork for anyone who has left.

Privacy, data and product. The published privacy policy compared with what the product actually does, the terms of service, the data terms you have signed with customers and with the outside services that handle data for you, security promises made during sales, and any AI tools in the workflow.

The four things it produces

1. A written inventory of what exists, what is missing, and what is out of date.
2. A risk ranking, so the first month is spent on what actually matters rather than on whatever is easiest to see.
3. A ninety-day roadmap with owners and dates. Not a list of recommendations: a plan with names on it.
4. A list of anything we think needs counsel we are not. Litigation, real estate transactions, tax, and matters governed by another state’s law are placed with counsel we choose and oversee. We make the introduction and stay involved.

That fourth item matters more than it looks. A review whose author only reports the problems they can fix themselves is not really a review.

The eight findings that come back most often

These are recurring patterns, not statistics. We are describing what the work tends to look like, not counting it.

• Equity granted without a signed approval. The grant appears in the cap table software, but there is no record that the board approved it, and the person holding it believes they own something they may not.
• A contractor with no ownership assignment. Usually an early designer or a freelance developer, and usually the one whose work is still in the product.
• The customer template nobody owns. Adapted from somewhere, never revised, and containing either an indemnity (a promise to cover the customer’s losses) the company cannot support, or no cap on liability at all.
• An auto-renewing vendor contract nobody put on the calendar. A twelve-month term with a sixty-day window to cancel, renewed twice, for software two people still use.
• A contractor who has drifted into being an employee. Same hours, same supervision, same tools as the staff, with the original agreement untouched since the first year.
• A privacy policy describing a previous product. Accurate at launch, silent now about the analytics, the outside data services and the AI vendor added since.
• Security promises made by sales, not by legal. A customer questionnaire answered optimistically by someone with no way to make the answers true.
• No paper trail for a departure. No separation agreement, no confirmation that company property came back, no written record of what was agreed about equity.

None of these is dramatic. All of them are cheap to fix in week two and expensive to explain when an investor or buyer reviews the company before closing a deal, the process lawyers call due diligence.

How the ranking works, in one illustration

This is a composite, not a client. The point of the risk ranking is that it is not the same as the list of findings. Suppose a review of a nineteen-person company turns up eleven findings. The roadmap does not tackle them in the order they were found. It might run like this:

1. Days 1 to 15: ownership assignments from two contractors, one of whose work is in the product. First, because the risk goes to who owns the thing the company sells, and because it needs signatures from people who are still on good terms with the company. Every month of delay lowers the odds they sign.
2. Days 1 to 30: the liability terms in the customer template. Second, because fixing it protects every deal signed afterward. The contracts already signed are a separate, slower conversation.
3. Days 15 to 45: four missing board approvals. Third, because they are entirely within the company’s control and take an afternoon. They prevent a future embarrassment rather than stopping a current loss.
4. Days 30 to 60: a closer look at two contractor relationships. Fourth, because the facts need gathering before any document is drafted.
5. Days 45 to 90: the privacy policy, a vendor renewal calendar and a departure file. Last, not because they do not matter, but because nothing gets worse while they wait.

The six other findings are logged with a note and no date, because the honest ranking of some issues is “not this quarter.” A roadmap that puts everything in the first thirty days is a roadmap nobody follows.

Why it comes first

The alternative to a review at the start is a relationship in which every question is answered from partial information and the gaps turn up one at a time, usually under time pressure and usually because the other side of a deal found them. Reading the file once, up front, is the most useful time in the engagement. It decides whether the next ninety days go to what matters or to whatever happens to arrive. From there the monthly rhythm begins, and the first strategy session typically happens within the first two weeks.

Where to start

You can run a rough version yourself this week. Make a folder with five subfolders named for the five areas above, and drop in what you can find in an hour. Whatever you cannot find is your first inventory of what is missing. If you would like the full review, the firm’s General Counsel page sets out the plans that include it and how onboarding runs.

This is general information about how an onboarding legal review works, not legal advice about your company.