Know exactly where your database stands.

An experienced eye finds most of a database's risks quickly, because the same problems come up over and over. In the first hour I check whether the relationships window is populated or empty (empty means referential integrity is enforced nowhere), whether tables have primary keys, whether one giant table is doing the work of five, and whether the file is split or being shared whole across a network. I look at the file size against the actual data volume, when it was last compacted, and whether any backup newer than "sometime last year" exists. Those few checks alone predict most of what the full review will find.

The code review goes deeper. Queries get read for the patterns that produce slow screens and wrong numbers: joins without indexes, criteria that silently exclude null rows, the same calculation implemented six slightly different ways across the database (which of the six is right?). VBA gets checked for error handling, hardcoded file paths that break the day a server changes, and credentials sitting in plain text. The security pass asks who can open the file, what they can do once inside, and whether the honest answer to both is "everyone, everything".

What you receive is a written report ordered by consequence, not an unsorted defect list. Item one is whatever could lose you data. Then what's costing your staff time every day, then what will hurt when the business grows, and only then the cosmetic. Each item states what I found, why it matters in operational terms, and roughly what fixing it involves, so the decisions stay yours.

There are a few moments when a review earns its cost several times over. Before commissioning new development, because building on a cracked foundation multiplies the price of everything after it. After inheriting a database, whether from a departed employee or an acquired company, when nobody left can say how it works. And before any migration, to SQL Server, to the cloud, or to a web app, since the review tells you exactly what you'd be migrating and what should be fixed or dropped first. A second-opinion review on another developer's quote is also a service I'm asked for more often than you'd think.

Some clients hand the list straight back to me to work through. Others fix the top three items internally and stop there. Both are good outcomes; the point of a review is that you decide with the facts in front of you instead of finding them out during an outage.