Claude Code Team Adoption Audit: 50-Point Scorecard

A Claude Code team-adoption audit is the difference between knowing your engineers have the tool installed and knowing what they actually do with it. Engineering leaders can pull a licence-usage report from Anthropic in a single click; what that report cannot tell you is whether the team has skills in .claude/skills, whether CLAUDE.md files are tight enough to be read in full on every turn, whether anyone has wired Stop hooks, and whether the security policy is keeping up with the shape of the tool today versus six months ago.

The 50-point scorecard below is the audit framework we use on client engagements. Five axes — configuration, hooks, skills, memory, security — at ten points each. Every point is checked against an artefact in the repo or in the user's local Claude Code state, not against survey self-reports. The output is a stage on a four-step maturity model and a 60-day uplift roadmap with the highest-ROI gaps prioritised.

This guide walks through what the audit looks for on each axis, how the maturity model maps an aggregate score to a development stage, and a worked example from a 30-engineer shop we audited in Q1 2026. Everything below is the operational method, not the sales pitch — the section at the end on engagement work is the place for the latter.

The first failure mode in any AI-coding-tool rollout is treating licence telemetry as the success metric. Anthropic's dashboard can confirm a seat is provisioned, a session opened, a token spent. None of those signals describe whether the engineer is using Claude Code as a thin chat interface or as a delegated agentic workflow — and the gap between those two postures is roughly an order of magnitude in productivity terms.

We separate the two with a deliberate vocabulary. Adoption is the floor: the tool is installed, the user has logged in, a session has been started this week. Engagement is the ceiling: subagents are being invoked, skills are being run, hooks are firing, CLAUDE.md is referenced on every turn, memory entries are accumulating with durable value. Adoption is binary and easy. Engagement is a spectrum and is what the audit measures.

Three signals separate engaged users from adopted-but-idle ones. They are also the signals managers most often miss because they sit outside the vendor dashboard:

Licence telemetry sees none of the three. A user who opens a session daily and copy-pastes generated code into their editor scores identically to a user running parallel review subagents with hook-driven CI integration — yet they are doing fundamentally different work. The audit's purpose is to surface that gap, attribute it to the right axis, and convert it into a roadmap rather than a number.

For a deeper look at how subagents change the workflow specifically, our walkthrough on building a Claude Code custom subagent is the operational layer underneath this axis — the audit checks for the presence and quality of those agents, that piece teaches how to build them.

The scorecard is organised around five axes, ten points each, for a fifty-point total. We picked these axes by working backwards from the engagement signals above — every axis maps to a class of artefact that engaged teams produce and idle teams do not. They are listed in the order we score them, because the earlier axes tend to be prerequisites for the later ones (skills are hard to land without good configuration; security is hard to audit without skills being present at all).

Two axes — configuration and hooks — form the base layer. They make the tool behave consistently across the team and create the hooks (literally) that later workflow integration depends on. Two more — skills and memory — form the leverage layer. They are what make Claude Code feel like a senior teammate rather than an autocomplete. The fifth — security — is the cross-cutting concern: it has to keep up with everything else because every new surface area is a new policy gap.

The next three sections cover each layer in turn — what we score, what good looks like, what failure looks like, and what the common remediation pattern is for the gaps we find most often.

Configuration is the easiest axis to score because the artefacts are deterministic — either ~/.claude/settings.json has an entry or it does not. We look for ten things, weighted equally. A well-configured engineer scores eight or nine; an unconfigured one scores zero to two.

The most common base-layer gap is the no hooks profile: solid settings, sensible model defaults, sometimes even a tidy MCP registry — but no lifecycle hooks at all. That team is using Claude Code as a smart text editor rather than as an agentic component of their workflow. The remediation is small and high-ROI: ship a Stop hook that posts to Slack or appends to an audit log, watch engagement rise inside a week as the team starts thinking of Claude Code as a participant in the shared workflow rather than a private assistant.

Configuration gaps, by contrast, are usually a one-afternoon fix — generate a shared .claude/settings.json template, commit it, document the user-scope additions individuals are expected to make, and move on.

If the base layer makes Claude Code behave consistently, the leverage layer is what turns it into a multiplier. Skills are the productised leverage — user-defined slash commands that wrap a repeated workflow into one keystroke. Memory is the sustained leverage — the file the model reads on every turn, which means tight memory pays dividends on every interaction.

Skills score ten points across five sub-criteria, two points each. Memory scores another ten with the same structure. The audit is opinionated about what good looks like on both — opinionated enough that scoring is reproducible across auditors, not interpretive.

The leverage layer is where the audit usually finds the biggest point gap in absolute terms. A team scoring 14 out of 20 on the base layer is doing fine — there is room to improve but the tool is broadly functional. A team scoring 2 out of 20 on the leverage layer (the median for first-time audits in 2026) is leaving most of the value on the table. The remediation is straightforward — start with one skill per engineer per month, prune CLAUDE.md to 300 lines, re-measure the quarter after.

For the technique of building a single high-quality skill from scratch, our walkthrough on building a Claude skill from scratch covers the SKILL.md format, trigger phrasing, and the scoping discipline that separates a skill that gets invoked from one that sits idle in the directory.

The fifth axis is the smallest in nominal point count but the most cross-cutting. Six points cover security policy — the disciplines that have to keep up with every other axis as it grows. Four cover the productivity signals — the metrics that tell you whether the other forty points are paying off.

Security drift is the audit's most-cited finding in retros. Teams adopt new tool surfaces — a new MCP server, a new hook, a new skill that runs bash — faster than the security policy catches up. The drift is rarely catastrophic but accumulates: by the time it shows up in a real incident the remediation is much bigger than the quarterly review would have been.

The productivity signals close the loop. Without them the other forty-six points are advisory rather than measurable. With them — even simple weekly subagent counts, skill-invocation totals, time-to-first-meaningful-output on new hires — the engagement curve is visible and the audit's next-quarter roadmap is grounded in evidence rather than assertion.

The aggregate score is plotted against a four-stage maturity model. The stages are deliberately broad — twelve-point buckets rather than fine-grained tiers — because the goal of the model is to set a next-quarter direction, not to fine-tune the current quarter. Most teams should expect to move one stage per quarter if the roadmap is taken seriously.

One nuance worth stating. The stages are not strictly sequential — it is possible to land at Configured with a partial leverage layer or to skip from Ad-Hoc straight to Leveraged on the strength of a single motivated tech lead shipping skills before settings.json is even committed. The stage label is a summary, not a constraint. The roadmap a given team gets out of the audit is the concrete remediation list — the stage just sets the expectation for cadence and next-quarter ambition.

One representative engagement, anonymised. A 30-engineer product team, Next.js + Python stack, Claude Code rolled out seven months before the audit. Self-reported adoption was strong — every engineer had used Claude Code in the last fortnight, the eng-leadership team had a positive narrative internally. The audit told a more textured story.

The headline finding: the team was Configured on paper but barely past Ad-Hoc in practice. Strong licence-usage telemetry, a passable base layer, almost no leverage layer, and zero infrastructure for measuring whether things were improving. The single highest-ROI remediation was the leverage axis — at 5 out of 20, the gap was the biggest absolute deficit on the scorecard.

The 60-day roadmap that came out of the audit had three workstreams. One: prune CLAUDE.md from 1,100 lines to roughly 350, split the rest into linked sub-docs, set up a quarterly edit cadence. Two: ship six initial skills — commit, code-review, scaffold-new-route, write-tests, update-changelog, spawn-subagent-team. Three: stand up a productivity panel — weekly subagent count, weekly skill invocations, time-to-first -meaningful-output for new hires. The security and hooks gaps were scheduled for the following quarter.

Re-audit at day 90 produced a score of 34 out of 50 — Stage 3 Leveraged, up from Stage 2 Configured, with the leverage axis now the strongest rather than the weakest. The productivity panel showed weekly subagent invocations roughly tripling and skill invocations climbing from a near-zero baseline. The absolute numbers are less interesting than the shape — the team moved from spending time prompting Claude Code to spending time orchestrating it.

If you want the same calibration applied to your team, our AI transformation engagements ship Claude Code adoption audits with a 60-day uplift roadmap scoped to your stack, your team size, and the gaps the scorecard identifies on the first pass.