Print this page (Ctrl/Cmd+P) and walk through it with your committee before a key is lost. Pair it with the free audit at safeaudit.node01.org — it computes the same items from on-chain data.
Threshold is at most owners − 2 (so losing one signer never bricks the treasury).
No N-of-N Safe (threshold ≠ owner count). If you run N-of-N, lower the threshold or add a signer now.
At least one signer is held by a person who is not the primary operator (geographic / organizational separation).
Headroom = owners − threshold. ≥2 = green, 1 = amber, 0 or negative = red.
A recovery module is installed and its guardian address is documented and tested.
The recovery delay (7 / 14 / 28 / 56 days) is chosen deliberately and matches your committee's review cadence.
Guardian key is held by a separate party (not one of the daily signers) and is reachable in an emergency.
A module configured after a key is lost cannot help. Install and drill it while everything works.
Transaction guard reviewed: it restricts (not silently permits) dangerous calls — delegatecall, self-call, module/guard changes.
Fallback handler (EIP-1271) is set only if you need off-chain signature validation; otherwise leave it unset.
Master copy (implementation) version is current and matches the version your runbook assumes.