IT Due Diligence Before Buying or Merging with a Business: What Should You Check?
Executive Summary
When buying or merging with another business, it is easy to focus on the finances, contracts, staff and customers. But the technology behind the business deserves just as much attention.
Poorly managed IT can create unexpected costs and risks after a deal completes. You could inherit ageing computers, unsupported software, weak cyber security, expensive supplier contracts, software licensing problems or systems that are difficult to integrate with your own.
IT due diligence is about understanding those issues before you take responsibility for them.
A good review should establish what technology the business relies on, how securely it is managed, who controls it, whether software is correctly licensed, how data is protected and what investment may be required after the acquisition or merger.
Done properly, IT due diligence does not just uncover problems. It gives you a much clearer picture of the true cost and complexity of bringing two businesses together.
Introduction
If you were buying a business, you would not agree the deal without looking at its accounts.
The same principle should apply to its IT.
Almost every modern business depends on technology for email, customer information, finance, payroll, documents, communication and day-to-day operations. Yet IT can sometimes receive relatively little attention during an acquisition until the deal is almost complete.
That can lead to some unpleasant surprises.
Perhaps half of the computers need replacing. Maybe an important system is running on old software that is no longer supported. There may be no reliable backup. A former employee could still have administrator access. Or the software the business depends on may be licensed in a way that does not automatically carry across to the new organisation.
These are much easier problems to deal with when you know about them in advance.
So what should an IT due diligence review actually cover?
Why IT due diligence matters
The purpose of IT due diligence is not simply to create a list of computers and software.
It should answer some much more important business questions:
- Is the technology secure?
- Is it reliable enough to support the business?
- Does the company actually own or have the right to use the technology it depends on?
- Are there hidden costs that will appear after completion?
- Can the acquired company be integrated with your existing IT?
- Are customer, employee and business data being handled appropriately?
- Who currently controls important systems and accounts?
- What needs to be fixed immediately after the deal?
The answers can affect the cost of an acquisition, the integration plan and, in more serious cases, whether the buyer is comfortable proceeding at all.
Cyber Security is particularly important. UK government guidance treats cyber risk as a material business risk and places responsibility for understanding and managing it at senior leadership level.
An acquisition should therefore involve more than asking, “Do you have antivirus software?”
You need to understand the overall state of the business’s technology.
1. Establish exactly what technology the business has
The first job is to build a clear picture of the company’s IT environment.
That includes the obvious equipment such as:
- laptops and desktop computers
- servers
- monitors and other office equipment
- mobile phones and tablets
- network equipment
- printers and specialist devices
But physical equipment is only part of the picture.
You also need to identify the systems and online services the business depends on. These could include email, file storage, accounting software, customer relationship management systems, line-of-business applications, websites, cloud services and communication platforms.
This exercise often uncovers technology that management did not realise was being used.
For example, a particular department may have subscribed to an online service independently and built an important process around it. If nobody knows about that system, it may be overlooked during the acquisition.
The aim is to understand what exists, what it does, who manages it and how important it is to the operation of the business.
2. Assess the company’s cybersecurity
One of the biggest risks when acquiring another business is inheriting a cybersecurity problem.
The company does not necessarily need to have experienced a major cyber attack for there to be issues. Weak passwords, outdated software, poorly configured accounts and old systems can all increase the risk once the businesses become connected.
A cybersecurity review should look at areas such as:
- whether important systems and devices receive security updates
- whether multi-factor authentication is being used
- how antivirus and other security tools are managed
- whether computers and mobile devices are centrally controlled
- who has administrator-level access
- how staff accounts are created and removed
- whether former employees still have access
- how email is protected
- how remote working is managed
- whether the company has experienced previous security incidents
- whether vulnerabilities or security concerns have already been identified
It is also worth asking whether the business has Cyber Essentials or another recognised security certification. Certification does not replace due diligence, but it can provide useful information about the controls already in place.
Where significant concerns are found, you can then understand the work required to reduce the risk before connecting the acquired business to your own systems.
3. Find out who controls the important accounts
This is a surprisingly common area of risk.
Critical services can sometimes be registered using an individual’s account, personal email address or company credit card without anyone else having full control.
You should establish who owns and administers important services including:
- Microsoft 365 or other email platforms
- domain names
- website hosting
- cloud services
- backup systems
- security software
- internet connections
- business applications
- social media accounts where relevant
Administrator credentials should be held securely and the business should have a clear way to regain access if a member of staff or external supplier leaves.
A domain name registered personally by the founder or a critical cloud account controlled solely by an old IT supplier can become a significant problem during an acquisition.
Finding these dependencies early gives you time to resolve ownership and access before completion.
4. Check software licences and subscriptions
Software licensing is another area that can create unexpected costs.
Do not assume that because software is currently installed and working, the new business automatically has the right to continue using it after an acquisition.
Software can be licensed in different ways. Some licences may relate to individual users or devices, while others may be subject to agreements with the company itself. Certain licences, subscriptions or contracts may need to be changed, reassigned or purchased again following a change in ownership or legal entity.
Your review should identify:
- what paid software the business uses
- how many licences have been purchased
- how many are actually required
- when subscriptions renew
- which company or individual owns each subscription
- whether licences can be transferred
- whether there are minimum contract periods
- whether important software is approaching end of support
- whether there is evidence that the business is properly licensed
Special attention should be paid to expensive or business-critical software.
If the acquired company relies on specialist applications for manufacturing, design, finance or another important business process, replacing or relicensing those systems could represent a significant cost.
Software agreements should be reviewed alongside the wider legal and commercial due diligence where appropriate.
5. Review IT suppliers and contracts
Many SMEs rely heavily on external providers for their IT.
That might include an IT support company, software developers, internet providers, telecoms companies, cybersecurity providers, cloud hosting businesses and specialist software suppliers.
You need to understand those relationships before the acquisition completes.
Look at:
- what each supplier provides
- contract length and renewal dates
- notice periods
- monthly or annual costs
- whether prices are likely to change
- whether the contract can transfer to the new owner
- what access the supplier has to company systems
- whether the company owns its data and configurations
- what happens when the supplier relationship ends
This is particularly important when one supplier has extensive access to the company’s systems.
You should know exactly what that provider controls and how access could be transferred or removed if you decide to use a different supplier after the acquisition.
6. Understand the data you are taking responsibility for
An acquisition can involve taking responsibility for a considerable amount of data.
That might include customer records, employee information, financial information, emails, documents and commercially sensitive information.
The Information Commissioner’s Office specifically advises organisations to consider data sharing and data protection obligations as part of due diligence when businesses merge or are acquired.
Questions to consider include:
- What personal data does the company hold?
- Where is that information stored?
- Who has access to it?
- Why was it originally collected?
- How long is it retained?
- Is sensitive information adequately protected?
- Has the company experienced any previous data breaches?
- Will information need to move between different systems after the merger?
Care is particularly important when data needs to be transferred from one organisation or system to another.
Your legal or data protection advisers may also need to review how personal information will be handled following the transaction.
7. Check backups and disaster recovery
Every business says its data is backed up.
The more important question is whether those backups would actually work if they were needed.
Due diligence should establish:
- what is being backed up
- how frequently backups run
- where copies are stored
- how long information is retained
- whether backups are monitored
- whether recovery has been tested
- who receives alerts when a backup fails
You should also understand what would happen if a major system became unavailable.
How long could the business continue without access to its files, email or key applications?
If there is no documented recovery plan, that does not necessarily make the acquisition a bad one. It does, however, highlight an area that may need attention and investment.
8. Look at the age and condition of the hardware
An office full of computers is an asset only if those computers are suitable for continued use.
If most of the company’s laptops are five or six years old, a substantial replacement programme could be waiting for you soon after the acquisition.
Review the age, specification and support status of the equipment.
You should be able to estimate:
- what can continue to be used
- what should be replaced soon
- what is already overdue for replacement
- whether devices can support your preferred operating systems and security requirements
The same principle applies to servers, network equipment and other business-critical technology.
This information can be turned into a realistic hardware budget for the first few years following the acquisition.
9. Work out how the two businesses will actually come together
Due diligence should also look forward.
Knowing what the acquired company currently has is useful, but the bigger question may be what happens after completion.
For example, will both businesses continue using separate email systems?
Will everyone move onto one Microsoft 365 environment?
Will documents and customer records need to be migrated?
Will offices be connected?
Will staff keep their existing laptops or receive equipment configured to the acquiring company’s standards?
Will two separate phone systems need to become one?
There may not be a reason to change everything immediately. In some cases, keeping systems separate for a period may be the most sensible approach.
What matters is understanding the options, risks and costs before making the decision.
10. Identify the hidden IT costs
A useful IT due diligence report should ultimately translate technology findings into business decisions.
Rather than simply saying that 30 laptops are old, it should help estimate what replacing those laptops is likely to involve.
Rather than saying that security needs improvement, it should explain which improvements should be prioritised.
Possible post-acquisition costs might include:
- replacing computers
- upgrading network equipment
- buying additional software licences
- migrating email and files
- consolidating cloud systems
- improving cybersecurity
- changing IT providers
- upgrading internet connections
- replacing unsupported software
- improving backups
- integrating phone systems
- staff training
This gives decision-makers a much more realistic view of the acquisition.
A business that appears to require little investment on paper might actually need significant technology spending during the first year.
What are the warning signs during IT due diligence?
Every company will have something that could be improved, so the purpose of due diligence is not to find a perfectly managed IT environment.
However, certain findings deserve closer attention.
These could include:
- nobody being able to provide an accurate list of systems or equipment
- unsupported software still being business-critical
- no multi-factor authentication on important accounts
- former employees retaining system access
- administrator accounts that cannot be identified
- little or no evidence of backups being tested
- widespread use of personal accounts for business systems
- unclear ownership of domains, websites or cloud services
- unlicensed or questionably licensed software
- security incidents that have not been properly investigated
- critical technology being dependent on one person
- large amounts of ageing hardware
- expensive IT commitments that were not previously identified
One issue on its own may be straightforward to fix.
Several of them together can indicate that the technology environment has not been well managed and that additional time and investment will be required after the deal.
When should IT due diligence take place?
Ideally, IT should be reviewed early enough in the acquisition process for the findings to influence the deal and the integration plan.
Leaving it until a few days before completion limits your options.
Early involvement means there is time to investigate concerns, obtain further information, estimate remediation costs and agree who will be responsible for addressing particular issues.
It also gives your IT team or provider time to plan what happens on day one.
That could include securing administrator accounts, changing access permissions, deploying security software, setting up new users and ensuring the acquired business can continue operating without disruption.
Final Thoughts
Technology is now so closely connected to everyday business operations that it should be treated as an important part of acquisition due diligence, rather than something to sort out after the deal.
The objective is not to produce an enormous technical report.
It is to answer some straightforward questions: What are you acquiring? Is it secure? Is it properly licensed? Who controls it? What could go wrong? And what is it likely to cost to bring it up to the standard you need?
Getting those answers before completion can prevent expensive surprises and make the eventual integration considerably smoother.
How Get Support can help with IT due diligence
If you are considering buying or merging with another business, Get Support can carry out an independent review of its IT environment before the transaction completes.
We can assess the company’s hardware, systems, Microsoft 365 environment, cybersecurity, backups, software and licensing position, supplier relationships and overall IT setup.
We can then highlight areas of concern, identify likely costs and help you build a practical plan for what needs to happen before, during and after the acquisition.
And once the deal completes, we can help with the next stage too, from securing accounts and supplying new hardware through to migrations, configuration, integration and ongoing IT support.
Contact Get Support to discuss IT due diligence for your acquisition or merger.
FAQs
IT due diligence is a review of a company’s technology before an acquisition, investment or merger. It looks at areas such as hardware, software, cybersecurity, backups, data, IT contracts, licensing and the systems the company relies on.
The aim is to identify risks, hidden costs and potential integration problems before the transaction completes.
Yes. Small businesses can be particularly dependent on a relatively small number of systems, suppliers or individuals.
Even a company with ten or twenty employees could have important customer data, expensive software, ageing computers or cybersecurity issues that a buyer needs to understand.
The scope of the review can be adjusted to suit the size and complexity of the business.
You should identify the software and online services being used, who owns the licences, how many licences exist, renewal dates and whether the licences or agreements can continue following the acquisition.
Business-critical and expensive specialist applications deserve particular attention.
Where the contractual position is unclear, appropriate legal or licensing advice should also be obtained.
Potentially, yes.
If two businesses are connected without first understanding the security of the acquired company’s systems, weaknesses in one environment could create risks for the other.
For this reason, it can be sensible to assess and address important security issues before fully integrating networks, accounts and systems.
Yes. Get Support can review the technology environment of a business you are considering acquiring or merging with.
We can help identify security concerns, ageing equipment, licensing issues, supplier dependencies and potential integration costs. We can also help plan and carry out the technical work required after the transaction, including hardware procurement, Microsoft 365 migrations, cybersecurity improvements, setup and ongoing IT support.
Sources
This article draws on current UK guidance including:
- National Cyber Security Centre guidance on cyber risk, asset management and security governance.
- The UK Government Cyber Governance Code of Practice, which sets out the importance of identifying critical technology and managing cyber risk at leadership level.
- Information Commissioner’s Office guidance on data protection due diligence and data sharing during mergers and acquisitions.
This article provides general information and should not be treated as legal or licensing advice.