Tech due diligence: The how and why of a crucial process

In a world that is rapidly becoming more digitised, it goes without saying that technology is an absolutely integral part of virtually any business. By extension, in business acquisitions, a target company’s IT infrastructure is one of the crucial elements that a buyer will be taking on when they acquire the business.

Due diligence of a target company’s tech, then, is absolutely crucial and this importance has only intensified in the current climate. With widespread working from home massively increasing cybersecurity concerns and the growing take-up of cloud-based solutions making “legacy tech” a major financial burden for many companies, tech due diligence has never been more vital.

Ensuring tech is a core part of a due diligence process can help buyers avoid an unexpected and potentially costly situation post-acquisition. More than this, though, proper tech due diligence can be invaluable in providing buyers with an early assessment of how smooth the post-acquisition integration process might be and how quickly the business can be geared up for growth.

While flagging issues during tech due diligence will not necessarily make or break a deal, identifying areas that will need upgrading post-acquisition can give buyers leverage to help drive the asking price down in negotiations.

For sellers, meanwhile, recognising the key role that tech will play in a buyer’s due diligence means that steps can be taken before the business is brought to market to facilitate a smooth due diligence process and to ensure IT issues don’t derail a potential deal at the due diligence stage.

The risks of insufficient tech due diligence

It should be obvious that due diligence of a target company’s IT platform and technology processes is a central component of a potential deal, but it’s important to stress how risky it can be to not get a comprehensive overview at the due diligence stage.

When attempting to close a deal, it may be tempting to just get a cursory overview of a company’s software, hardware and processes, but this leaves a buyer open to numerous major pitfalls that could seriously impact the business once they have taken over.

Foremost, of course, are unexpected costs. Taking over a business and quickly discovering that its tech platform is in major need of updating can mean a huge amount of investment is required. This is hardly ideal in a sensitive, post-acquisition stage where careful cash management is vital and investment may already be earmarked for other areas and can also quickly make the price paid for the business appear to represent a major lack of value.

The post-acquisition period is, of course, vital for a new owner to bed in and begin imposing their vision for the business. An urgent need to upgrade the company’s tech can seriously complicate the post-acquisition process and lead to early growth targets being delayed.

Key areas to look at – a tech due diligence check list

Hardware/equipment
The most obvious and perhaps easiest element of tech due diligence to conduct is assessing a target company’s hardware and equipment. Sometimes companies go years without replacing the likes of desktops, laptops, phone systems and (a particularly important and potentially costly piece of tech) servers. This can mean a build-up of outdated, slow hardware that is insufficient for taking the business forward.

As a general rule, hardware that is more than three years old may be considered due for an upgrade, while any hardware that is say five to seven years old should be replaced. Identifying this at the due diligence stage can provide instant leverage in negotiations, putting the seller in a position where they will either have to upgrade their hardware in order to get the price they want or cut their asking price to reflect the state of their hardware.

Failure to perform sufficient due diligence on a target firm’s hardware can lead to numerous damaging situations. Firstly, outdated tech such as computers and servers can be extremely slow, which will have a hugely negative impact on the business’ performance.

If a buyer is aiming to integrate the target company with their current business, performance can also be negatively impacted by the fact that outdated hardware may not be compatible with the current business’ systems.

Legacy internal servers are a particular red flag, as not only are they, for the most part, becoming outdated as companies migrate to cloud-based platforms like Azure or AWS, they often require specialist programmers to manage, particularly if they are proprietary systems.

Potentially an even more severe issue arising from outdated hardware can be compromised security. If a piece of hardware is old enough, the vendor firm may stop (or may have already stopped) delivering automatic security updates and patches for the device in question. Naturally, this leaves the device and the business at greater risk of being successfully targeted by a cyberattack – an outcome which can have dire consequences for its finances and reputation.

Cybersecurity
With more employees working from home than ever, cybersecurity has never been more crucial. Employees working from home and logging into company systems from home broadband connections massively increases the potential attack surface for hackers to target. For that reason, due diligence on cybersecurity is paramount.

The company’s antivirus systems and firewalls will need to be looked at closely to ensure they are adequate and up to date. It will also be important to consider whether, even if they are sufficient, they can be enhanced post-acquisition by tapping into technology such as AI.

If the company has employees working from home then endpoint security will be vital to ensuring that devices and connections are secure when logged into company systems. A less technical, but just as vital, element of ensuring working from home is secure will be gaining an overview of employee cybersecurity awareness.

While it may not be possible to assess every single employee’s knowledge of cybersecurity best practice, buyers can still gain an idea of this at the due diligence stage by enquiring about what training employees have been given on staying secure online while working. For example, have employees received adequate training on how to spot and avoid email phishing scams?

As well as leaving a new business vulnerable to attack, an insufficient cybersecurity system will also increase an owner’s data liability – potentially putting the business at risk of not meeting regulatory standards such as GDPR. Finally, of course, updating (or entirely replacing) a cybersecurity system that isn’t up to scratch would be another unwanted cost in the post-acquisition phase.

Backups/disaster recovery stratagems
No cybersecurity system is perfect and for that reason a company’s backups and protocols for disaster recovery are also a key thing to look at during due diligence. In the event of something going wrong, what measures are in place to ensure that important files and documents aren’t lost permanently?

If a company has poor disaster recovery systems then a cyberattack, or even a technical malfunction, could have an enormously costly impact on the business. Proper disaster recovery processes might include having systems in place to mitigate the impact of a security breach or loss of data and regular tests in place to ensure that these are efficient.

Increasingly, companies with cloud-based infrastructures are utilising systems that have disaster recovery processes and regular backups as standard (for example, Disaster Recovery as a Service – DraaS). If a target company does not have such processes in place then this should be reflected in the valuation of the firm and should be an immediate priority to sort out post-acquisition.

Integration
Unless the buyer plans to leave the target company as a separate entity from their core business, then post-deal integration should be a key consideration when performing tech due diligence. Prior to the acquisition, buyers should assess how the target company’s software, platforms and operating systems can be merged with their own and how their compatibility (or lack thereof) could impact the post-acquisition integration.

A lack of compatibility can mean that the integration process is slow and costly, with systems potentially requiring wholesale replacement in order to make an IT merger feasible.

Potential barriers to tech due diligence and how to work around them

When conducting any kind of due diligence, there are bound to be factors that complicate proceedings and need to be worked around in order to facilitate a proper due diligence process. Tech due diligence is, of course, no different and is perhaps even more sensitive than other types of due diligence.

A primary issue, as in many types of due diligence, is information sharing. Especially in acquisitions involving two competitor firms, the target company will often be hesitant to share sensitive information with the other. With information as closely guarded as tech processes, cybersecurity systems and other software, this concern will be particularly acute.

In order to work around this, the potential buyers could be asked to sign a non-disclosure agreement restricting them from sharing information with third-parties, should they wish to proceed with the acquisition. Meanwhile, in order to prevent accidental leaks of sensitive data, tech due diligence matters can be discussed in a secure data room.

Another current factor that could impact tech due diligence is COVID-19. While lockdown restrictions are currently loose this is changeable and there is still likely to be some trepidation and reluctance surrounding on-site visits in which people mix closely in confined office spaces. This could make examining a target company’s hardware difficult.

A potential solution to this, discussed in this previous BSR insight, is to conduct due diligence remotely. Detailed video tours of offices can be used to ascertain an overview of a company’s hardware, or, in the case of larger sites, drones could even be utilised.

How should buyers undertake due diligence

Obviously, as outlined above, buyers should enter the tech due diligence process with a checklist of what to examine. However, it is also important to consider what practical measures they can take to ensure effective due diligence.

Firstly, it is important to bear in mind that the process is largely an attempt to gain a thorough understanding of the target company’s tech, their hardware, software and related processes. While buyers should of course be on the lookout for areas where the company’s tech is lacking (and reflect this in their valuation), going into the due diligence process with the aim of driving the valuation as low as possible will not necessarily be conducive to a sale.

Aggressively attempting to drive the price down by flagging up every issue no matter how tiny might be a legitimate technique if a buyer is targeting a distressed company. However, in any other type of sale this approach might be enough to convince the seller that they aren’t the right buyer.

In fact, part of a good due diligence process can also be looking to see what the firm does well on a technological level. For example, a buyer might ask themselves what unique tools or processes the company has that could be implemented across their wider business and aid growth at their existing firm post-acquisition.

Again, trust is a vital and extremely sensitive part of the due diligence process, particularly when it comes down to a company’s tech. In order to ensure that a potential buyer gains the trust and confidence of the seller, all information regarding the company’s tech should be shared and discussed in a secure data room.

Not only will this safeguard the seller’s sensitive data, it will help to facilitate a sale by creating trust and demonstrating a buyer’s seriousness and respect for the target firm.

Ensuring tech due diligence doesn’t derail a sale

Due diligence is, of course, not a one-way street. While it is largely conducted on the buyer’s side, there is plenty that a seller can do to ensure that tech due diligence proceeds smoothly and, crucially, doesn’t derail a potential sale.

Firstly, prior to beginning the sales process, a seller should conduct a thorough audit of their own tech (essentially mirroring a buyer’s due diligence). This will flag up any issues that maybe hadn’t already been identified, preventing any embarrassing and unexpected revelations when it comes to the sale.

This will provide a thorough overview and understanding of the company’s tech, which will be valuable in answering any questions the buyer has. It will also be useful in helping to identify areas where tech can be upgraded prior to a sale and in coming up with a realistic and, more importantly, attainable valuation.

If a seller is committed to proceeding with a high valuation for their company in spite of identifying tech issues, then they should be prepared to invest in upgrading their tech prior to putting the business on the market.

On the other hand, if a seller is unwilling or unable to invest in their tech prior to a sale, then any shortcomings should be reflected in their valuation. It will also be important to be realistic and forthcoming about any technical issues that can’t be resolved prior to the sale in order to build trust and facilitate a good relationship with potential buyers.

Finally, a crucial component of all due diligence on the seller’s side, will be being organised and having any paperwork relating to the company’s tech ready for inspection when the buyer needs it. Disorganisation, after all, remains a major factor in many failed due diligence processes.


Tech due diligence has long been a vital component of the acquisition process. However, in a world where huge numbers of employees are logging onto company systems from home broadband connections on personal devices, and growing numbers of companies are migrating to the cloud, making sure a company’s tech is secure and up-to-date has perhaps never been more crucial.

Insufficient due diligence on a target company’s tech can quickly land a buyer in a situation where they have overpaid for a company that they then need to plough time and more money into upgrading. This can not only delay plans for growth, but potentially lead to unexpected financial problems.

A proper tech due diligence process can help to generate a realistic, accurate valuation, eliminate the likelihood of any nasty post-acquisition surprises and help buyers know exactly where the business stands when they take over. From that position, the new owner can quickly start preparing the company for their growth plans.

Read more:
The due diligence process for business buyers
Due diligence: a business seller’s perspective
Due diligence tips
Due diligence is essential during times of financial crisis
Due diligence in a recession

Also read: Intellectual Property in M&A – The key due diligence considerations

Share this article

Latest Businesses for Sale

---

---

---

View more businesses for sale