How IT Due Diligence Can Identify Risks in M&A

Jim Hoffman
Author, IT Due Diligence Guide
© Alzhan Development LLC 2018
http://www.itduediligenceguide.com
@jim_hoffman
linkedin.com/in/itduediligence

Due diligence is intended to identify these risks.
“Due diligence” is research and analysis of a
company or organization done in preparation for
a business transaction. *
* Merriam-Webster: https://itdd.us/2jRPlHU

Financial and legal due diligence are almost always
undertaken as part of M&A activity.
IT due diligence is a specific focus on the
technology-related people, products, services, and
resources of an organization, and is not performed
as often and as thoroughly as it should be.

Even when a company is not focused on developing
and selling technology, IT is probably central to
how the business operates. If a company’s email,
website or custom software fails or data is lost,
business may come to a standstill.
If a company IS focused on technology, IT due
diligence is even more important.

Here are some examples of technology-related
risks that buyers should identify before completing
a transaction.

Anti-virus / anti-
malware software
not deployed
A thorough, tested
backup strategy is
not in place
Security not fully
considered when
developing software
35% of web and 99% of mobile applications tested by Hewlett
Packard suffer from common security vulnerabilities.
Hewlett Packard Enterprise
https://itdd.us/2IwHyNZ

Data not encrypted
where required by
law or regulation
Inappropriate use of
cloud providers and
services
Lack of compliance
with anti-spam
regulations
Only 9.4% of cloud providers encrypt the data they store.
McAfee
https://itdd.us/2rGMXqX

Acquirer and target
use different
technology stacks
Dissimilar software
development
methodologies
Software
development team
cultures clash
71% of organizations utilize an Agile software development methodology.
Capterra
https://itdd.us/2IgfWsY

Product or service
cannot handle
significant traffic
increase
System not
implemented using
industry-standard
hosting
Peak demand
periods impact
system requirements
and maintenance
Q4 2017 cloud market share:
Amazon: 62% | Microsoft: 20% | Google: 12% | Other: 6%
CNBC
https://itdd.us/2rE8ykR

Unsupported
operating systems
and other software
Expensive in-house
hosting solutions are
utilized
Improper disposal of
old computers and
other devices
6% of desktop computers are still using Windows XP even though the security
vulnerabilities have been well-documented for years.
NET MARKETSHARE
https://itdd.us/2KTkozD

Unlicensed software
in use
No system in place
to track software
licensing
Potential
whistleblower
concerns
39 percent of software installed on PCs around the world
in 2015 was not properly licensed.
BSA | The Software Alliance
https://itdd.us/2wB1vOT

Software not
developed in a
maintainable way
Open source
licensing
requirements not
considered
Uncertain ownership
of contracted
development
There are more than 80 types of open source software licenses with varying
restrictions and requirements imposed on users.
Open Source Initiative
https://itdd.us/2IhZIzt

Long-term
telecommunication
contracts
Incompatible email
or phone systems
Key employees are
potential flight risks
Business telecom contracts can contain early termination fees as high as 75-
100% of the remaining monthly charges on the contract term.
BillFixers
https://itdd.us/2IBBlQS

They can cost the acquirer money if not detected
prior to closing the transaction, projected cost-
savings may not be realized, and they may mean
that the companies cannot be integrated as
intended.

Although there are many good reasons to conduct
IT due diligence, let’s explore why it’s not part of
every M&A transaction.

Even a transaction that is small from a purchase
price standpoint may rely substantially on
technology to run the business.

The price paid for thorough IT due diligence can
often identify risks that save the acquirer many
times the cost.

An IT due diligence expert may not be needed to
get the process started.

The IT Due Diligence Guide is designed to help
both technical and non-technical members of a
deal team ask questions related to the target
company’s IT systems and resources and how to
understand the answers they receive.

Identify the IT risks in your merger or acquisition,
and make an informed investment.
Learn more at itduediligenceguide.com

How IT Due Diligence Can Identify Risks in M&A

Recommended

Recommended

More Related Content

What's hot

What's hot (18)

Similar to How IT Due Diligence Can Identify Risks in M&A

Similar to How IT Due Diligence Can Identify Risks in M&A (20)

Recently uploaded

Recently uploaded (20)

How IT Due Diligence Can Identify Risks in M&A