- Blog
M&A’s Hidden Costs: IT Due Diligence and Avoiding Post-Deal Surprises
- Tom Allen
SHARE:
In mergers and acquisitions (M&A), IT due diligence can be the difference between a smooth, value-enhancing transition and a painful, costly ordeal. With technology underpinning almost every aspect of modern business—from e-commerce platforms and customer databases to cloud infrastructure and artificial intelligence—examining a target’s IT environment has never been more critical. Thorough due diligence should not only reveal potential “deal breakers” that might reduce the transaction value but also highlight opportunities to harness new technologies for future growth.
1. Ability to Scale and Support Growth
A core reason for acquiring another company often lies in tapping new markets, products, or technologies that can drive profitability. To fulfil that promise, the target’s IT environment must be able to handle increased demand and business complexity. When the acquired systems buckle under a higher transaction load or additional user traffic, operational disruptions and emergency spend can overshadow anticipated synergies.
Key Considerations
- Infrastructure Capacity: Determine whether the target’s infrastructure—servers, cloud resources, or network bandwidth—can easily scale. If they rely on on-premises hardware that’s already at maximum load, urgent upgrades may be necessary post-deal.
- Application Scalability: Review how core applications (such as e-commerce platforms or data analytics solutions) perform under stress. Is there evidence of performance bottlenecks at peak times?
- Automation and Process Maturity: Manual processes or heavy reliance on ad hoc scripts can slow expansion. A more automated setup (for deployment, testing, or customer onboarding) is generally more robust.
By identifying scalability gaps in due diligence, acquirers can estimate future costs and factor them into the deal structure.
2. Ability to Integrate
Failed IT integration is a common culprit behind underwhelming M&A results. When combining two companies, leadership needs clarity on which systems will remain, which will be replaced, and how data flows will be merged. Without a careful plan, overlapping technologies can cause confusion and inflate operational costs well beyond initial estimates.
Key Considerations
- Integration Strategy: Determine early on if the acquirer will impose its own systems (ERP, CRM, etc.) or retain the target’s. Both scenarios demand a clear roadmap and budget to manage data migration and user training.
- Critical Day One Processes: Certain functions—email, websites, or finance systems—may need to be unified immediately. Identify these priorities and estimate the cost and time required.
- Existing Customisations: If the target heavily customised platforms, that can complicate standardisation. Factor in potential re-engineering or data mapping challenges.
Robust integration planning, underpinned by proper due diligence, helps avoid expensive delays and ensures the combined entity reaps the intended benefits.
3. Technology Infrastructure and Cloud Architecture
Infrastructure forms the backbone of IT operations. This covers data centres, network devices, storage solutions, and any cloud services the target depends on. Many modern businesses operate extensively in the cloud, which simplifies certain scalability and maintenance issues but can raise questions around cost and vendor lock-in.
Key Considerations
- On-Premises vs. Cloud: If the target still relies on a physical data centre, consider energy costs, hardware age, and redundancy provisions. Migrating legacy systems to the cloud can be expensive and time-consuming.
- Cloud Contracts: For cloud-hosted environments, review spending commitments, subscription tiers, and termination clauses. Check if the target uses a multi-cloud approach or is reliant on a single provider.
- Network Resilience: Assess connectivity between the target’s offices and cloud regions. If the company is distributed internationally, their network architecture should support secure and efficient data flows.
By gaining insight into the infrastructure’s age, capacity, and associated costs, acquirers can avoid unwelcome surprises that affect both operating expenses and capital expenditure.
4. Software Assets and Intellectual Property
A target’s software portfolio, including enterprise systems and any proprietary technology, can be a significant source of value—or a tangled web of licensing problems. Clarifying what the acquirer will actually own or license after closing is essential, especially if key revenue streams hinge on that technology.
Key Considerations
- Licensing Compliance: Confirm the target is properly licensed for all software (ERP, CRM, databases, productivity tools) and running supported versions. Unlicensed or obsolete software can expose the acquirer to legal and security risks.
- Proprietary Software: If the target’s intellectual property (IP) is a primary value driver—like a unique algorithm or SaaS platform—ensure the code and patents fully belong to them. Verify that contractors or third-party developers have legally assigned all rights.
- Quality and Maintenance: Where possible, conduct a high-level code or architecture review. Poorly structured codebases or a lack of documentation can lead to inflated maintenance costs and integration challenges.
Understanding the nature and stability of software assets ensures the acquirer can either integrate or commercialise the target’s technology without unexpected hurdles.
5. Third-Party Dependencies and Open-Source Software
Modern IT stacks often rely on multiple third-party components and open-source libraries. While this modular approach can accelerate development, it can also introduce significant licensing, security, and vendor risks if not carefully managed.
Key Considerations
- Third-Party Service Providers: Collect a list of core service contracts—managed IT providers, hosting services, API partners. Check contract terms, renewal dates, and whether they allow transfer upon a change of control.
- Open-Source License Compliance: Many software products incorporate open-source libraries. Breaching licences (e.g., copying GPL code into a proprietary system without meeting obligations) can lead to legal complications. Additionally, unpatched open-source components are a prime target for cyberattacks.
- Vendor Stability: If the target uses a niche vendor for a critical function, that vendor’s financial or operational issues could become your problem.
Diligence here might involve specialised audits (e.g., scanning codebases for open-source usage). Addressing any red flags pre-closing helps avoid costly disruptions later.
6. Cybersecurity and IT Resilience
Cyber threats have exploded in recent years, making cybersecurity one of the most urgent parts of IT due diligence. A serious vulnerability or prior breach can derail an acquisition or slash deal value, as seen in some high-profile cases where undisclosed incidents emerged mid-transaction.
Key Considerations
- Security Governance: Evaluate whether the target has security leadership (e.g., a CISO), strong policies, and adherence to recognised standards (ISO 27001, NIST CSF).
- Previous Breaches: Ask about historical attacks or data leaks. How quickly were they disclosed and remediated? A track record of unreported or poorly handled incidents is a red flag.
- Technical Vulnerabilities: Check if systems are regularly patched and if vulnerability scans or penetration tests are carried out. Pay special attention to legacy or end-of-life software that attackers commonly exploit.
- Incident Response and Disaster Recovery: If a severe breach or system failure occurred post-acquisition, how quickly could operations resume? Does the target maintain off-site backups and robust recovery plans?
Because cyber incidents can result in fines, reputational harm, and operational downtime, a thorough security review is a non-negotiable step for safeguarding deal value.
7. Data Privacy and Regulatory Compliance
Data privacy regulation—led by the EU’s General Data Protection Regulation (GDPR)—has transformed the risk profile of handling personal information. Non-compliance can incur eye-watering fines or cause lasting harm to brand reputation. In an M&A deal, undisclosed data protection liabilities may be transferred to the acquirer.
Key Considerations
- Relevant Laws: Identify whether the target must comply with GDPR, CCPA, or similar global standards. Many companies operate across multiple jurisdictions, making compliance a multilayered challenge.
- Consent and Data Handling: Evaluate how the target collects, stores, and processes personal data. Request records of consent or relevant documentation showing lawful data use.
- Breach History: Determine if the company has experienced data breaches. If so, how did they respond, and were authorities and affected individuals notified correctly?
- Legal Agreements and Documentation: Look for data protection impact assessments (DPIAs), data processing agreements, and other evidence of a mature compliance framework.
If gaps appear in the target’s data privacy posture, the acquirer should address them promptly or adjust the deal to account for remedial actions.
8. Artificial Intelligence and Automation
As AI and automation reshape entire industries, many M&A transactions hinge on acquiring advanced technology or data-driven capabilities. However, AI also introduces unique concerns like algorithmic bias, opaque decision-making, and intellectual property questions around training data.
Key Considerations
- AI Ownership and Data Rights: Confirm the target has the right to use all data sets that train its AI models. If these are third-party or user-generated datasets, ensure legal transfers are permitted.
- Model Quality and Bias: Investigate how the AI is validated, monitored, and updated. A flawed or biased model can create reputational damage and legal challenges.
- Regulatory Environment: With new AI regulations on the horizon (such as the EU’s proposed AI Act), the acquirer should understand if the target’s tools or processes might face scrutiny.
- Automation Robustness: If the target relies on automation in production or customer service, confirm those workflows are well-documented and can be maintained by the combined entity.
A methodical review of AI assets can prevent unexpected liabilities, especially when the target’s main value proposition resides in proprietary machine learning algorithms or advanced automation features.
9. ESG and Sustainability Considerations in IT
Environmental, Social, and Governance (ESG) factors have become central to M&A, as investors, regulators, and customers demand more responsible business practices. Although ESG extends well beyond IT, the technology function can significantly affect carbon footprint, data ethics, and broader corporate governance.
Key Considerations
- Energy Usage and Data Centres: On-premises servers can consume substantial energy. Check whether the target uses renewable energy or invests in efficient cooling systems. Migrating to greener cloud platforms may offer both cost and environmental benefits.
- Electronic Waste (E-Waste): How does the company dispose of outdated hardware? Irresponsible disposal can create environmental damage and potential regulatory issues.
- Ethical AI: If the target applies AI for sensitive purposes—hiring, lending, or medical diagnostics—ensure there are policies to prevent bias and protect stakeholder interests.
- Governance Alignment: Confirm that senior leaders regularly monitor IT risks (including cybersecurity and data privacy). If the target has established ESG goals, see if IT is integrated into those initiatives.
By checking these aspects, acquirers can identify sustainability gaps, align them with their own commitments, and potentially uncover cost savings through greener IT approaches.
10. IT Operating Budget and Future Investments
A historical and forward-looking review of the target’s IT budget reveals how well (or poorly) the business aligns technology expenditure with strategic goals. Underinvestment can mask large future expenses, while overspending might point to inefficiencies or neglected cost-optimisation measures.
Key Considerations
- Historic Expenditure Breakdown: Examine hardware, software licences, cloud usage, and external support costs. Any unexplained recurring fees or spikes deserve closer scrutiny.
- Planned Capital Expenditures: Is the target preparing a major ERP replacement or data migration? Factor that into the overall deal cost.
- Spend vs. Industry Benchmarks: Comparing the target’s IT spend (as a percentage of revenue) to sector averages can show whether they’ve been cutting corners or investing wisely.
- Contractual Obligations: Some costs, like long-term leases or subscription agreements, might be locked in. Verify if the target can terminate or renegotiate these contracts after closing.
Understanding the target’s current and projected IT spend lets the acquirer anticipate integration costs, plan system upgrades, and determine realistic synergy targets.
Takeaway
IT due diligence shapes the trajectory of an M&A deal—spotlighting critical risks, unveiling hidden costs, and clarifying whether the target’s technology truly supports post-deal growth. By scrutinising scalability, integration paths, cloud infrastructure, licensing, cybersecurity, data privacy, ESG alignment, and emerging trends like AI, acquirers can protect themselves from unpleasant surprises and set themselves up for success.
In today’s high-stakes environment, it’s no longer enough to take a cursory look at a target’s servers or software licences. A holistic approach to IT due diligence is essential: one that accounts for the technical, financial, legal, and ethical dimensions of technology. Once this process is complete, the acquirer should have a firm grasp of the target’s IT strengths, weaknesses, and investment needs, as well as a roadmap for integrating or upgrading systems without derailing the deal’s overall strategy.
Ultimately, the main goal is to avoid undervaluing or overvaluing a target because of undiscovered IT deficiencies—or missing out on untapped opportunities for innovation. With a diligent, forward-looking approach, M&A teams and private equity professionals can confidently assess technology risks, capitalise on the target’s unique capabilities, and build a stronger, tech-enabled business after closing. That level of preparation is precisely why IT due diligence has become a make-or-break element in modern M&A transactions.
TAGS:
Stay up to date with M&A news!
Subscribe to our newsletter
