IT is part of the company’s value
M&A due diligence routinely covers finance, legal, commercial and tax matters. Technology often determines whether a product can continue to evolve, the business can scale, the target can be integrated or planned synergies can be achieved. A superficial inventory of systems does not provide that answer. It is not enough to know which applications are in use; the buyer needs to understand how they depend on one another, who can change them and what their continued operation and development will cost.
A modern company depends on a combination of proprietary software, third-party services, data, internal and external teams and its operating environment. That environment may be on-premise, cloud or hybrid. We assess these parts as one system, including their dependencies and capacity for change. The scope is tailored to the deal type, investment thesis, available time and whether the plan is standalone growth, integration into a group or a carve-out.
Technology, product and architecture
We examine key systems, architecture, integrations, source code, technical debt, documentation, the data layer and third-party dependencies. We do more than search for defects. We determine whether the technology supports the business model, growth plan and investment thesis.
For proprietary software, we also examine the ability to release safely, testability, code ownership and critical integration points. In product companies, we test whether the architecture can support the growth plan and whether the technology roadmap is consistent with commercial priorities, team capacity and expected investment.
Teams, people and delivery capability
System quality says little without the people who build and operate it. We assess team structure and seniority, leadership quality, key-person risk, replaceability, vendor dependency and the ability to attract and retain the capabilities the company needs.
We also look at how product, engineering, operations and business teams work together. This often makes the difference between a company that can execute its plan and one that merely owns interesting technology.
The result is a view of actual capacity and critical gaps: which roles must be retained, where accountability is missing, what depends on a single person and which capabilities will be required for growth or integration. For external teams, we also assess contracts, knowledge transfer and the ability to proceed without unmanaged vendor lock-in.
Processes, security and the operating environment
We assess engineering and release processes, prioritisation, testing, security, business continuity, licensing, data protection and relevant certifications. For infrastructure we consider not only its current state, but also operating cost, scalability, contractual commitments and risks related to on-premise data centres, cloud and hybrid environments.
Security is assessed in the context of the company’s size, data sensitivity and sector. In addition to technical controls, we examine actual incident readiness, recovery capability, accountability and whether stated processes work in practice. For operations, we connect technical risk with expected investment, contractual commitments and the time needed to make a change.
Post-merger integration starts during due diligence
When the target is expected to be integrated after the deal, we incorporate the integration perspective into due diligence from the outset. Findings then become more than a risk list: they provide a basis for deciding what to retain, what to consolidate and what to change. At a high level, we define the target state, key dependencies, decision rights and sequence of work.
Before closing, we identify the conditions for a safe Day 1, continuity of critical services, team roles and capacity, critical vendors and potential TSA or carve-out dependencies. We also identify where a shared target operating model, common governance or rapid stabilisation measures would create value.
For the first 100 days, we prepare a high-level roadmap covering applications, data, infrastructure, cloud, security and the technology organisation. For each stream, we distinguish mandatory action, quick improvements, longer-term transformation and the assumptions behind planned synergies. After closing, we can continue with high-level integration leadership and challenge, tracking key decisions, risks and alignment with commercial objectives.
An output designed for decisions
The result is not an unprioritised technical list. We provide a clear view of material risks, impact and likelihood, expected investment and recommended actions before signing and after closing. Where useful, we also prepare input for negotiations, transaction documentation, a high-level integration plan, carve-out or the first 100 days.
We present the output in a form that works for an investment committee, board and technology management. Material issues are clearly separated from normal technical debt, assumptions and open questions are explicit, and recommendations are prioritised by impact, urgency and implementation effort.