IT Due Diligence

IT due diligence reviews the IT systems, software, and cyber security of a target company. It examines whether the technology is fit for the future and where security or cost risks may exist. This review is especially critical for digital business models. Its scope covers the system landscape with age, maintenance status and dependence on individual vendors. It also examines the licensing position, including whether sufficient licences exist and whether change of control clauses require vendor consent. Further topics are the state of the infrastructure and any investment backlog, resilience with backup and recovery arrangements, and information security with access rights, logging and the history of security incidents.

For software companies the product itself is added: structure and maintainability of the source code, technical debt, test coverage, dependence on key developers, and the use of open source libraries whose licence terms may require disclosure of the company's own code. Data protection questions feed directly into valuation, because breaches of the General Data Protection Regulation can attract substantial fines and because unlawfully collected data cannot be used commercially. In carve-outs it must additionally be clarified which systems remain with the seller and through which transitional arrangements they will be provided for a limited period, since building a stand-alone landscape regularly involves considerable cost.

The findings feed into price, warranties and the post-acquisition investment plan. Distinguishing necessary from desirable measures is essential in assessing the findings, because otherwise the review reports an investment requirement reflecting the buyer's preferences rather than the company's condition. Dependence on individuals in IT also deserves attention, because in smaller companies a single person often maintains the systems and their departure represents a substantial risk that money can only partly offset.

Note: This explanation is for general information only and does not constitute legal advice. The legal position depends on the individual case and may change with new legislation or case law. For a binding assessment, please consult a qualified lawyer.