IT Due Diligence: What the Company Runs, and What Transfers at Close

Networks, Devices and the Tools Staff Use Every Day

Networks connect offices, plants, warehouses and remote staff to the systems they use. Ask for the network diagram, the list of sites and the circuits that serve them, how remote access works, and who runs all of it: the company's own team or an outside provider. The finding to look for is the single point of failure: one internet connection into a site that cannot stop, one firewall only one person can configure, one engineer who holds the routing in their head.

End-user IT is the part of the estate most employees see. Laptops and phones have a refresh cycle, and a company preparing for sale may have let it slip, which shows up as an aging fleet and a deferred cost. Device management records show whether those devices can be secured and wiped, and whether they are owned or leased.

Email, file storage and collaboration tools sit in a tenant, and someone owns that tenant. Establish who. In a business sold out of a larger group, the mailboxes, files and accounts of the people being sold often live in the parent's tenant, and moving them is a project with a date, not a formality. Telecoms contracts belong on the list as well. They tend to be long, renew automatically and spread across sites, and they are often signed outside IT, which makes them easy to miss.

Business Applications and Licenses: What Survives a Change of Control

The application estate is usually where the money and the dependencies sit: the ERP system that runs finance and operations, the CRM, payroll and HR, industry systems, and the software subscriptions that accumulate around them. For each critical application, the questions are who holds the license, on what terms, and whether those terms survive the deal.

Three checks do most of the work:

• Entitlement against use. Compare the licenses bought with the users and installations that exist. Use beyond the entitlement is an exposure a vendor audit can turn into a bill.
• Transfer terms. Read the assignment and change-of-control clauses. Published legal commentary warns that anti-assignment, change-of-control and deemed-assignment provisions, if overlooked, can derail a buyer's integration strategy or force costly renegotiation, and that the legal form of the transaction often decides whether a consent is triggered. Whether a share purchase or a merger counts as an assignment under a particular contract is a question for counsel.
• Scope of use. A license limited to the licensee's internal operations, or to named entities, may not stretch to a business the buyer combines with another, or to one the seller is carving out.

The output is a list of every critical license with its consent requirement, the party responsible for asking, and the cost or disruption if the vendor says no. Consents take time to obtain, so the list has to exist well before signing.

Identity and Access: Who Holds the Keys

Whoever controls identity controls the estate. Ask how people sign in: the directory, single sign-on, multi-factor authentication, and the administrator accounts that sit above all of it. Then list who holds privileged access, because the answer is rarely only current employees. It often includes a managed service provider, a contractor who set up the network years ago, the seller's group IT team, and accounts that belonged to people who have since left.

The joiner and leaver process is the test that matters most. Take a sample of recent departures and check that their access ended when they did. Take a sample of administrator accounts and check that each belongs to a named person who still needs it. Gaps here are a control finding as much as a security one, and they become urgent at close, when the buyer takes on responsibility for whoever can still get in.

Two items are easy to forget and painful to recover: control of the company's domain names and DNS, and the credentials to every cloud and software account in the inventory. Both should sit in the company's name, and in more than one person's hands, before the deal closes. The deeper review of security posture, from penetration tests to incident history, belongs to cybersecurity due diligence.

IT Operations and Recovery: Records, Not Assurances

How the estate is run shows up in the records IT operations keeps: the service desk queue, incident and problem records, change approvals and maintenance logs. Ask for them as raw exports covering a recent period. The age of open tickets shows whether the team keeps up. Repeated incidents on the same system show where the estate is fragile. A change process that exists on paper but leaves no records does not exist.

Backup and disaster recovery deserve their own line, because a company can run for years without needing either, and the buyer inherits the day it does. NIST's contingency planning guide frames the work as evaluating information systems and operations to determine contingency planning requirements and priorities. In diligence that becomes four questions:

• Which systems matter most, and how long can the business run without each one?
• What is backed up, how often, and where do the copies live?
• When was a restore last tested, and did it work?
• What happened in the last real outage, and what changed afterwards?

A company that has never tested a restore does not know whether it can recover. That is a finding with a cost attached: the testing itself, and whatever the testing reveals.

IT Contracts and Spend: Where Most of the Risk Is Written Down

Most of an IT estate is bought rather than built, so most of its risk sits in contracts. Build a register of every material IT contract: hosting, software, telecoms, support, outsourcing and equipment leases. For each, record the term, the renewal and notice dates, any automatic renewal, minimum commitments, termination charges, price increases at renewal, change-of-control terms, and what happens to the company's data when the contract ends.

IT spend needs the same scrutiny as any cost line that drives the price. Split it into running the estate and changing it, and follow the trend. A business preparing for sale can hold IT spend down by deferring hardware refreshes, license true-ups and upgrades, which flatters the earnings the price is built on. Guidance for private equity buyers from one of the large accounting firms makes the same point: addressing historical underinvestment in IT on the sell side can reveal overlooked expenses. Those expenses belong in the quality of earnings work and the forecast, not in the first budget after close.

Look at concentration too. A single provider that hosts, supports and secures the whole estate is convenient, and it is also the party the buyer can least afford to lose.

The IT Team and the Providers Behind It

The people who run the estate are part of it. Map the IT team: roles, tenure, which people are employees and which are contractors, and what each person alone knows how to do. A small IT function often rests on one or two people who hold the passwords, the network design and the vendor relationships. That is key-person risk, and it needs a retention or knowledge-transfer plan before close, not after a resignation.

Many companies run some or all of IT through a managed service provider. Read that contract with the care given to any critical license. Guidance from CISA and its international partners notes that these providers usually need trusted network connectivity and privileged access to their customers' systems, which makes the provider part of the estate the buyer is acquiring. The questions follow from that:

• What exactly the provider does, against which service levels, and how performance is measured.
• Whether the contract survives a change of control, and what help the provider owes on exit.
• Who owns the documentation, the configurations and the credentials the provider holds.
• Whether the provider's accounts are named, limited and reviewed like everyone else's.

A provider that holds the only copy of the network design holds a strong hand in any renegotiation after close.

Carve-Outs: Separation and Transition Services

When the business being bought is a division of a larger group, IT due diligence changes shape. The business has rarely run its own estate. Its people sign in to the parent's directory, its finance runs on the parent's ERP system, and its contracts are often the parent's contracts, shared with businesses that are not part of the sale. The questions become which systems, data and contracts can transfer, which must be replaced, and how the business keeps running in between.

The usual bridge is a transition services agreement, under which the seller keeps providing services such as IT for a period after closing while the buyer builds or buys its own. Licensing reaches into it. Published legal commentary notes that a seller's software may be licensed for internal use only, and that unless the license allows use to serve divested businesses, the seller may need the licensor's consent before it can provide the application to the business it sold.

For the deal team, that means a separation plan built during diligence rather than after signing:

• Every shared system and contract, with its route to separation: transfer, replace, or provide under the agreement.
• The services to be provided, for how long, and on what exit criteria, with extension terms priced before signing.
• The data that has to be separated, and who checks that it was.
• The stand-alone running cost of the estate, which the forecast needs and the parent's cost allocations rarely show.

Where Each Finding Lands: The Price, the Contract or the First Hundred Days

An IT finding is only useful once it lands somewhere, and each one belongs in one of three places:

• The price. Quantifiable costs, such as deferred refreshes, license shortfalls, a separation program or the stand-alone cost of a carved-out estate, adjust the price or the earnings it is built on.
• The purchase agreement. Exposures that cannot be sized yet go to counsel: vendor consents as closing conditions, specific protection against a license audit, and the terms of any transition services agreement.
• The integration plan. Everything about how the estate will be run becomes work in the first hundred days, each item with an owner and a date. Integration readiness is settled here: whether the identity, email and finance systems can join the buyer's, stand alone, or need replacing first.

Two pages take the list further. The technology due diligence checklist sets out the product-side questions, each with the system that answers it, and the due diligence checklist maps every workstream a deal runs. For where IT sits among the other workstreams, and how the structure of the deal sets its scope, see M&A due diligence.