Before you sign, you’ll know what the target’s IT will really cost: what needs fixing, what it takes to separate or integrate, and what that should mean for the price. Clear findings your deal team can negotiate with, in as little as 3–5 days.
Before the LOI through signing
3–5 days to 8 weeks, by scope
Findings, cost to fix, IT scorecard and roadmap
Deal teams, operating partners and corporate acquirers
Diligence
Day 1
TSA exit
Integration
IT due diligence is the review of a target company’s technology, security and IT organization before a deal closes. In M&A, it tells the buyer what the systems will cost to run, fix, separate or integrate, which risks belong in the price or the purchase agreement, and where technology can add value after close.
It rarely stops a deal. Done well, it changes the terms: a purchase price adjustment, better transition services, a stronger bid for the right target and a 100-day plan built on facts rather than the CIM.
Can the systems support the growth plan, and how resilient are they?
What will it cost to combine the two environments and migrate the data?
How long, and how much, to stand up an independent environment?
Is the architecture built to scale, or held back by technical debt?
Which vulnerabilities and compliance gaps need fixing before and after close?
Will closing IT gaps now lift the sale price?
Five lenses on the target, evaluated together rather than in silos, so a finding in one shows up in the cost and the plan for the others.
Applications and infrastructure
Security, compliance and regulatory
Business continuity and disaster recovery
IT organization and governance
Order-to-cash, procure-to-pay and record-to-report
Are the systems scalable and extensible?
Is the IT organization built for growth?
Information security program and policies
Application security and DevSecOps
Cloud and physical security
Vulnerability and penetration testing
Regulatory and compliance adherence
What is the real security posture?
Is anyone governing it?
Stack and architecture
Infrastructure and scalability
Software development lifecycle
Software code review
Continuity and the engineering team
Is the architecture extensible and secure?
Will the stack scale with the business?
Cost reduction and margin expansion
Sourcing and procurement
Sales, inventory and operations planning
Site layout and flow
Leadership and Lean maturity
Is the supply chain efficient?
Are inventory and COGS optimized?
AI use and data leakage risk
AI policy and governance
Data readiness for the investment thesis
Dependence on third-party AI providers
Where is AI already creating risk?
Where could it create value?
AI readiness is part of every lens: AI use and data leakage risk, AI governance, data readiness for the thesis, and how much the business depends on third-party AI providers.
One methodology, scaled to the decision in front of you. Every tier ends in findings the deal team can act on, with a clear view of what to fix first and what it will cost.
3–5 days
CIM and management presentation review
A one-hour management interview
Red flags, plus a separation and stand-up spend summary
3–5 days
Data room review and 1–2 hours of interviews
Spend summary and prioritization
IT scorecard and roadmap
2–3 weeks
3–5 hours of stakeholder interviews
IT benchmarking and spend summary
Prioritized scorecard and roadmap
4–8 weeks
Everything in a full-scope review
Separation and TSA exit plan
Synergy savings and bridge report
One repeatable sequence, refined across 300+ diligences and scaled to the tier you choose.
Diligence request list
Sent on day one for the target to complete, then updated from the data room.
Kickoff call
Optional: review the request list, set the agenda and book interviews.
Pre-engagement review
CIM, management presentation and data room analysis.
Stakeholder interviews
In-depth sessions with the key IT people on infrastructure, process and compliance.
Interview debrief
Red flags and post-close risks, straight to the deal team.
IT and security assessment
Applications, infrastructure, security, compliance and continuity.
Draft report
An executive summary or a full report of findings and recommendations.
Read-out
Findings and actionable recommendations, presented to the deal team.
Rep and warranty
We join the rep and warranty call to answer IT-related concerns.
Findings only matter if they change the deal or the plan. Here are three times they did, and what a sponsor said afterwards.
Diligence found that a $150M firm serving top-20 U.S. banks had no real security program. After close, we built one to FFIEC banking standards, and the company passed its banking audit with zero findings.
Read the case study →
A $500M division carved out of an $8B public company, with eight facilities on different ERPs and the CIO gone a week before close. We centralized the ERP within three months and stabilized IT.
Read the case study →
A $300M division carved out of a $6B parent faced a 12-month TSA. A rapid IT assessment right-sized the infrastructure and ERP, and the business was running on its own systems in five months.
Read the case study →A very practical assessment of systems, procedures and shortcomings. Conducted 100% remotely with clear communication, and completed a full report on a very tight deadline.
Principal, PE firm with $20B AUMSomething we haven’t covered? A partner can answer it on a short call.
IT due diligence is the review of a target’s technology before a deal closes: its applications and infrastructure, security and compliance, IT organization, and the core processes that run on them. The output is a view of what the IT will cost to run, fix, separate or integrate, and what that means for the deal.
For a buyer, the point is the terms. Diligence findings can support a purchase price adjustment, better transition services agreement (TSA) terms and a realistic 100-day plan. See how it fits with the rest of our M&A IT services.
It depends on the decision. A red-flag review or a confirmatory review takes three to five days. A full-scope review takes two to three weeks, and a carve-out diligence four to eight weeks, because it adds the separation and TSA exit plan.
A red-flag review can run before the LOI, using the CIM, the management presentation and a one-hour interview. Starting early leaves time to negotiate on what diligence finds, rather than discovering it after close.
Every report includes findings and recommendations, and a spend summary covering what it will cost to fix, separate or stand up the IT. Confirmatory and full-scope reviews add an IT scorecard and a prioritized roadmap; a full-scope review adds IT benchmarking.
A carve-out diligence also includes the separation and TSA exit plan and a synergy savings and bridge report. Findings are presented to the deal team in a read-out, and we join the rep and warranty call.
IT due diligence for private equity starts from the investment thesis, not a technology checklist. The questions are whether the systems can carry the growth plan, what the deal model should assume for IT spend, what belongs in the price or the TSA, and what goes in the 100-day plan.
Our IT due diligence services are run by senior operators who have done the work after close, in carve-outs, integrations and as interim CIOs, so the findings come with a realistic cost and plan attached.
Yes. Security is one of our five lenses: the information security program and policies, application and cloud security, vulnerability and penetration testing, and regulatory and compliance adherence.
When security is central to the deal, for example a target handling health, financial or defense data, a dedicated cybersecurity due diligence goes further, including cyber-insurance readiness.
The findings become the plan. We can run the IT carve-out and TSA exit, lead the M&A IT integration for an add-on, or stay on to run IT as the company’s managed IT provider.
It’s an option, not a condition. Either way, what we learned in diligence isn’t lost between signing and Day 1.
Security posture, compliance gaps and cyber-insurance exposure, priced before you sign.
Whether the ERP can carry the investment thesis, before signing or after close.
Separation design, TSA scope and governance, Day 1 cutover and an early exit from the TSA.
Day 1 readiness, then moving the add-on onto the platform’s systems.
One office running every workstream for carve-outs, ERP integrations and other transactions.
AI readiness, maturity, governance and training, tied to EBITDA.
Start with a red-flag review: three to five days, a clear view of the IT risks, and what they’re likely to cost to fix.
