Free template
A free technology due diligence checklist in Word covering architecture, applications, security, data, people, cost and the integration or separation risks that change a deal.
By Christopher Fagan, Managing Partner, PEF Consulting Partners
A note before you start
Technology due diligence is not an IT audit. The question is what the technology means for the deal: what it will cost to run, fix, integrate or separate, and what could stop the value creation plan. Ask for evidence rather than assurances, talk to the people who run the systems, and price the findings so they can go into the model.
Christopher Fagan, Managing Partner, PEF Consulting Partners
Send the information request early and agree how the data room will be organised. Work through the checklist using management interviews and evidence, and rate each area red, amber or green. Turn every material finding into a cost, a risk to the plan or a condition, such as a price adjustment, an indemnity or a hundred day action, and agree with the deal team which findings go into the model and the sale and purchase agreement.
[Organisation name] | Version 0.1 | [Date] | Owner: [Name, role]
| Question | Evidence requested | RAG | Finding and deal impact |
|---|---|---|---|
| Is there a technology strategy aligned to the business plan? | Strategy, roadmap, board papers | ||
| Who owns technology decisions and budget? | Organisation chart, governance terms | ||
| Which major programmes are in flight and are they on track? | Programme reports and budgets |
| Question | Evidence requested | RAG | Finding and deal impact |
|---|---|---|---|
| What are the core systems, their versions and support status? | Application inventory and contracts | ||
| Are any systems end of life or heavily customised? | Vendor roadmaps, customisation log | ||
| How are the systems integrated? | Architecture diagrams, interface list |
| Question | Evidence requested | RAG | Finding and deal impact |
|---|---|---|---|
| Where is everything hosted and who runs it? | Hosting contracts, cloud bills | ||
| How resilient is the estate? | Disaster recovery plan, test results, outage log | ||
| Is there technical debt that will need investment? | Backlog, previous audits |
| Question | Evidence requested | RAG | Finding and deal impact |
|---|---|---|---|
| What security certifications and testing are in place? | ISO 27001, Cyber Essentials, penetration tests | ||
| What incidents or breaches have occurred? | Incident log, ICO correspondence | ||
| How is personal data governed? | Records of processing, DPIAs, policies |
| Question | Evidence requested | RAG | Finding and deal impact |
|---|---|---|---|
| How reliable is the core data? | Data quality reports, reconciliations | ||
| Who owns the data and the reporting? | Data ownership model, report catalogue |
| Question | Evidence requested | RAG | Finding and deal impact |
|---|---|---|---|
| Is there key person dependency? | Organisation chart, tenure, contracts | ||
| Which suppliers are critical and on what terms? | Contracts, change of control clauses, renewal dates |
| Question | Evidence requested | RAG | Finding and deal impact |
|---|---|---|---|
| What is the true run cost of technology? | Budgets, actuals, licence schedule | ||
| What investment is needed in the first two years? | Capital plans, backlog |
| Question | Evidence requested | RAG | Finding and deal impact |
|---|---|---|---|
| What would integration or separation involve? | Shared services, transitional services, licence transferability | ||
| What has to work on day one? | Day one plan and dependencies |
Template by PEF Consulting Partners, pefconsultingpartners.co.uk. Free to use and adapt.
Related reading: technology due diligence, operational due diligence, the operational red flags financial due diligence misses, the ESG due diligence checklist.
An assessment of a target company’s technology before a deal: its systems, security, data, people, suppliers and costs, and what they mean for price, risk and the plan after completion.
Usually two to four weeks for a mid market deal, depending on access to management and the quality of the data room.
The terms are often used interchangeably. Technology due diligence tends to mean a wider view that includes product and software platforms as well as internal IT.
End of life core systems, heavy customisation, key person dependency, change of control clauses in critical contracts, weak security, and years of underinvestment hidden in a low IT budget.
If you are weeks from signing and the technology picture is still based on management assurances, a short independent review will either confirm the plan or change the price.