IT Due Diligence for Mergers & Acquisitions: What to Check Before You Sign

When a small business changes hands, the diligence team crawls through the financials, the contracts, and the customer list — and then everyone shakes hands, and the buyer discovers the “IT infrastructure” is a 2016 server under a desk, the software licenses are in the seller’s brother’s name, and the one person who knows the passwords gave notice on closing day. Technology surprises rarely kill small deals; they just quietly reprice them, after signing, at the buyer’s expense. An IT diligence pass costs a few days. Here’s what it looks at.

What you’re actually buying

Start with the unglamorous inventory: every computer, server, and network device with its age; every software subscription with its cost and renewal date; who the vendors are; and — critically — who owns the accounts. Domain name, website, Microsoft 365 tenant, line-of-business software: registered to the company, or to the founder’s personal email? Untangling personal-name ownership after closing ranges from awkward to briefly business-stopping, and it’s a one-line fix in the purchase agreement if you catch it now.

Then age the assets honestly. A fleet of five-year-old machines and an out-of-warranty server isn’t a dealbreaker — it’s a six-figure line item the seller’s price didn’t mention, arriving in your first eighteen months. Hardware ages on knowable schedules; read them before you price the deal, not after.

The liabilities that don’t appear on a balance sheet

Security debt transfers with the keys. You’re acquiring the target’s security history, including the parts nobody knows about yet. Ask directly and get it in writing: past incidents and breaches, whether MFA is actually deployed, the state of the backups and when a restore was last tested, what the cyber insurance application attested versus what’s true. A company with no MFA, untested backups, and staff who’ve never seen phishing training is carrying risk you’ll inherit at the worst possible moment — integrations are noisy, and attackers read acquisition announcements too. Payment-fraud attempts spike around deals precisely because “new procedures, unfamiliar names, urgent wires” is the business email compromise scenario, pre-built.

Compliance follows the data. If the target holds health records, card data, or consumer financial information, its regulatory obligations become yours at closing — including any gap between what compliance requires and what was actually happening. Price the remediation, or negotiate it.

Licenses may not transfer. Software agreements often require consent to assignment, and the target’s pricing may have been grandfathered, discounted, or frankly out of compliance (more seats in use than purchased is astonishingly common). The renewal-at-real-prices number belongs in your model.

The people and knowledge risk

In most small businesses, the IT documentation is a person — an employee, the owner, or “a guy” on informal retainer. Diligence questions: Is anything written down? Where do the passwords live? Does the key person know about the deal, and are they staying? If the answers are no, one head, and unclear — that’s manageable, but only if you plan for it: a documented knowledge-transfer period in the agreement, credentials escrowed at closing, and admin access verified before the wire, not requested after. The buyer who can’t get into what they bought has a story we’ve heard more than once.

Pricing the integration

Two companies’ technology doesn’t merge by press release. Someone has to combine email systems, reconcile file storage, merge or bridge line-of-business applications, connect networks safely (a flat connection between two networks also merges their security problems — segment first), and standardize security. That’s a real project with real cost and a realistic timeline of months, and it belongs in the deal model next to the legal fees — because it’s just as certain. Sequencing tip from the field: get security and backups to your standard in week one, before deep integration. Everything else can be phased; inherited exposure can’t wait.

The one-page ask

If diligence time is short, five requests reveal most of it: (1) hardware and software inventory with ages and renewal dates, (2) proof of account ownership for domain, tenant, and core apps, (3) security attestation — incidents, MFA, backup tests, insurance application, (4) IT support arrangement and where documentation lives, (5) software agreements, for the assignment clauses. Evasiveness on any of the five is itself a finding.

The bottom line

Technology diligence isn’t about finding a reason to walk — it’s about buying the company at its actual price. The server fleet’s age, the licenses that won’t transfer, the security debt, the key person, and the integration project are all knowable before signing. Know them, and they’re negotiating points. Skip them, and they’re your first-year budget.