Mergers & Acquisitions (M&As) are among the most challenging undertakings in business. Administering the IT integration risk associated with a merger has become a major component in determining the ultimate success or failure of M&As. Expectations concerning cost savings and economies of scale often focus on IT. M&A IT due diligence helps buyers, investors, and leadership teams identify technology risks, hidden costs, cybersecurity gaps, and integration challenges before they affect deal value.
In fact, IT plays a critical role in determining how effectively the merged organization is able to integrate processes and people, as well as deliver products and services to internal and external customers.
How does one comprehend the expenditure and IT risk associated with an M&A and possible regulatory or software compliance issues? The answer is IT due diligence.
What is IT Due Diligence?
IT due diligence serves to evaluate:
An organization’s current state of technology;
Issues linked to sustaining its current technology;
Financial consequences of a technology plan;
Opportunities for leveraging existing technologies;
Initiatives essential to undergo a successful merger and
Business risks.
The IT Assessment
The IT due diligence process commences with an IT assessment report that supplements the work performed by financial, legal, and operational analysts. The IT assessment analyzes risk and affords bench-marking information, facilitating a more informed decision. The assessment report should contain:
Architecture analysis
Infrastructure analysis
Applications analysis
Security risk analysis
Service support analysis
Information asset analysis
System criticality
Organization overview
Threat, vulnerability and impact analysis
Operating expense analysis
Capital expense analysis
Executive presentation Benchmark comparison
Security Risk Assessment
As a complement to the IT assessment report, a security risk analysis will afford a comprehensive evaluation of threats, vulnerabilities and impacts. The objective is to understand the following:
- What is the important data?
- Where does the data reside (systems)?
- How is it protected?
Security vulnerabilities are amid the most overlooked problem areas revealed in the due diligence process. Medium to smaller sized organizations often don’t realize how much authority and access some of their IT personnel may have – access that could empower them to create considerable problems for the organization. Such vulnerabilities can subject the organization to lawsuits if not properly dealt with.
Malware embedded deeply within various software systems can also present a severe threat. In many instances, even organizations with suitable anti-virus software have it configured incorrectly, permitting malware to penetrate the company’s systems. The likelihood for such malware to steal credit card numbers, human resources data, intellectual property, passwords and more is substantial.
Disaster prevention and recovery should also be dealt with. Does your organization have a suitable backup plan to make certain it can recover critical data quickly enough to sustain operations? The cost of attending to these issue areas should be factored into the total cost of ownership from the very start.
Lastly, a compliance dashboard should be afforded to capture the compliance status of the IT organization for applicable regulatory requirements such as SOX (or bill 198), HIPAA (or PIPEDA), SAS 70, etc.
The Litcom Approach
If your organization is evaluating a merger, acquisition, or investment, Litcom can help assess the target company’s IT environment, identify risks and hidden costs, and provide practical recommendations to support informed decision-making. Please contact us for additional information at: info@litcom.ca.
