Acquiring or merging with an established business can add customers, staff and new markets quickly. Financial statements, however, rarely show how the target’s systems will perform once ownership changes. IT due diligence is the review that identifies these risks before completion. For a London SME, a focused IT due diligence review can affect the purchase price, the cost of integration and the continuity of client services. This article sets out what buyers should check, and where managed IT support can help.
Table of Contents
- Quick Takeaways
- What IT Due Diligence Covers in an SME Deal
- Infrastructure, Licences and Support Dependencies
- Cyber Security and Data Protection Exposure
- Integration Costs and Approaches Compared
- Integration Planning and Post-Completion Checks
- Frequently Asked Questions
- References
Quick Takeaways
| Key Insight | Explanation |
|---|---|
| Request a full asset register early | Ask for hardware, software licences, domains, cloud tenants and administrator accounts. Gaps in this list usually point to wider documentation problems. |
| Confirm who holds administrator access | At least two named people should control email, domains and cloud billing. Single-person control is a continuity risk. |
| Check licence transferability | Some licences cannot move to a new legal entity. Review the terms before completion to avoid an unplanned repurchase. |
| Map personal data in business systems | Identify customer and HR data, its storage location and retention period. The buyer inherits the obligations along with the records. |
| Price known remediation before signing | Obtain estimates for end-of-life systems and security gaps, and treat them as negotiation items. |
| Plan integration as separate workstreams | Identity, email domains and line-of-business systems need a sequenced plan rather than a single cutover. |
What IT Due Diligence Covers in an SME Deal
IT due diligence is a structured review of the technology a target business uses to operate, the contracts that support it, and the skills needed to run it. The scope is narrower in a small business than in a large group, but the consequences of an error are proportionally greater. A firm with a small team that loses its email domain or accounting system on the day of completion may struggle to keep clients informed.
In practice, a review covers five areas: infrastructure and hosting, software and licences, cyber security, data protection, and people and support arrangements. Official guidance on merger-related records published by HMRC expects an acquirer to test inherited records and to verify them where there is reason to doubt them. The same discipline applies to IT records.
Setting the scope before the data room opens
Set the scope in writing before the seller provides access. A short request list covering systems, contracts and staff roles prevents the review from becoming a general tour of the business. Agree the timetable with the deal team so that technical findings arrive before exclusivity ends.
Infrastructure, Licences and Support Dependencies
Software licences and their transfer terms
Many small businesses run on licences bought by an individual, or on accounts registered to a personal email address. Check whether licences can be assigned to the buying entity, whether discounts depend on the seller’s contract, and whether any perpetual licence carries an annual maintenance obligation. A licence that cannot transfer forces an unplanned purchase at completion.
Key-person dependency on in-house IT
A common finding is that one employee holds every administrator password and performs every repair. This arrangement works until that person leaves. Request documented procedures and confirm that an external provider can take over administration during the handover period.
Pro tip: Ask the seller to complete a credentials register during the review, and store it in a password manager with at least two authorised administrators before completion.
Cyber Security and Data Protection Exposure
A system that works today is not necessarily a system that is safe to inherit.
Administrator accounts and multi-factor authentication
Review how administrator accounts are created, reviewed and removed. Confirm whether multi-factor authentication is enforced for email, remote access and cloud consoles. Former staff accounts that remain active are a frequent source of unexpected exposure after a change of ownership.
Personal data in customer and HR systems
Under UK GDPR, personal data held by the target remains subject to data protection duties after ownership changes. Establish what personal data is held, where it is stored, how long it is kept and whether existing privacy notices cover the intended use. The ICO publishes guidance on these obligations, and buyers should review it before completion.
Integration Costs and Approaches Compared
Integration cost is often underestimated because buyers compare only licence fees. The three routes below differ in speed, control and cost. The choice should follow the level of risk identified during the review.
| Approach | Typical use | Main risk |
|---|---|---|
| Run the target as a standalone business | Short holding period or a separate regulated entity | Duplicate costs and unmanaged security gaps |
| Phased migration to the buyer’s platforms | Most SME acquisitions with overlapping email, file storage and finance | Extended dual administration if the timetable slips |
| Full cutover at completion | Small targets with simple, well-documented systems | Disruption if documentation is incomplete |
Matching the integration route to the findings
Select the route after the review, not before it. Where documentation is strong and systems are few, a cutover may be efficient. Where licences, data or administrator access are unclear, a phased approach gives the buyer time to resolve issues without interrupting clients.
Integration Planning and Post-Completion Checks
Integration plans often fail in the first weeks, when several tasks run in parallel and no one owns the sequence. A written plan agreed at signing reduces this risk. It should name an owner for each system and a date for each change.
The first 30 days after completion
Priority tasks include confirming domain ownership and DNS records, moving billing and administrator accounts to the buyer’s control, and checking that backups can be restored. Record each change in a shared log. This discipline keeps the transition auditable.
Ongoing monitoring and service levels
Integration does not end when systems are connected. Set measurable service levels for helpdesk response, patching and backup testing, and review them at least quarterly during the first year. An outsourced IT department, such as the managed IT services offered by iTO.London, can provide this continuity with a named engineer accountable for each stage.
Pro tip: Run a restore test on at least one critical backup before completion, rather than relying on the seller’s assurance that backups work.
Frequently Asked Questions
How long does IT due diligence take for a small business?
A focused review can usually be completed within the exclusivity period if the data request is issued early. The timescale depends mainly on the quality of documentation the seller provides.
Who should carry out IT due diligence?
The review should be led by a qualified internal technologist or an independent provider. The seller’s own IT contact should supply information but should not be the sole source of assurance.
Is IT due diligence needed for an asset purchase?
Yes. Asset purchases still require the transfer of licences, data and accounts. The scope narrows to the assets being transferred, but the risks of missing items remain.
Which findings most often add cost after completion?
In practice, undocumented administrator access, unlicensed software and end-of-life systems tend to add the most cost. Each usually requires unplanned work or purchases once the business is under new ownership.
Can a managed IT provider support a deal before completion?
Yes. A provider can conduct the review, price the remediation and then take over administration after completion. This keeps knowledge in one place and avoids a gap between the two phases.
We would welcome your feedback: has your business faced an IT issue during an acquisition or merger, and which check would you add to this list?