IT Due Diligence Checklist for M&A and PE Deals

Information technology (IT) due diligence is an independent, evidence-based review of a target business's technology before an acquisition or investment. It tells a buyer or investor what they are really acquiring: the systems, the contracts, the people who keep it running, and the risks sitting underneath the numbers. Done well, it protects deal value, shapes the price and the sale and purchase agreement, and gives the integration team a head start. Done badly, it leaves the acquirer to discover unsupported platforms, unlicensed software or a single point of failure after completion, when the leverage has gone.

This IT due diligence checklist sets out what an independent review should cover in a UK M&A or private equity transaction, how the process runs, what the report should contain and the red flags that should change a deal conversation. It is written for deal teams, CIOs, operating partners and boards who need evidence they can trust rather than a vendor-led view of the estate.

What IT Due Diligence Is For

Run before signing, a good review answers four questions:

• Does the technology support the investment case? Can the estate carry the growth plan, the buy-and-build strategy or the synergies in the model?
• What will it cost that is not in the numbers? Deferred upgrades, end-of-life platforms, licence true-ups, security remediation and key-person cover.
• What could stop the business on Day 1? Shared services with a parent, change-of-control clauses, hosting tied to the seller and undocumented dependencies.
• How hard will integration or separation be? The answer drives the 100-day plan, any transitional services agreement and the integration budget.

It should sit alongside financial, commercial and legal due diligence, not apart from it. Findings only change outcomes when they are translated into price adjustments, warranties, indemnities, conditions precedent or a funded remediation plan.

Scope the Review to the Deal Type

A single template rarely fits. Scope depends on the transaction and the investment thesis:

• Private equity platform acquisition: scalability, cost of ownership, cyber risk, the IT leadership team and the technology value creation plan.
• Corporate acquisition or bolt-on: fit with the acquirer's architecture, integration complexity and realistic synergy timing. See our guide to M&A technology integration strategies.
• Carve-out: what is shared with the parent, what must be stood up, and the scope and exit plan for any transitional services agreement.
• Software or tech-enabled target: product architecture, code quality, intellectual property, open source licensing, hosting cost and the engineering organisation.
• Seller-side: vendor due diligence and exit preparation so buyers find no surprises. See vendor due diligence and technology exit readiness.

The IT Due Diligence Checklist

Use the checklist below to structure the data room request and management interviews. Each area should end with a rated finding, an estimated cost and a recommendation.

1. IT Strategy and Alignment

• Current IT strategy and roadmap, and how it links to the business plan
• Planned and in-flight programmes, their budgets, status and delivery confidence
• Technology assumptions built into the investment case or synergy model

2. Infrastructure and Hosting

• Data centres, cloud tenancies and hosting contracts, including who owns them
• Network topology, sites and connectivity
• End-user devices and hardware age profile
• End-of-life or unsupported operating systems, databases and hardware
• Capacity headroom against the growth plan

3. Applications and Software Platforms

• Application inventory covering ERP, CRM, finance, HR and line-of-business systems
• Level of customisation and the cost of upgrading or replacing it
• Bespoke software: ownership of the code, documentation, test coverage and who can maintain it
• Open source components and licence obligations
• Integration points, interfaces and hidden spreadsheets or manual workarounds

4. Cyber Security

• Security policies, controls framework and certifications such as ISO 27001 or Cyber Essentials Plus
• Recent penetration tests and the status of remediation
• Incident and breach history, including anything reported to the ICO
• Identity and access management, privileged access and multi-factor authentication
• Backup, patching and vulnerability management discipline
• Cyber insurance cover and exclusions

5. Data, Privacy and Regulatory Compliance

• UK GDPR compliance, records of processing and data protection impact assessments
• Where data is stored and transferred, including outside the UK
• Data quality, ownership and retention
• Sector obligations such as FCA operational resilience, PCI DSS or NHS DSPT

6. Contracts, Licensing and Suppliers

• Software licence position and exposure to vendor audit or true-up
• Change-of-control and assignment clauses in key contracts
• Managed service and outsourcing agreements, notice periods and exit terms
• Supplier concentration and dependence on any single partner

7. IT Organisation and People

• IT structure, headcount, contractors and cost
• Key-person dependencies and retention risk
• Skills gaps against the future roadmap
• Quality of IT leadership and governance

8. IT Financials

• IT operating and capital spend over the last three years, and forecast
• IT cost as a share of revenue, benchmarked against comparable businesses
• Deferred investment and the one-off cost to fix known issues
• Committed contract spend beyond completion

9. Resilience and Continuity

• Business continuity and disaster recovery plans, and when they were last tested
• Recovery time and recovery point objectives for critical systems
• Major outages in the last two years and their root causes

10. Integration or Separation Readiness

• Compatibility with the acquirer's platforms and standards
• Services shared with a parent or group that will need a TSA
• Day 1 requirements: email, identity, finance, payroll and access
• An indicative integration or stand-up cost and timeline

Checklist Additions for IT Service Providers and MSPs

When the target is itself an IT service provider, managed service provider or software business, the technology is the product. Add these checks:

• Client contract terms, service level performance and service credits paid
• Customer concentration and churn
• Security of client environments and remote access tooling, including supply chain risk
• Accreditations and partner status with major vendors, and whether they survive a change of control
• Recurring revenue quality and the cost to serve each contract

The IT Due Diligence Process, Step by Step

1. Scope and Plan

Agree the investment thesis, the questions the review must answer, the timetable and the level of access. A focused red flag review can run in one to two weeks. A full review of a complex group typically takes three to six weeks.

2. Data Room Request

Issue a targeted request list based on the checklist above. Asking for everything slows the process and buries the documents that matter.

3. Management Interviews and Site Review

Interview the CIO or IT lead, security, key application owners and major suppliers. Documents describe the intended state. Interviews reveal how things actually work.

4. Analysis and Risk Rating

Rate each finding by likelihood and impact, estimate the cost to resolve and flag anything that affects valuation, Day 1 continuity or the integration plan.

5. Report and Deal Actions

Present findings in a form the deal team can act on, then carry the actions into the SPA, the 100-day plan and the integration programme.

What a Good IT Due Diligence Report Contains

• An executive summary with a clear view on whether the technology supports the deal
• A rated risk register using a simple red, amber and green scale
• One-off and recurring cost estimates for remediation, integration or separation
• Recommended deal protections such as price adjustments, warranties, indemnities or conditions
• A 100-day priority list for the new owner. Our 100-day IT playbook for acquirers shows how to carry this forward.

The report should be written for decision makers. A long technical inventory with no view on value is not due diligence.

IT Due Diligence Red Flags

• Core systems out of vendor support with no funded replacement plan
• A breach or incident that was not investigated or disclosed
• Critical knowledge held by one person or one supplier
• Material under-licensing or an open vendor audit
• Hosting, domains or key contracts held in the seller's or a founder's name
• IT spend well below peers, which usually signals deferred investment rather than efficiency
• No tested disaster recovery for revenue-critical systems

Common Mistakes to Avoid

• Starting too late: leaving IT until after commercial terms are agreed removes the chance to price the risk.
• Relying on management's view alone: an independent reviewer should test claims against evidence.
• Treating it as a technical audit: findings must connect to value, cost and deal terms.
• Ignoring people: retention of key IT staff often matters more than any single system.
• Losing the findings after signing: the report should become the integration team's starting point.

Frequently Asked Questions

What is an IT due diligence checklist?

An IT due diligence checklist is a structured list of the technology areas to review before an acquisition or investment. It typically covers IT strategy, infrastructure, applications, cyber security, data protection, contracts and licensing, people, IT costs, resilience and integration readiness.

How long does IT due diligence take?

A focused red flag review usually takes one to two weeks. A full review of a larger or more complex business typically takes three to six weeks, depending on data room quality and access to management.

Who should carry out IT due diligence?

It should be led by experienced technology practitioners who are independent of the target and its suppliers, so the findings can be trusted by investors, lenders and the board. Many buyers use an independent consultancy rather than relying on internal teams or incumbent vendors.

What is the difference between IT due diligence and technology due diligence?

The terms are often used interchangeably. Technology due diligence is sometimes used for software and tech-enabled targets, where product architecture, code quality and intellectual property carry more weight than internal IT systems.

What happens to IT due diligence findings after the deal?

Findings should feed the sale and purchase agreement, then the 100-day plan and the integration or separation programme, so the risks identified before signing are owned and resolved after completion.

How Intology Can Help

Intology provides independent IT due diligence for private equity investors, corporate acquirers and sellers across the UK. Our senior practitioners have led technology through acquisitions, integrations and carve-outs, so findings are practical, costed and linked to deal value. Find out more about our M&A advisory and due diligence services, or read how CIOs can drive technology due diligence in private equity deals.