In today’s business world, digital assets and technologies are not merely an optional extra, but an indispensable core component for most companies and their products. In the battle for market share, technological advantages are increasingly decisive and determine a company’s economic strength. Companies that stand out for their technology are among the most valuable and successful in the world. It is therefore crucial that companies recognise digital assets and technologies as a strategic priority and invest in them accordingly.
This investment requires an in-depth, technology-focused assessment that goes beyond standard co due diligence. In the past, product characteristics and their added value were easier to understand, even for those less tech-savvy, than they are today. Due to the increasing complexity of digital products and value creation, it is now virtually impossible to truly grasp the benefits of digital products without specialist knowledge.
Contents
Whilst technology investments offer considerable opportunities, the potential risks must not be underestimated. Thorough due diligence is crucial for making informed investment decisions. Assessing the technical aspects of a company involves both Tech Due Diligence (TDD) and IT Due Diligence (ITDD). TDD focuses on technology-based products, whereas ITDD focuses on the ‘traditional’ IT organisation and its capabilities. As the two assessments cannot be clearly distinguished from one another, they are regularly considered together (ITDD) – a practice that is also recommended. The focus of the ITDD may vary depending on the target company.
“Understanding a target’s technical capabilities and expertise is, for us, an essential part of a successful investment. This enables us to assess growth potential and identify business-critical risks. As a result, we can often tackle necessary investments immediately following the acquisition.” – Richard Glatzel, Aurelius Group
Investment in digital technologies (e.g. digital products, automation, IT infrastructure) offers opportunities across many competitive dimensions, such as efficiency gains, new business models or improved customer experiences. However, technological developments are often associated with high costs and uncertainties. Furthermore, there are always risks relating to cyber security, data protection and technological obsolescence (e.g. outdated technologies). A careful assessment of these risks is crucial for making well-informed investment decisions. There are companies that face a clear competitive disadvantage not in their services, but in their underlying processes. The situation can become even more dramatic when it comes to cyber-attacks, which can have consequences that threaten a company’s very existence. Two very prominent examples are the Equifax data breach and the MOVEit data leak.
Equifax data breach: In 2017, Equifax, a major credit reference agency, suffered a massive data breach. Hackers exploited a vulnerability in a software framework to gain access to sensitive information belonging to over 147 million consumers. As part of a settlement, Equifax agreed to pay between a minimum of 575 million and a maximum of 700 million USD.
MOVEit data breach: In 2023, the MOVEit Transfer software, a widely used solution for secure file transfers, was the target of a serious data breach. Hackers exploited a vulnerability in the software to gain access to sensitive information belonging to over 40 million people worldwide. This vulnerability enabled the hacker group Cl0p to compromise data from hundreds of companies and organisations (including Provinzial Versicherung and banks such as Comdirect, ING Direktbank and Deutsche Bank). The affected organisations took immediate action, including applying patches and security updates, to close the vulnerability and prevent further attacks. The financial cost of the breach cannot yet be estimated.
The transformation now required towards increasingly technology-driven businesses and processes is being driven ever further by the constant development of new technologies such as artificial intelligence, machine learning, big data, cloud computing and blockchain. Companies that fail to adapt these technologies in a targeted manner will face a competitive disadvantage in the medium term, making a technology-focused assessment – more comprehensive than standard commercial due diligence – absolutely essential.
An (I)TDD is essential for understanding a company’s digital maturity, technological risks and willingness to innovate. These assessments provide a comprehensive overview of a company’s technological landscape and support risk management.
A key aspect of (I)TDD is understanding digital maturity and the associated technological risks. Organisations and products with a mature digital infrastructure are better placed to respond to technological changes and drive innovation. (I)TDD helps to identify vulnerabilities and risks that could have a negative impact on business development.
Another key aspect of (I)TDD is the assessment of the scalability, quality and future viability of a company’s digital assets. In particular, companies and products that have grown organically over time and may have a significant backlog of IT investment require careful analysis. Just because a system is currently functioning does not mean it is sound or secure in the long term. (I)TDD helps investors assess these critical aspects and make informed decisions.
The duration and key focus areas of an (I)TDD vary depending on the complexity of the target company and the technologies under scrutiny. Typically, a later stage in the investment process is now the norm due to the need to access information. However, for companies with highly innovative or complex technologies, an earlier stage may be advisable, as this helps to demonstrate the value contribution of the technology from the buyer’s perspective.
Fig. 1: Tech due diligence involves a technological assessment that plays a crucial role in the analysis of the target company (own illustration).
Integrating (I)TDD into the other areas of due diligence ensures that all relevant aspects of a potential investment are comprehensively assessed. There is not always a clear distinction between the various aspects of business valuation, and often the issues need to be considered from different perspectives. The areas of overlap for (I)TDD are generally greatest with commercial due diligence (CDD) and legal due diligence (LDD).
Similarly, overlaps with otherdue diligence areas (e.g. financial due diligence) should also be considered in order to be able to assess further aspects from different perspectives where necessary (e.g. potential cost savings).
Hidden potential within IT is rarely identified by experts during commercial, legal or financial due diligence, as they lack the necessary expertise and experience in this area. A robust assessment from these perspectives is often not available.
An (I)TDD is routinely carried out from two perspectives:
These different perspectives all have their place – varying budgets and different analytical objectives ensure a clear allocation of goals and focus.
This is where (I)TDD comes in, evaluating digital assets – within the context of the company and investors’ expectations – with proven experts and extensive experience.
The scope and depth of the review may vary depending on the value contribution of the digital assets. For a detailed and well-founded valuation, exclusivity is usually necessary to gain sufficient access to sensitive technical information. This significantly increases the accuracy of the valuation. Direct access to development teams, technical documentation and internal systems is crucial for a thorough (I)TDD. On the other hand, ‘outside-in’ valuations without comprehensive access are limited to public information and secondary data sources and therefore add less value to the analysis.
Furthermore, depending on the context and the remit, there are various names and formats used for due diligence reports:
Vendor Due Diligence (DD): A report commissioned by the seller, which is made available to potential buyers to ensure transparency and speed up the sale process.
Red-Flag Due Diligence/High-Level Critical Evaluation: A rapid review aimed at identifying critical issues (‘red flags’) that could jeopardise the deal.
Selective-Focus Due Diligence/Focused DD: A targeted review focusing on specific areas of particular relevance to the investor.
Full-Scope Due Diligence/Extensive DD: A comprehensive and detailed review covering all aspects of the target company and its technologies.
The depth of the review is not only strongly correlated with the effort involved and, consequently, with the costs incurred. Depending on the depth of the review, there is an optimal timeframe for an (I)TDD.
Fig. 3: As time goes on, the learning curve flattens out and the insights gained are not proportional to the time invested (own illustration).
Many factors influence the duration and quality of a business valuation. The time taken to produce an (I)TDD report is therefore not linear.
An audit that is too short can lead to inadequate results, whilst one that is too long often uncovers unnecessary details that are of little business-critical importance. Experience has shown that a period of four to eight weeks is optimal for obtaining a well-founded analysis. The aim is to strike a balance to ensure both depth and efficiency.
“A comprehensive technical due diligence must protect against hidden technological liabilities and risks. By carefully assessing the target company’s IT systems, cyber security and digital products, clients must be enabled to navigate M&A transactions with the utmost confidence.”
– Klaus Mahle, kobaltblau Management Consultants
It will be fascinating to see how due diligence practices evolve over the coming years, as a number of new areas will be added. These include new perspectives on the target company and a deeper focus (for example, in the fields of AI, cybersecurity and data). We expect to see increasing specialisation and, as a result, further technological aspects being examined as standalone due diligence processes.
Uwe Barthel – has been a Senior Software Architect at iteratec since 2018. He is the point of contact for all matters relating to system reviews and IT modernisation.
This article first appeared in M&A REVIEW Digital
Do you have any questions or need assistance?
You can find further information about the possibilities of IT modernisation for your business on our website. Feel free to contact us.