IT Diligence: Beyond Checking the Box
M&A transactions are often a great way to create value for shareholders, but these transactions can be costly and time intensive. If your company is engaging in any type of M&A transaction, you likely are performing upfront deal diligence to make sure the investment is sound and any identified risks can be mitigated. Deal diligence is certainly important and should not be overlooked or downplayed, especially from a technology perspective. However, diligence is most valuable when it extends beyond risk qualification and lays the groundwork for shareholder value creation.
Technology risk profile:
An important and necessary part of any deal is the upfront confirmation that the target company (regardless of the transaction type) has minimal risk with regards to its technology infrastructure and cyber footprint.
To assess the infrastructure risk profile, there is no quick and dirty way to ensure risks are mitigated. A bottoms-up analysis of all infrastructure equipment is recommended to confirm that all assets are well maintained, properly patched, and not end of life (EOL). It is also required to confirm that the surrounding facilities where most infrastructure assets reside (e.g. data centers) are secured, and have proper disaster recovery protocols in-place. More often than not, infrastructure risks will be identified as part of these assessments, but it is important to qualify and quantify the appropriate mitigation.
Cyber risk assessments vary in scope based on the target company industry. At the bare minimum, there are various government guidelines that should be validated with respect to treatment of data. A few common assessments are penetration testing, the validation of Payment Card Industry (PCI) compliance, Personally Identifiable Information (PII) compliance, California Consumer Privacy Act (CCPA) and General Data Protection Regulation (GDPR) compliance.
Beyond 'checking the box':
Deal diligence is also a great opportunity to get a third party perspective on different ways to enable an investment thesis. Regardless of the transaction type, there should be a deal thesis that justifies the transaction and that will require a plan to properly enable. Diligence is the phase in the deal lifecycle where a deep-dive can enable a quicker path to value realization.
Aberdeen Advisors believes that each deal thesis (and any business goal or objective for that matter) requires certain business and technology capabilities for delivery. Understanding that the requisite capabilities needed to operate today may not be the same or may be mature for what is needed after the transaction completes is critical. As part of any diligence project, Aberdeen analyzes the current state capabilities, using a ‘people, process, & technology’ lens, and assesses the maturity levels relative to what is needed in the future-state. By grounding the analysis in a capability-oriented framework, it is then possible to recommend projects or initiatives that can directly improve less mature areas of the business and serve as a catalyst to value enablement. This not only helps mature the target-state organization, but it also serves as an important framework that can be built upon for future business planning and transaction success monitoring.
Each transaction will have a series of initiatives that will be needed to enable the thesis. It will be important to sequence these initiatives based on criticality, inter-dependencies, and delivered value. For example, there are a series of foundational infrastructure-related activities that are typically needed to enable any downstream collaboration or work as the New company. It is important to get these out of the way at the onset, so that value-enabling initiatives can begin.
At Aberdeen, we pride ourselves on our differentiated IT diligence capability. We are experts in understanding IT capability models and can quickly assess the overall maturity level relative to peers and help provide realistic, executable roadmaps to enable the deal thesis. We strongly believe that today’s technologies are not just value enablers, but if properly utilized can be value creators. For all assessments we leverage the Aberdeen IT Investment methodology, and directly links technology projects / initiatives to technology capabilities, business capabilities, and ultimately business outcomes.