close search bar

Sorry, not available in this language yet

close language selection

IT due diligence: How to enhance your approach


IT due diligence: How to enhance your approach

I recently read the 2016 Edition of the IT Due Diligence Guide by Jim Hoffman. It’s a valuable reference for anyone involved in mergers and acquisitions. Certainly, an acquirer who does not have a well-established process will benefit. However, I believe even experienced acquirers will find it a useful source of ideas to enhance their own approach. And it’s a great resource for sellers, who will benefit from an exhaustive understanding of the spectrum of questions they will need to address during diligence. Hoffman has 25 years of technology experience, including participating in numerous transactions from both the buy- and sell-side. Reading between the lines, he’s a very organized guy who probably kept great notes over the years.

Technical aspects of IT due diligence

The book focuses on the technical aspects of due diligence, and also covers all areas to explore when assessing a company’s technology. These include: staff, products, processes, quality, infrastructure, security and a dozen or so other areas. It begins with an overview of the acquisition process and how due diligence works, which is particularly valuable for an organization not experienced in M&A. Chapters dedicated to each of the specified areas follows the overview.

A recipe for successful due diligence

Hoffman clearly designed this guide for practical use. You could literally use it as a recipe for a successful diligence. The best example is the chapter structure. The chapter for each area of diligence is organized in series of information requests. An icon highlights each request, indicating its criticality, followed by a description and an explanation of “Why This Is Important.” Hoffman also flags items to handle face to face during a site visit. As an example, the chapter called Software and Services Utilized outlines requests for lists, among other things requests for open source components used by the company (classified as a Critical Request, by the way):

A list of any open source projects utilized by the company, including the name and URL of the open source project, version, company products or services associated with license, reason used and the open source license under which the project is distributed.

It goes on to explain the potential security and license risks associated with open source. Each chapter provides this kind of detail for a particular area of diligence. The importance of an open source audit is detailed in an appendix titled Recommended Third Party Audits. You know who to talk to if you want to take Hoffman’s advice on that one.

Due diligence guides, checklists, forms and more

This IT Due Diligence Guide is available on a dedicated website The Guide comes in a zip file accompanied by a useful set of templates. These comprise the Guide (PDF) and Excel checklists for many of the due diligence areas. It also includes Word documents, including a comprehensive checklist to manage the overall process, a detailed report form and a template for integration planning.

Need an M&A Checklist? Download now.

Synopsys Editorial Team

Posted by

Synopsys Editorial Team

More from Security news and research