IT due diligence: recognizing IT risks before the purchase

IT due diligence can be differentiated according to its tasks on the one hand and its objectives on the other: There are analyses carried out as part of company acquisitions and analyses carried out as part of outsourcing projects for the service provider.

 

The aim of IT due diligence in the context of company acquisitions is to identify the opportunities and risks arising from the acquisition and the IT infrastructure acquired. What is important is what the acquiring company has planned. For example, it should be assessed differently if the IT of the acquired company continues to be used or if the migration to a uniform system takes place after the acquisition. In contrast, the situation is different if, in particular, group companies are to be separated from an existing group of companies and a new IT landscape may have to be set up. 

 

If service providers carry out IT due diligence as part of outsourcing projects, they are particularly interested in which IT systems and possibly also employees are taken over and how these structures can be transferred to their own as efficiently as possible.

As auditors, we are used to a structured approach from auditing financial statements and use it for IT due diligence. When auditing annual financial statements, it is also essential to gain a quick overview of the client's business models and IT systems and to carry out a risk analysis. In addition, we are familiar with many IT systems and their strengths and weaknesses from the audits we have carried out. We can use this knowledge for IT due diligence and incorporate it into our analyses and assessments.

 

We always start the audit by taking stock of the IT systems, IT processes and the organizational basis. Here we use the methods that we also use for the annual audit and thus quickly obtain comprehensive information about the target object. If we have already received information about the systems used in advance, we can ask more specific questions about the IT systems straight away.

 

Based on the available information, we can carry out an analysis and either request further information or directly assess risks and opportunities.

 

This is followed by an assessment of the documents found. In addition, we estimate the costs of the IT and its further development and thus also provide information that should be included in the pricing.