Buying a business means inheriting more than its customers, contracts and balance sheet. You may also inherit unsupported systems, expired licences, unclear data rights and a recovery plan that exists only in someone’s memory.
For buyers, sellers and finance directors, IT due diligence should establish what the business relies on, what could disrupt it and what remediation will cost. It is not simply an inventory exercise: its findings may affect the purchase price, warranties, completion conditions and the first 100 days after a deal.
David Evestaff approaches this work as an expert IT Consultant, combining strategic advice with practical understanding of delivery. His practitioner-led background includes Google-certified IT project management, multinational onboarding and IBM i system administration. The objective is a clear IT strategy for the business being acquired, not a shopping list of technology.
1. Test compliance evidence against the actual business
Treat compliance as a transaction risk to verify, not a certificate-counting exercise. Ask for the evidence behind any claim of ISO 27001 certification or Cyber Essentials status, then check whether it covers the business, systems and services included in the sale.
For ISO 27001, review the certificate’s validity and scope, the information security management system boundaries, exclusions, Statement of Applicability, recent audit findings and open corrective actions. Does the scope cover the acquired legal entity, locations, cloud services and production systems, or only a limited part of the organisation? A valid certificate with a narrow scope may say little about the estate you are buying.
For Cyber Essentials, verify the level, validity and scope. The NCSC’s overview describes its five technical controls: firewalls, secure configuration, security-update management, user access control and malware protection. Ask whether the certificate covers the relevant devices and infrastructure, and whether Cyber Essentials Plus testing has identified unresolved issues.
Neither certification should be treated as a universal legal requirement for every SME. The practical pass/fail question is whether the target’s claims are supported by current, relevant evidence, and whether any gaps are understood, costed and addressed in the deal.
If the target is FCA-regulated, or its technology supports a regulated firm, assess operational resilience and third-party dependencies. The FCA’s guidance says regulated firms remain accountable for managing risks associated with outsourcing and other third parties. Identify important services, technology and supplier dependencies, recovery expectations and any relevant notifications.
DORA may also matter where the target is an EU financial entity or supports one through ICT services or contractual arrangements. It has applied in the EU since 17 January 2025; it is not automatically applicable to every UK SME. Check the relationship and contractual obligations, and consult regulatory advisers where needed. The EIOPA overview explains DORA’s coverage.
2. Ask for proof that recovery works
A backup job reporting “successful” is not proof that the business can recover. Ask for the disaster recovery plan, backup schedules, retention settings, recovery objectives and evidence of recent restore tests. Find out who can access and administer backups, where they are held, and whether copies are isolated from the systems they protect.
Then ask a more useful question than “Do you have DR?”: when was a critical system last restored, by whom, and how long did it take? Has the business rehearsed the process, including staff responsibilities, supplier contacts and communications? If recovery has never been tested, treat that as an unpriced liability until there is evidence otherwise.
Compare the recovery capability with business requirements. A finance system that takes days to restore may have a different impact from a non-critical file share. For each important service, establish the acceptable downtime and data loss, the systems and people it depends on, and whether the plan can meet those expectations.
A robust Disaster Recovery review is especially important where the target depends on a small number of individuals or suppliers. The buyer should know what happens if the key administrator is unavailable on completion day, not just after a fire drill.
3. Establish whether the core finance system is inheritable
Find out what runs finance, operations and reporting, and whether the acquired organisation can continue to support it. For a modern, documented platform such as Microsoft Dynamics 365 Business Central, examine the tenant and administrator ownership, version, licence arrangements, extensions, integrations, data quality and support responsibilities.
Business Central can provide a supported finance and ERP core, but the product name alone does not guarantee a clean handover. Ask for system documentation, a list of customisations, data flows, integration credentials and details of any dependencies on the seller’s Microsoft tenant or implementation partner. Confirm that finance processes, roles and reporting meet the buyer’s needs, and test any proposed changes before cutover.
Where a target’s needs and readiness make it appropriate, Evestaff’s Dynamics 365 Jump Start offers a route to assess Business Central as a finance and operations platform. The purpose of that assessment is to determine strategic fit and implementation requirements, not to assume that a new system should be bought as part of every acquisition.
An ageing or heavily customised on-premise system needs a different level of scrutiny. Identify unsupported components, undocumented integrations, licence constraints, upgrade costs and the expertise needed to maintain it. Put estimated remediation, migration and transition costs into the deal model rather than treating them as a future IT problem.
4. Find out whether legacy expertise leaves with one person
Where the target relies on IBM Power or AS/400 systems, confirm the operating environment, support arrangements, backup and recovery method, application dependencies and access to system knowledge. Establish whether the organisation’s continuity depends on one administrator who plans to leave after the sale.
Request current documentation, a named support route, an inventory of key applications and an explanation of how recovery is performed. Check whether the software and support entitlements can continue after a change of ownership. A system can be reliable and business-critical while still carrying considerable people and continuity risk.
For specialist support, review IBM i Management as part of the target’s continuity plan. Do not assume a general support contract covers a legacy estate in sufficient depth; confirm the provider’s responsibilities, response arrangements and knowledge-transfer process.
5. Reconcile technology costs and commitments
Use Technology Expense Management to create a clear view of the target’s actual technology costs. Reconcile supplier invoices, contracts and licence records across software, cloud services, telecoms, connectivity, hardware, support and security.
Look for unused or duplicate licences, overlapping tools, shared services paid for by the seller, automatic renewals and contracts with change-of-control provisions. Confirm who owns domains, cloud tenants and subscriptions, and whether each agreement can transfer to the buyer. A low historic IT cost may conceal deferred maintenance, under-licensing or services that the seller supplied informally.
This cost review should distinguish recurring operating costs from one-off transition, separation and remediation costs. It may reveal a requirement for additional Cloud Solutions, Network Solutions, Helpdesk Support, Managed IT Services, or Voice and Connectivity, but those are execution choices, not a substitute for deciding what the business needs.
A structured Technology Expense Management review can help identify waste and prioritise investment. The aim is to build a sustainable cost baseline and support the wider IT strategy, not merely to replace one supplier with another.
6. Include data and transition obligations
A change of ownership can affect how personal data is controlled and shared. Identify what data is being transferred, why it was originally collected, the relevant lawful basis, retention arrangements and security controls. The ICO’s M&A due diligence guidance advises organisations to consider data sharing as part of due diligence, document it and seek technical advice where different systems are involved.
Also establish what the seller must provide after completion. A transition services agreement may be needed for access to systems, supplier introductions, data migration or specialist knowledge. Record its scope, duration, cost and exit plan. If an essential service relies on the seller’s infrastructure or account, make the separation plan explicit before signing.
Turn findings into deal decisions
A useful diligence report does more than list technical weaknesses. For each material finding, record the evidence, business impact, remediation owner, estimated cost and deadline. Agree how significant issues will be handled: through a price adjustment, warranty, specific seller obligation, completion condition or a funded post-completion plan.
Prioritise Day 1 essentials (administrator access, backups, incident contacts, licences, supplier continuity and critical system support) then build a 100-day plan for remediation, integration and longer-term optimisation. Sellers benefit too: clear evidence and realistic transition plans reduce surprises and make risks easier to discuss with buyers.
An acquisition is a strategic decision, and technology should be assessed in that context. The right IT consultant can help establish what must be protected, what should change and what can wait. Before assumptions become costly commitments. For an overview of the wider Evestaff group, visit evestaff.co.uk.
This article provides general information, not legal or regulatory advice. Confirm transaction-specific, data protection and regulatory requirements with suitably qualified advisers.
SEO tags: IT due diligence, UK SME acquisition, technology due diligence, Cyber Essentials, ISO 27001, Disaster Recovery, Dynamics 365 Jump Start, IBM i Management, Technology Expense Management, Managed IT Services, Cloud Solutions, Network Solutions, Helpdesk Support, Voice and Connectivity, FCA operational resilience, DORA
Join The Discussion