IT due diligence for company sales and successions in Germany

What an IT due diligence checks

An IT due diligence answers one question for a buyer: can the IT of this company carry the business after the deal, and what has to happen first? For a seller it answers the same question earlier, while there is still time to close gaps before a buyer finds them.

Why the IT needs its own review in a smaller deal

When a smaller company is sold or handed to a successor, the financial and legal reviews come first on the plan. Yet on the day of the closing the buyer also takes over the servers, the software licenses and the contracts with IT providers, together with the one employee or outside provider who knows how it all works. If that knowledge is not written down, the buyer pays for it later, in outages or in the price of a new provider.

IT due diligence checklist for a smaller company

These are the areas I work through, with the documents I ask for in the data room. A missing document is a finding of its own.

Area	What I check	Documents I ask for
Systems	Servers, cloud accounts and software, with their age and support status	System list, network plan
Business software	ERP, CRM or shop: version, custom changes, vendor	License and maintenance contracts
Licenses	Whether the licenses cover the actual use and pass to the buyer	License list, change-of-control clauses
IT providers	Who runs what, notice periods, dependence on a single provider	Service contracts, service levels
People	Who knows which system, and what happens if that person leaves	Organization chart, handover notes
Documentation	Whether setup, backups and access are written down	Operating manuals
Security	Access rights, updates, incidents of recent years	Access lists, incident reports
Backups	Whether a restore has been tested, and how long an outage may last	Backup plan, log of the last restore test
Data protection	Where personal data sits, and whether the GDPR paperwork exists	Record of processing activities, data processing agreements
Own software	Who owns the code, how it is tested, who can deploy it	Repository access, rights clauses in contracts with developers
Costs	Running IT costs and investments that fall due soon	IT budget, invoices of the past year
Closing day	Which accounts, domains and contracts change hands	Domain list, list of admin accounts

The last row is easy to forget. Domains, admin logins and cloud accounts can sit in the name of a former employee or of the owner, and they have to move to the buyer on the day of the closing.

Where my due diligence experience comes from

I have taken part in several due diligences, on the buyer’s side and on the seller’s side. My part was the documents on the quality of the IT systems, the state of the teams and the health of the products: I examined them for buyers and prepared them for sellers.

I have also written and reviewed contracts, license agreements and terms of use for business development and IT. At the Frankfurt-based company Blocksize Capital this included the terms of a market-data product and the legal framework of a partner program. As CIO there I had disciplinary responsibility for business-critical teams and was responsible for the IT budgets.

Who I am

I am Michael Wutzke from Frankfurt, and my work in IT and media goes back more than twenty years. Before the CIO role I was Head of Decentralized Finance and Node Operations at Blocksize Capital, Project Manager and Web Developer at an insurance group, and earlier IT Team Lead and Managing Director. I sit on the Product Advisory Committee of the Digital Token Identifier Foundation. Details: Publications, press and committees.