Technology due diligence · for investments, acquisitions and exits, led by a senior CTO

Technology due diligence: what is assessed

Technology due diligence answers one question for the people putting money in: does the technology support the plan the valuation assumes? It sits alongside financial and legal due diligence, and it is best run by someone who has been a CTO, because the risks that matter are rarely the ones a checklist finds.

Architecture and scalability

Whether the product can carry the growth in the business plan, what has to be rebuilt to get there, and which parts depend on a single supplier or a single person.

Code quality and IP ownership

How the code is written, tested and released, and who owns it. Copyright in code written by an employee in the course of employment usually belongs to the employer; code written by a contractor or agency usually stays with its author unless a written agreement says otherwise, as the Intellectual Property Office’s guide to ownership of copyright works explains. The review lists who wrote the core product and checks the contracts. Open-source licences are checked too.

Security

Access, patching, past incidents and how the company would respond to one. ICAEW’s guide Cyber Security in Corporate Finance notes that an acquirer can inherit a breach the business does not know about, and that a transaction itself draws attackers. The NCSC’s Cyber Security Toolkit for Boards gives the questions a board should be able to answer.

Data protection

What personal data the company holds, on what lawful basis, and whether it can show its compliance, as the ICO’s guide to accountability and governance requires. On an acquisition, the ICO’s code on due diligence when sharing data following mergers and acquisitions says the buyer must consider data sharing as part of its due diligence, including the purposes the data was first collected for.

Team and key-person risk

Who holds knowledge nobody else has, whether they are staying after the deal, and whether the team can deliver the roadmap. A company where one founder is the only person who understands the platform is a different investment from one with a documented system and a second in command.

Technical debt and costs

The shortcuts that will have to be paid back, what they will cost in time and people, and what the technology costs to run today. The review separates debt that limits growth from debt that is merely untidy.

Sensitive sectors

Some acquisitions must be notified to the government before they complete under the National Security and Investment Act; GOV.UK says a notifiable acquisition completed without approval is void. Qualifying assets can include intellectual property. Whether a deal is caught is a legal question, but the technical reviewer is often the person who can say plainly what the target’s technology does.

Vendor due diligence: getting ready for a raise or a sale

Vendor due diligence is the same review, commissioned by the company before investors or buyers arrive. It finds the issues while there is still time to fix them, so the first time a bidder sees a problem is not in the middle of negotiating the price.

ICAEW’s Cyber Security in Corporate Finance describes a vendor report as covering the matters an acquirer would expect in its own review, with the vendor able to take remedial action on what it finds. The British Business Bank’s Are you ready for finance? checklist makes a related point for founders: from tax planning to not owning your own IP, knowing the sticking points up front helps the negotiation and shows you are being transparent.

Getting ready usually means: confirming the company owns its code, with assignments from contractors where needed; documenting the architecture; closing obvious security gaps; putting the data protection records in order; and making sure the platform does not depend on one person. Before sensitive information goes to a fund, the British Business Bank’s private equity checklist suggests a non-disclosure agreement to protect IP and commercially sensitive data. If you want a wider review first, start with a technology audit.