How to prepare for an IT due diligence, step by step?

An IT due diligence assesses, as part of an acquisition, merger or investment, a company's technology strength: architecture, technical debt, DevOps practices, security, governance. Unlike a financial audit, it covers risks that are often less visible at first glance, but which directly weigh on valuation and on the guarantees negotiated in the deal.

The key steps of an IT due diligence

1. Scope the assessment: which systems, teams and subsidiaries are covered.
2. Gather existing technical documentation: architecture diagrams, vendor contracts, past security audit results.
3. Conduct structured interviews with technical teams (CTO, infrastructure and security leads).
4. Assess architecture and technical debt: critical dependencies, legacy code, structuring technology choices.
5. Assess security and compliance: access management, known vulnerabilities, regulatory compliance (GDPR, NIS2 where relevant).
6. Summarize findings into risks prioritized by impact and likelihood, with their potential effect on valuation or deal terms.

Documents to prepare, on the seller's side

• Up-to-date technical architecture diagrams
• Contracts and service level agreements (SLAs) with critical vendors
• Results of the latest security audits or tests
• Documentation on code intellectual property (including open source licenses)
• Technical org chart and level of dependency on key people

The domains typically assessed

An IT due diligence prepared in advance, with an assessment framework shared by both parties, turns an exercise often seen as a hurdle into a negotiation tool grounded in sourced facts rather than impressions. It cuts both ways, though: well documented gaps also give the buyer concrete grounds to renegotiate price or warranties, something the seller is better off anticipating than discovering mid negotiation.