Why We Deliver Two Diligence Reports

IT due diligence is often forced to serve two audiences that should never receive the same report.

This is why we provide our clients with two.

▪ Report 1: What technology risks could affect the transaction?

The first report is for the deal team, but is structured to be shared with deal counsel, lenders, reps and warranties insurance underwriters, and other outside stakeholders.

In addition to documenting what is working well at the target company, it also documents security risks, compliance gaps, software licensing issues, technical liabilities, and other findings that may affect the purchase agreement, deal terms, or required remediation.

▪ Report 2: Can the seller’s IT systems, people, and processes support the investment thesis?

The second report is proprietary and usually stays with the PE firm.

If the thesis depends on organic growth, add-on acquisitions, geographic expansion, operating leverage, or the introduction of new products and services, this report tests whether the company’s applications, data, infrastructure, and technology organization can support the plan.

It identifies what must change, how quickly it must change, and the people and capital required to make it happen.

We’ve found that most diligence providers don’t put a heavy focus on investment thesis or they bury thesis-specific advice in the same diligence report.

Combining these two objectives in one report creates a problem.

A report that may circulate outside the deal team is not the place to fully document the investment thesis. And a report written for insurers, attorneys, lenders, and other outside stakeholders will naturally focus on current risk - not the PE firm’s post-close agenda.