IT Due Diligence: How To Enhance Your Approach

IT Due Diligence: How To Enhance Your Approach

I recently read the 2016 Edition of the IT Due Diligence Guide by Jim Hoffman. It’s a valuable reference for anyone involved in mergers and acquisitions. Certainly, an acquirer who does not have a well-established process will benefit. However, I believe even experienced acquirers will find it a useful source of ideas to enhance their own approach. And it’s a great resource for sellers, who will benefit from an exhaustive understanding of the spectrum of questions they will need to address during diligence. Hoffman has 25 years of technology experience, including participating in numerous transactions from both the buy- and sell-side. Reading between the lines, he’s a very organized guy who probably kept great notes over the years.

Technical Aspects of IT Due Diligence

The book focuses on the technical aspects of due diligence, and also covers all areas to explore when assessing a company’s technology. These include: staff, products, processes, quality, infrastructure, security and a dozen or so other areas. It begins with an overview of the acquisition process and how due diligence works, which is particularly valuable for an organization not experienced in M&A. Chapters dedicated to each of the specified areas follows the overview.

A Recipe for Successful Due Diligence

Hoffman clearly designed this guide for practical use. You could literally use it as a recipe for a successful diligence. The best example is the chapter structure. The chapter for each area of diligence is organized in series of information requests. An icon highlights each request, indicating its criticality, followed by a description and an explanation of “Why This Is Important.” Hoffman also flags items to handle face to face during a site visit. As an example, the chapter called Software and Services Utilized outlines requests for lists, among other things requests for open source components used by the company (classified as a Critical Request, by the way):
A list of any open source projects utilized by the company, including the name and URL of the open source project, version, company products or services associated with license, reason used and the open source license under which the project is distributed."
It goes on to explain the potential security and license risks associated with open source. Each chapter provides this kind of detail for a particular area of diligence. The importance of an open source audit is detailed in an appendix titled Recommended Third Party Audits. You know who to talk to if you want to take Hoffman’s advice on that one.

IT Due Diligence Guides, Checklists, Forms and More

The IT Due Diligence Guide is available on a dedicated website The Guide comes in a zip file accompanied by a useful set of templates. These comprise the Guide (PDF) and Excel checklists for many of the due diligence areas. It also includes Word documents, including a comprehensive checklist to manage the overall process, a detailed report form and a template for integration planning. As a Black Duck blog reader, you qualify for 25% off with this (easy to remember) discount code: BLACKDUCK. Having been involved in M&A myself, give me half a day and I could assemble a decent due diligence check list. But I wouldn’t; I’d start with the IT Due Diligence Guide.

Request a Custom Code Analysis

Sorry we missed you! We close comments for older posts, but we still want to hear from you. Tweet @black_duck_sw to continue the discussion.


How an Open Source Software Audit Works

| Mar 20, 2017

Most of our readers understand that an open source software audit involves expert consultants analyzing a proprietary code base using Black Duck tools. The deliverable is a report that identifies open source in the code as well as associated risks. If you’d like to understand our process — what

| MORE >

Auditing Code Quality: A Broader Picture

| Mar 2, 2017

Black Duck is well-known for open source audits, but that is only a piece of the technology due diligence puzzle. Auditing code quality assesses other aspects of a company’s software assets and completely complements an open source audit. Both audit types dive into issues that impact the valuation

| MORE >

3 Areas of Open Source Risk: Legal, Security…Do You Know the Third?

| Dec 20, 2016

Looking back five or ten years, companies managing open source risk were squarely focused on license risk associated with complying with open source licenses. Beginning in 2014, when open source security vulnerabilities began to get names (like Heartbleed, Shellshock and Poodle), open source

| MORE >