playbook 9 min

The PE Deal Team's Guide to IT Due Diligence in 6 Steps

PE deal teams don't need to become IT experts. They need to know what questions to ask, which answers matter, and when to push back on what the target's CTO tells them.

ACQI Research ·

Why PE Deal Teams Get Burned on IT

A private equity deal team does everything right. The financial model is clean. The management team is credible. The market thesis is compelling. The deal closes.

Then the integration starts. The IT assessment reveals four cloud tenants the target didn’t mention. 23 SaaS contracts nobody in the data room had listed. 200+ Active Directory accounts belonging to people who left 6 months ago. A legacy ERP system that runs on a physical server in a regional office that nobody on the deal team had ever heard of.

The integration is 60 days behind schedule by Week 2. This happens on the majority of PE deals. It doesn’t have to.


Step 1: Separate IT Assessment from Financial Audit

Most PE IT due diligence is done as a subsection of the financial audit. The CFO manages it. The technology findings get reported in a footnote.

The fix: IT assessment should be a parallel workstream with its own timeline, its own output format, and its own escalation path to the deal team lead. The deal team lead should receive a one-page IT Risk Summary at the same time as the financial model.


Step 2: Ask the Question the CTO Doesn’t Want to Answer

Send this to the target’s CTO before the management presentation:

“How confident are you that your IT system of record reflects 100% of the software and cloud services in use across the organization? Where are you least confident about completeness?”

CTOs who are confident will answer directly. CTOs who know they’re missing things will give a longer answer. The answer tells you what your discovery scope needs to be.


Step 3: Require a Complete Discovery Scan, Not a Questionnaire

A complete discovery scan requires API access to the target’s cloud environments, Active Directory, and M365. It takes 48-72 hours. A self-reported inventory misses shadow IT, stale accounts, overprivileged accounts, undocumented SaaS contracts, and cloud resources in non-standard subscriptions.

If the target resists providing API access for discovery, that itself is a signal.


Step 4: Build the Finding Risk Score, Not the Finding List

A 200-finding IT report is useless to a deal team. A 10-finding risk score with financial implications is actionable.

The risk score weights findings on two dimensions:

  1. Integration impact: If we don’t address this before Day 1, what breaks?
  2. Financial exposure: If we discover this post-close, what does it cost?

Step 5: Get the Day 1 IT Readiness Score Before Signing

Before the IC meeting, the deal team needs a single number: Day 1 IT Readiness Score.

A score below 70% means the deal team should be negotiating an IT-specific escrow or holdback. A score above 85% means the deal team can proceed with confidence.


Step 6: Build the Integration Workstream Before Signing

The integration workstream plan should be built by the buyer’s integration team using the discovery findings as input. It tells the IC three things: what needs to be done before Day 1, what the integration team will find in the first 30 days, and what the integration timeline risk looks like.

If the workstream plan shows 90 days of integration work that the synergy model assumed would take 30, the synergy model needs to be revised before signing.


ACQI runs complete IT discovery for PE deal teams in 48-72 hours. Request a discovery sprint.

Running an integration right now?

The research is clear: discovery-first integrations deliver on time. ACQI has the modules to get you there in weeks, not months.