IT when you buy or merge with another business

Before you sign: find out what you are taking on

Ask for an inventory of devices, servers, software, subscriptions and contracts, and who holds admin access to each. Find out who registered the domain names, who manages email and whether the business owns its accounts or relies on a contractor or a former staff member's login. Ask about any past security incidents, current support arrangements and contract end dates. Gaps in the answers are findings in themselves.

Look for liabilities that could cost real money. Hardware leases and long telco contracts may carry exit fees. Software may be licensed to the old business in a way that does not transfer. Old servers or unsupported systems may need urgent replacement. Customer or patient data may be held without the protections expected under the Privacy Act. Your lawyer and accountant handle the deal itself, but they rely on someone technical to surface these points.

Day one: secure the access

On settlement or on the merger date, take control of the admin accounts for email, domain names, the website, cloud services, firewalls and business applications. Change passwords, confirm multi-factor sign-in is enabled, and remove access for anyone who is not continuing, including former owners, contractors and old IT providers. Do this methodically from a list, because one forgotten admin account can undo everything else.

Check that backups exist and work for the acquired business's important data, and if they do not, put one in place immediately. Make sure someone is monitoring for security alerts in both environments. The period straight after an acquisition, when staff are unsettled and processes are changing, is exactly when a convincing fraudulent payment request is most likely to succeed, so warn finance teams to verify any change to bank details by a known contact method.

Decide the end state before touching anything

Agree what the combined business will look like in IT terms: one email domain or two, one Microsoft 365 or Google environment, one accounting system, one practice or job management platform, one phone system. Sometimes keeping the acquired brand's email address is important for its customers, which can be done within one environment. The decision should come from the business strategy, not from whichever system is technically easiest to keep.

Then write a sequence. Typically, security and visibility come first, followed by communication tools such as email, calendars and Teams so staff can work together, then files, then business applications, and finally devices and networks. Each stage should have a plan, a test, a communication to staff and a fallback. Avoid trying to move everything in a single weekend unless the acquired business is very small.

Bringing email and files together

Merging two email and collaboration environments is a well-trodden but detailed project. Mailboxes, calendars, shared mailboxes, file libraries and permissions need to move, and the domain names need to be set up so mail flows correctly during and after the change. Plan for a period where both environments coexist, with shared calendars or directory sync so staff can find each other and book meetings.

Clean up before moving. An acquisition is an ideal moment to archive old files, close unused mailboxes and retire shared folders that nobody has opened in years. Moving everything as-is simply transfers the clutter and the permission problems into your environment, where they become yours to manage. Ask each team in the acquired business to nominate what must move and what can be archived, and agree retention for the archive so nothing needed for legal or tax reasons is lost.

Applications, devices and contracts

Business applications are usually the hardest part, because they hold customer history, jobs, stock or financial records with their own structure. Decide whether to migrate data into your system, keep the old system read-only for a period, or run both for a time. Involve the people who use the system daily, since they know which data actually matters.

Bring acquired devices under your management and security, replacing those too old to secure properly. Review every inherited contract for internet, phones, printers, software and support, and either transfer, renegotiate or give notice in line with their terms. Keep a single register of what was inherited and what happened to it, so nothing renews quietly a year later.

Look after the people

Staff in an acquired business are often anxious, and changes to their email address, laptop or daily software can feel like a loss of identity. Explain each change in advance, why it is happening and what will stay the same. Offer short training for new systems and have support visibly available in the first days after each stage.

Ask for feedback after each phase and adjust the plan. A merger that technically succeeds but leaves half the staff unable to find their files or frustrated with new tools has not really succeeded, and early attention to the human side saves time later. A named contact in the acquired team who can relay concerns and test each stage before everyone else moves is often the most useful single step you can take.