Preparing your IT for due diligence when selling or raising investment

What buyers and investors look for

Buyers and their advisers want to know what they are getting and what could go wrong. In IT terms, that means understanding which systems the business depends on, who owns them, what they cost, how secure they are and whether anything is about to need expensive replacement. Increasingly, they also ask about past security incidents and how personal information is handled.

Unclear answers create doubt, and doubt affects price and terms. A buyer who discovers that the domain name is registered to a former contractor, that customer data sits on an old server with no backup, or that key software licences cannot transfer may reduce their offer, ask for warranties or walk away. Preparation turns those risks into a clean set of answers.

Prove the business owns what it uses

Check that domain names, email and collaboration platforms, cloud services, website hosting, social media accounts and business applications are registered in the business's name and controlled through business accounts. Move anything registered personally, by a founder, a former employee or a contractor, into the business's control. Store master credentials securely in a business password manager, with access held by more than one person.

Confirm intellectual property in software or systems developed for you. If a developer built custom tools, check that the contract assigns ownership to the business and that you hold the source code or access to it. Lack of clear ownership is one of the more common and more expensive issues uncovered during due diligence. The same applies to website designs, logos and content created by outside suppliers.

Document systems, contracts and licences

Prepare an IT inventory listing devices, servers, network equipment and their ages; a software and subscription register with costs, renewal dates and licence counts; and a list of IT-related contracts including internet, phones, printers, leases and support, with terms and exit conditions. Note which contracts can transfer to a new owner and which require consent.

Add a simple diagram showing how systems connect, a description of backup and recovery arrangements, and the roles of any IT providers. Buyers want confidence that the business can be run without depending on a particular person. If knowledge sits in one head, write it down now. This documentation also helps the business run better day to day, so the effort is not wasted even if a sale never happens.

Show that security and privacy are handled

Gather evidence of your security practices: multi-factor sign-in across accounts, managed and encrypted devices, email protection, tested backups, staff training and an incident response plan. A recent independent review or health check, with a record of how findings were addressed, carries real weight. So do patching reports and evidence that leavers' access was removed promptly, because they show controls operating over time rather than existing only on paper.

Be ready to describe how personal information is collected, stored and protected under the Privacy Act 2020, and to disclose any past incidents or breaches honestly. Buyers usually discover incidents eventually, and an issue that was handled well and disclosed openly is far less damaging than one found during the process. Your lawyer can advise on how best to present any historical issues within the sale documents.

Fix the obvious problems early

Look at your IT through a buyer's eyes and deal with issues that would raise concern. Replace or plan for unsupported operating systems and ageing servers, tidy permissions so former staff no longer have access, cancel unused subscriptions and consolidate scattered accounts. These are often inexpensive fixes that improve the impression the business makes. Remove personal data you no longer need, too, since holding less information means less risk to explain.

Start at least six to twelve months before you plan to go to market where possible. Some changes, such as moving systems, renegotiating contracts or transferring domains, take time, and rushing them during the sale process adds risk at the worst moment. An early start also gives you time to show that new controls are working, which is more convincing than a policy dated the week before the data room opened.

During the process

Set up a well-organised data room with the IT documents, and nominate one person to answer technical questions consistently. Be accurate rather than optimistic; warranties in the sale agreement may make you liable for statements that turn out to be wrong. Keep systems stable during the process and avoid major IT changes unless they are agreed with the buyer.

Plan the handover. A buyer will need admin access, documentation and possibly a transition period of support. Agreeing these in advance makes completion smoother and protects the value you have built. Include the IT provider in this planning, because they may need to transfer accounts, change billing or support the new owner through the first months, and a clear handover agreement avoids gaps in support or security during the change of ownership.