Technical due diligence: what investors and buyers check
Funding round, acquisition or succession: what a technical due diligence examines, the most common red flags and how to prepare.
In a funding round, an acquisition or a business succession, financial and legal due diligence are a given. Technical due diligence is far less common, even though technology often accounts for a large share of a company’s value, and of its risks.
What is technical due diligence for?
It answers a simple question: can the company’s technology support its growth plan, and at what cost? The goal is not to grade the elegance of the code, but to identify the risks that could affect the value or price of the deal, and to estimate what it will take to fix them.
What gets examined
- Architecture and scalability: will the system cope with ten times more users, sites or data?
- Code quality and technical debt: automated tests, documentation, parts of the system nobody dares to touch any more.
- Security: access management, updates, backups, incident history.
- Infrastructure and costs: hosting, licences, supplier contracts and how costs are likely to evolve.
- Team and organisation: key skills, dependence on one or two people, use of vendors.
- Intellectual property: who actually owns the code, and are the open-source licences used compatible with the business model?
- Data and compliance: data protection (Swiss nFADP, GDPR), data quality and ownership.
- Processes: deployment, incident management, product roadmap.
The most common red flags
- Only one person knows the system, and they are not bound by a solid contract.
- The code was built by a vendor who keeps the rights to it.
- No tested backups, or backups that have never been restored.
- So much technical debt that every new feature takes months.
- Personal data processed without a clear legal basis or adequate security measures.
None of these is necessarily a deal-breaker. But each has a cost, which must be known before signing and factored into the negotiation.
How a due diligence works
A technical due diligence usually takes from a few days to a few weeks, depending on the size of the company. It combines a review of the documentation, interviews with the technical team and an analysis of the code and infrastructure, and ends with a report: risks ranked by severity, estimated remediation costs and recommendations.
On the sell side: get ready
If you are preparing a funding round or the sale of your company, a vendor due diligence lets you find and fix weaknesses before the buyer does. You go into the negotiation with a solid file rather than surprises that weigh on the price.
In short
Technical due diligence turns uncertainty into quantified risks. For an investor it is insurance; for a seller it is an argument. Either way, it should be carried out by someone independent of the team and vendors being assessed.