Tech Diligence in M&A: The 9 Systems Buyers Audit Before Signing an Acquisition Agreement

Tech diligence in M&A is the buyer-side audit of a target's software, infrastructure, security, data, IP, and engineering organization to validate the purchase price and de-risk the integration plan. It is separate from financial and commercial diligence, it happens after the LOI and before the definitive agreement, and it is where deals get repriced, restructured, or walked. For a software-heavy target, tech diligence covers nine discrete systems, each with its own document request list, its own red flags, and its own bearing on the final wire.

Bain & Company estimates that technology capabilities represent 30–40% of unrealized value in acquisition targets in traditional industries undergoing digital transformation, which is why the firm bought specialist practice Tech Economy in June 2021 to expand its diligence bench. The counter-example is HP's 2011 acquisition of Autonomy for $11.1 billion: HP wrote down $8.8 billion eighteen months later, and post-mortems found Autonomy's flagship IDOL 7 database had not received a meaningful update in five years, a fact a first-week code review would have surfaced. The nine systems below are what an experienced buyer's tech diligence team pulls apart before signing.

1. Source Code and Software Architecture

The code review answers one question: can this platform scale to the buyer's growth thesis without a re-architecture? Diligence teams request a read-only repository snapshot, run static analysis (SonarQube, CodeScene), and interview the CTO and two senior engineers per major service. They look for monoliths masquerading as microservices, database coupling across "independent" services, cyclomatic complexity outliers, and test coverage below 40% on revenue-critical paths.

Actionable next step: before you sign the LOI, ask the target for a written architecture diagram, a service inventory, and last quarter's incident post-mortems. If they cannot produce all three in a week, price in a rebuild.

2. Cybersecurity Posture and Vulnerability Management

Security has moved to the top of the tech diligence stack because a post-close breach becomes the buyer's breach. Auditors verify SOC 2 Type II reports (not just Type I), ISO 27001 certification scope, penetration test reports from the last 18 months, and the target's identity stack: SSO coverage, MFA enforcement on admin accounts, secrets rotation cadence, and admin role count.

Ask specifically for the last 24 months of security incidents with root cause and remediation status. A target that reports "no incidents" is almost always misclassifying, not disclosing.

The five cybersecurity artifacts every buyer requests

SOC 2 Type II report covering the last 12 months
Two most recent third-party penetration tests
Vulnerability scan output with SLA-tracked remediation timelines
Incident register for the last 24 months
Data flow diagram showing where customer PII lives

3. Open Source and License Compliance

The Black Duck 2025 Open Source Security and Risk Analysis Report (a step-by-step audit of 947 commercial codebases submitted between November 2024 and October 2025) found open source components in 98% of codebases, with an average of 911 components per application. The mean number of open source vulnerabilities per codebase has more than doubled year over year, and license conflicts hit the highest level in the report's history.

This matters because a copyleft license like AGPLv3 buried in a proprietary product can force the buyer to open-source their code or strip the component post-close. Both are expensive. Buyers commission a third-party software composition analysis (SCA) audit — Black Duck, FOSSA, or Snyk — as a standard reps-and-warranties precondition on any deal above $10M.

Actionable next step: demand a full SBOM (software bill of materials) as a bring-down condition to closing. If the target cannot generate one, that is diligence finding #1.

4. Cloud Infrastructure and Unit Economics

Cloud spend is the fastest-growing line item in most software P&Ls, and it is the one most likely to break the buyer's model. Auditors pull the last 12 months of AWS, Azure, or GCP invoices, map spend against monthly active users, and build a unit-cost curve. A healthy SaaS target shows cloud cost per user declining or flat as usage scales; a fragile one shows it climbing.

Red flags include: 10+ fragmented AWS accounts with no centralized visibility, zero use of Reserved Instances or Savings Plans on predictable workloads, single-AZ deployments on tier-1 services, and manual scaling of production infrastructure. Any of these is a millions-of-dollars-per-year post-close fix.

The four cloud economics questions

What is COGS-per-customer, and is it flat, rising, or falling over the last four quarters?
What percentage of compute is on Reserved Instances or Savings Plans?
How many environments (dev, staging, prod) exist and what does each cost?
What is the disaster recovery RTO and RPO, and when was it last tested?

5. Data Privacy and Regulatory Compliance

GDPR, CCPA, HIPAA, PCI DSS, and (for anything touching children) COPPA all create direct regulatory exposure that transfers with the assets. Buyers verify a Record of Processing Activities (Article 30 GDPR), Data Processing Agreements with every subprocessor, and the target's response history to Data Subject Access Requests. For US healthcare targets, request the last two HIPAA risk assessments and any Office for Civil Rights correspondence.

Cross-border data transfers are the trap. If the target moves EU personal data to US infrastructure, they need Standard Contractual Clauses in place with every EU customer. Missing SCCs are grounds to escrow a portion of the purchase price until remediation.

6. Intellectual Property Ownership and Assignment

Every line of code shipping in the product must be owned by the company, not by a founder, a contractor, or an offshore agency. Buyers request signed IP assignment agreements for every employee and contractor who ever touched the codebase, plus patent assignment records and trademark registrations. Missing contractor IP assignments — common when a target used Upwork or a Ukrainian dev shop in year one — force a "clean-up" side letter that can delay close by 30–60 days.

Also verify: no open source contributions from company time under a personal GitHub handle without a CLA, no third-party pre-trained models baked into a "proprietary" AI product without a commercial license, and no university-owned IP (a shockingly common finding in academic spin-outs).

7. Engineering Team and Key Person Risk

The team is often worth more than the code. Studies of post-acquisition retention find nearly 50% of key employees leave within the first year and 75% leave within three years, with replacement costs running 50–200% of annual salary. In engineering-heavy targets, the critical 5% of headcount usually holds 80% of the tribal knowledge on the highest-revenue systems.

Diligence maps this by requesting an org chart with tenure, a "bus factor" analysis per critical service (how many people can maintain each system), and the compensation ranges for the top 20 technical hires. Buyers then negotiate retention packages — typically 12–36 month earn-outs, equity grants that vest post-close, or consulting agreements — for the founding CTO, VPs of Engineering, and any principal engineer who owns a load-bearing service alone.

The three key person risk mitigations

Retention grants (RSUs or cash) tied to 24-month cliffs for the top 5% of engineering
A documented knowledge transfer plan with named owners and deadlines
Non-solicitation clauses in the purchase agreement covering the target's leadership for 24 months

8. AI and ML Stack: Proprietary Versus Licensed

Buyers are paying AI premiums, and diligence teams are being paid to sort real from wrapper. The question is simple: is the target's AI a proprietary model trained on proprietary data, or is it an OpenAI, Anthropic, or Google Vertex API call with a UI on top? Both can be valuable, but they command very different multiples.

Request: the model card for every ML system in production, the training data provenance (with licensing for any scraped or third-party datasets), the fine-tuning pipeline, inference cost per query, and API dependency exposure. A target whose "proprietary AI" is 100% dependent on the OpenAI API is one price change away from margin collapse. Also confirm no training data was scraped in violation of terms of service — the New York Times v. OpenAI lawsuit made this a live liability issue.

9. Third-Party Integrations and Vendor Lock-In

The last system is the map of everything the target does not control. Auditors build a full vendor inventory: every SaaS subscription, every API integration, every data provider, every payment processor. For each, they log contract length, renewal terms, exclusivity clauses, and the cost of substitution.

The specific traps: a Stripe-only payment integration where the acquiring bank's own processor cannot be swapped in, a Twilio dependency at pricing that has been renegotiated three times, or a data provider (a market data vendor, a KYC provider, an enrichment API) that has a change-of-control termination clause. Change-of-control clauses hit hardest — they can void 30% of the target's vendor stack the day the deal closes.

Actionable next step: request a vendor register with contract dates, annualized cost, and a highlighted list of every agreement containing a change-of-control provision. Model the cost of re-signing each one at market rates.

The Practical Payoff: A Ready-Made Diligence Kit

Tech diligence is 60% document requests, 30% synthesis, and 10% actual analysis. Teams that build the document request list from scratch on every deal burn two weeks and still miss items. The buyers who close cleanly reuse a standard 200-line request list, a standard scorecard, a standard red-flag register, and a standard findings memo template — the same nine systems, run the same way, every time.

That is exactly the value of a pre-built M&A diligence template: the request list is already in Excel, the scorecard already weights the nine systems by dollar impact, and the findings memo already ties each red flag to a purchase price adjustment or a rep-and-warranty ask. The HP-Autonomy write-down is what happens when a diligence team runs without one. The clean close is what happens when they do not.